云野 Past-运维运维 2022-04-25

Linux中的远程登陆服务

一.Openssh的功能

sshd服务的用途

作用：可以实现通过网络在远程主机中开启安全shell的操作
Secure SHell ===>ssh ##客户端
Secure SHell daemon ===>sshd ##服务端

安装包 openssh-server

主配置文件 /etc/ssh/sshd_conf

默认端口 22

客户端命令 ssh

二.ssh

基本用法

ssh [–l远程主机用户]<ip|hostname>

ssh-l root192.168.2.200
通过ssh命令在free2主机中以root身份开启远程shell 
[root@free2 ~]#  ssh -l root192.168.2.200
The authenticity of host'192.168.2.200 (192.168.2.200)'can't be established. 
ECDSA key fingerprint is SHA256:1uLJ3EuYzt16BrtDrGdbjOY6wxCZcfppTLSwTI3BuCs. 
Are you sure you want tocontinueconnecting (yes/no/[fingerprint])? yes #身份证明生成过程确认

作用

当收入<yes>后

200主机会向当前主机发送身份公钥,并保存此公钥到~/.ssh/know_hosts

200主机持有私钥当客户主机再次连接时会对客户主机进行身份验证

如果身份验证改变拒绝连接效果如下

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@  WARNING:REMOTE HOST IDENTIFICATION HAS CHANGED!  @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! 
Someone could be eavesdropping on you right now (man-in-the-middle attack)! 
It is also possible that a host key has just been changed. 
The fingerprintforthe ECDSA key sent by the remote host is SHA256:1uLJ3EuYzt16BrtDrGdbjOY6wxCZcfppTLSwTI3BuCs. 
Please contact yoursystemadministrator. Add correct host key in/home/lee/.ssh/known_hosts to get rid of this message. 
Offending ECDSA key in/home/lee/.ssh/known_hosts:1 
ECDSA host keyfor 192.168.2.200has changed and you have requested strict checking. 
Host key verification failed.

当连接因为认证问题被拒绝时解决方案

vim -rf ~/.ssh/know_hosts ##在此文件中删除报错提示相应的行即可

ssh 常用参数

-l    ##指定登陆用户
-i    ##指定私钥
-X    ##开启图形
-f    ##后台运行
-o    ##指定连接参数
      ssh -l root@192.168.2.200.x -o "StrictHostKeyChecking=no" 首次连接不许要输入yes
-t    ##指定连接跳板
      ssh -l root 192.168.2.100 -t ssh -l root 192.168.2.200

三.sshd key认证

认证类型

1.对称加密

加密和解密是同一串字符

容易泄漏

可暴力破解

容易遗忘

2.非对称加密

加密用公钥，解密用私钥

不会被盗用

攻击者无法通过无密钥方式登陆服务器

生成非对称加密密钥

方法1

[root@free1 Desktop]# ssh-keygen
Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa):   ##输入保存密钥文件 
Enter passphrase (empty for no passphrase):   ##密钥密码 
Enter same passphrase again:   ##确认密码 
Your identification has been saved in /root/.ssh/id_rsa. ##私钥 
Your public key has been saved in /root/.ssh/id_rsa.pub. ##公钥 
The key fingerprint is: SHA256:Dml0KdfKvk72cCh2xNr1o3dnnjBBkq5dfN1it7t+V1E root@free1
The key's randomart image is: