Linux ssh 安全配置

標籤：private   public   enter   linux   file   

Linux ssh 安全登陸

建立ssh密鑰

[[email protected] ~]# ssh-keygen -t rsa #建立密鑰

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa): # 密鑰位置

Enter passphrase (empty for no passphrase): #輸入密鑰，可以為空白

Enter same passphrase again:

Your identification has been saved in /root/.ssh/id_rsa. #私密金鑰

Your public key has been saved in /root/.ssh/id_rsa.pub. #公開金鑰

The key fingerprint is:

40:96:bf:a5:89:c2:66:a3:bd:dc:79:a3:b5:a8:1f:8d [email protected]

The key‘s randomart image is:

+--[ RSA 2048]----+

| o. |

| o. |

| .. |

| .. . |

| . .S= |

| * .o+ |

| = oE o |

| .... =o. |

| ++*o.. |

+-----------------+

[[email protected] .ssh]# ls

id_rsa id_rsa.pub #把公開金鑰上傳到遠端linux機器上

[[email protected] .ssh]#

[[email protected] ~]# clear

[[email protected] ~]# ssh-copy-id -i .ssh/id_rsa.pub [email protected]

The authenticity of host ‘10.0.0.2 (10.0.0.2)‘ can‘t be established.

RSA key fingerprint is fb:82:7c:05:f1:74:86:47:52:64:87:3c:86:fd:cd:ee.

Are you sure you want to continue connecting (yes/no)? yes #第一次需要確認一下

Warning: Permanently added ‘10.0.0.2‘ (RSA) to the list of known hosts.

[email protected]‘s password:

Now try logging into the machine, with "ssh ‘[email protected]‘", and check in:

.ssh/authorized_keys

to make sure we haven‘t added extra keys that you weren‘t expecting.

[[email protected] ~]#

[[email protected] ~]# ssh 10.0.0.2

Enter passphrase for key ‘/root/.ssh/id_rsa‘: #需要輸入密鑰

Last login: Wed Oct 29 16:47:08 2014 from 10.0.0.1

[[email protected] ~]# ls -a .ssh/

. .. authorized_keys # 公開金鑰查看ok

[[email protected] ~]# # 重啟一下ssh就ok了。

為了使系統更加安全，關閉密碼認證啟用密鑰認證

[[email protected] ~]# vi /etc/ssh/sshd_config

Protocol 2 #啟用ssh2

PubkeyAuthentication yes #啟用密鑰認證

AuthorizedKeysFile .ssh/authorized_keys #密鑰存放位置

PasswordAuthentication no #關閉密碼認證

[[email protected] ~]# /etc/init.d/sshd restart #重啟ssh 服務

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_1414723386sT7m.png" />

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_1414723386rPPC.png" />

把系統預設的22連接埠改為四位元連接埠，並且修改ssh檔案

vi /etc/ssh/sshd_config

如果需要登陸，將公開金鑰的檔案拷貝出來就ok了。

如果需要使用工具的話，那麼可以在工具上配置密鑰

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_1414723387LXql.png" />

前面建立的是單向的密鑰

建立雙向金鑰組兩個機器都執行 # ssh-keygen t rsa 使用相同的密鑰

將產生的密鑰拷貝對方機器~/.ssh/ 目錄下 並且更改名字為 authorized_krys（兩個名字修改後拷貝對方的使用者~/.ssh/ 目錄下） 修改sshd_config 檔案

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_1414723387AFCm.png" />

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_1414723387H7TF.png" />

測試

650) this.width=650;" src="http://img1.51cto.com/attachment/201410/31/4484443_14147233872gbr.png" />

不需要任何認證，還有鎖定網路ip等

Linux ssh 安全配置