当前位置 主页 > 服务器问题 > Linux/apache问题 > 最大化 缩小

    linux远程登录ssh免密码配置方法

    栏目:Linux/apache问题 时间:2019-03-08 13:54

    这篇文章主要介绍了linux远程登录ssh免密码配置方法,需要的朋友可以参考下

    一、情景

    公司刚上几台Linux,现在要把主机之间都能远程ssh免密码登陆。

    二、原理
    很简单,使用ssh-keygen 在主机A上生成private和public密钥,将生成的public密钥拷贝到远程机器主机B上后,就可以使用ssh命令无需密码登录到另外一台机器主机B上。

    三、步骤

    主机A:

    1、 生成公钥和私钥文件id_rsa和id_rsa.pub (敲3下回车即可)
    [root@bogon ~]# ssh-keygen -t rsa
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    The key fingerprint is:
    67:da:0d:79:e0:d6:2b:cd:7d:22:af:51:7e:9c:75:fe root@bogon
    The key's randomart image is:
    +--[ RSA 2048]----+
    | |
    | |
    | . |
    | . + |
    | S B o . o|
    | * * = o+|
    | . o B +.=|
    | . + +.|
    | ... E|
    +-----------------+

    2、ssh-cop-id命令会将指定的公钥文件复制到远程计算机

    [root@bogon ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@10.1.250.166
    The authenticity of host '10.1.250.166 (10.1.250.166)' can't be established.
    RSA key fingerprint is c8:9d:6d:92:55:77:3d:3e:af:f5:cb:18:80:5a:47:93.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added '10.1.250.166' (RSA) to the list of known hosts.
    reverse mapping checking getaddrinfo for bogon [10.1.250.166] failed - POSSIBLE BREAK-IN ATTEMPT!
    root@10.1.250.166's password: <主机B的登陆密码>
    Now try logging into the machine, with "ssh 'root@10.1.250.166'", and check in:

    .ssh/authorized_keys

    to make sure we haven't added extra keys that you weren't expecting.

    3、然后ssh登陆主机B验证是否需要密码

    [root@localhost ~]# ssh 10.1.250.166
    reverse mapping checking getaddrinfo for bogon [10.1.250.166] failed - POSSIBLE BREAK-IN ATTEMPT!
    Last login: Wed Oct 21 10:05:39 2015 from 10.1.250.141
    [root@bogon ~]#

    4、登陆成功后,我们需要在主机B也做下以上3步,这样就可以相互免密码ssh登陆。(如果有多台主机,每台主机都做下相同操作,以方便以后管理)。

    5、权限问题
    建议用其他用户做ssh登陆的话,调整目录文件权限
    设置authorized_keys权限

    chmod 644 authorized_keys

    设置.ssh目录权限

    chmod 700 -R .ssh

    6、要保证.ssh和authorized_keys都只有用户自己有写权限。否则验证无效。

    本文出自 “好大的刀” 博客