How to use Ssh-keygen

I. Overview

1, is to allow two Linux machines between the use of SSH does not require a user name and password. Digital signature RSA or DSA is used to complete this operation.

2. Model Analysis

Suppose a (192.168.20.59) is a client machine, B (192.168.20.60) is the target machine;

To achieve the purpose:
A machine SSH login B machine does not need to enter a password;
Encryption mode RSA|DSA can be selected, the default DSA

Second, the specific operation process

The operation process of one-way landing (can satisfy the above purpose):
1. Log In a machine
2, Ssh-keygen-t [RSA|DSA], will generate a key file and a private key file id_rsa,id_rsa.pub or id_dsa,id_dsa.pub
3. Copy the. pub file to the. SSH directory of the B machine, and cat id_dsa.pub >> ~/.ssh/authorized_keys
4, finished, from a machine login B machine's target account, no longer need password; (direct running #ssh 192.168.20.60 )

Two-way landing operation process:

1, Ssh-keygen do password authentication can make in to the other side of the machine ssh, SCP does not use the password. The method is as follows:
2, two nodes perform the operation:#ssh-keygen-t RSA
Then all returns, with default values.

3, this generates a pair of keys, stored in the user directory ~/.ssh.
test the public key into the user directory of the other machine and copy it to ~/.ssh/authorized_keys (Operation command:#cat id_dsa.pub >> ~/.ssh/authorized_keys ).

4. Set file and directory permissions:

Set Authorized_keys Permissions
$ chmod Authorized_keys
Set the. SSH directory permissions
$ chmod 700-r. SSH

5, to ensure that. ssh and Authorized_keys only the user has write permission. Otherwise, validation is not valid. (Today is the problem, looking for a long time the problem), in fact, think carefully, this is done so as not to appear system vulnerabilities.

When I visit 20.59 from 20.60, I notice the following error:

1The authenticity of host ' 192.168.20.59 (192.168.20.59) ' can ' t be established.2RSA Key fingerprint is 6a:37:c0:e1:09:a4:29:8d:68:d0:ca:21:20:94:be:18.3Is you sure-want toContinueConnecting (yes/no)?Yes4warning:permanently added ' 192.168.20.59 '(RSA) to the list of known hosts.5[email protected] ' s password:6Permission denied, pleaseTryagain.7[email protected] ' s password:8Permission denied, pleaseTryagain.9[email protected] ' s password:TenPermission denied (Publickey,gssapi-with-mic,password).

Iii. Summary of matters needing attention

1, file and directory permissions must not be set to chmod 777. This privilege is too large, unsafe, and digital signatures are not supported. I'm starting to figure out how to do it.

2, the generated RSA/DSA signature of the public key is for the other machine to use. This public key content is also copied to the Authorized_keys

3. Access between Linux direct SSH machine IP

4, a machine generates its own RSA or DSA digital signature, the public key to the target machine, and then the target machine to set the relevant permissions (public and Authorized_keys permissions), the target machine can be generated digitally signed by the machine without password access

How to use Ssh-keygen