SSH key-based logon and password-disabled logon practices
Preface
Whether it's a personal VPS or a server that enterprises allow access to the public network, if the SSH password authentication method for port 22 is enabled, it may also happen frequently when it is cracked by many hackers. Enterprises can use firewalls for restrictions. Common users may also use
| Creative Commons BY-NC-ND 3.0
Http://blog.csdn.net/cdztop/article/details/37983067
Last modification time: July 20, 2014
How to create an ssh-key
The ssh method is required for downloading code using repo git. Currently, the password method is not supported for downloading code, and only the ssh-
1. What is opensshis a software that provides remote access control.2. remote login via sshSSH [email protected] # LoginLouout # Log Out650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/86/F6/wKioL1fP2MCQ4wcLAAFQgJ_mgnc851.png "title=" Picture 1.png "alt=" Wkiol1fp2mcq4wclaafqgj_mgnc851.png "/>2.ssh key authentication key is divided into public Keyand
access, can specify the local private key file, so that the trouble of losing the password every time, and more than every time the password is more secure.This public key can be generated using Putty key generator, download link View official website: http://www.chiark.greenend.org.uk/~sgtatham/
/Xshell/PuTTY[SSH-2 RSA 2048]
# Generate an SSH key pair ssh-keygen-t rsaGenerating public/private rsa key pair. # We recommend that you press Enter to use the default path "Enter file
SSH key-based logon and password-disabled logon practices
Preface
Whether it's a personal VPS or a server that enterprises allow access to the public network, if the SSH password authentication method for port 22 is enabled, it may also happen frequently when it is cracked by many hackers. Enterprises can use firewalls for restrictions. Common users may also use
1. Brief description of public key and private key (two-key encryption technology:
Assume that data transmission from data transmitter A to data receiver B (take server a and client B as an example ). B now has a pair of key pairs (public and private keys). B sends the public key
Often in the Linux between the SCP command transmission files, each time the need to enter the other machine password, very troublesome. This approach allows both parties to automatically pass the key authentication without having to enter the password manually:
1,root Landing, on both sides of the machine execute the following command and return all the way to generate the RSA private
RSA and DSA algorithms. In recent years, DSA has become less secure, so it is recommended to use a key based on the RSA algorithm to establish an SSH secure connection.The basic use of SSH key is to randomly generate a private key
ObjectiveWhether it is the personal VPS or the enterprise allows public access to the server, if the open 22-Port SSH Password login authentication method, by many hacker violence to guess the broken chrysanthemum can also be a frequent tragedy. Enterprises can be restricted through firewalls, ordinary users may also be modified by 22 port and strengthen the weak password, such as protection, but the relatively safe and simple scenario is to let
Every time you log in to Linux need to enter a large number of passwords (sometimes wait a long time to enter the password, the article finally has a solution), password set too short, security is not high, long hard to remember and input trouble.Using a key to log in can not only eliminate the steps of password entry, but also improve the security of the server.1. Generate the keyExecute
SSH does not have password logon to use the public key and private key. Linux can be used to generate a public/private key pair with Ssh-keygen.There is a machine a,b (192.168.0.32). Now want a password to login to B via
If you have used a Linux operating system VPS or other server, you may often be prompted to log in at the number of times you have failed to log in.This logging failure record is actually the attacker using a script to automatically scan the entire network IP and then filter and test, the final script will use the built-in cipher group to try to log on to open 22-Port Linux server.Of course, if the login success means that your server is hacked, in addition to the search for valuable content in
installation
#ee/etc/inetd.conf
Remove the # in front of the sshd
#ee/etc/rc.conf
Add inetd_enable= "YES"
#kill-hup ' Cat/var/run/inetd.pid '
Then use Putty remote login, always end immediately, failThere's a message from the FreeBSD terminal."May 7 21:38:26 FreeBSD sshd[595]: error:could not loadHost key:/etc/ssh/ssh_host_dsa_key "
Idea put on/
a pair of keys (private key + public key) to place the public key on the server registration. When a user logs on to a server from a client, the server receives a security authentication request using the key (that is, the public key registered on the server), the server is
under the root directory of the user, and then compares it with the public key sent. If the two keys are consistent, the server uses the public key to encrypt the question and send it to the client software (putty, xshell, etc ). After receiving the question, the client can decrypt it with a local private key and then
|
| . . . |
| . |
| S |
| |
| |
| |
| |
+-----------------+
The generated private key Id_rsa is then downloaded. The Putty private key PPK file is then generated locally with the Puttygen toolAt the same time, the Id_rsa.pub file generated on the VPS is renamed Authorize
The important reason for writing this article is that many people feel unable to share a key pair directly with the Linux system when they use tortoisegit under WindowsThe reason is that tortoisegit default to use the Putty format of the Ssh-key, and the Linux system Ssh-
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.