ssh命令及其用户加密

1.systemctl 命令
systemctl list-units                    ##列出当前系统服务的状态
systemctl list-unit-files               ##列出服务的开机状态
systemctl status sshd                   ##查看指定服务的状态
systemctl stop sshd                     ##关闭指定服务
systemctl start sshd                    ##开启指定服务
systemctl restart sshd                  ##从新启动服务
systemctl enable sshd                   ##设定指定服务开机开启
systemctl disable sshd                  ##设定指定服务开机关闭
systemctl reload sshd                   ##使指定服务从新加载配置
systemctl list-dependencies sshd        ##查看指定服务的倚赖关系
systemctl mask  sshd                    ##冻结指定服务
systemctl unmask sshd                   ##启
systemctl set-default multi-user.target ##开机不开启图形
systemctl set-default graphical.target  ##开机启动图形

sshd的安全配置
1.禁止原始认证方式
打开/etc/ssh/ssh_config 文件
78 PasswordAuthentication no|yes        ##开启或关闭ssh的默认认证方式
48 PermitRootLogin no|yes               ##开启或关闭root用户的登陆权限
79 AllowUsers westos                    ##用户白名单，当前设定是只允许westos登陆
80 DenyUsers linux                      ##用户黑名单，当前设定是只不允许linux登陆
命令练习
1.[kiosk@foundation60 Desktop]$ systemctl list-units    //列出当前系统服务状态
UNIT                        LOAD   ACTIVE SUB       DESCRIPTION
proc-sys-fs-binfmt_misc.automount loaded active waiting   Arbitrary Executable F
sys-devices-pci0000:00-0000:00:02.0-drm-card0-card0\x2deDP\x2d1-intel_backlight.
2.[kiosk@foundation60 Desktop]$ systemctl list-unit-files  //列出服务的开机状态
UNIT FILE                   33                STATE
proc-sys-fs-binfmt_misc.automount           static
dev-hugepages.mount                         static
dev-mqueue.mount                            static
proc-fs-nfsd.mount                          static
proc-sys-fs-binfmt_misc.mount               static
sys-fs-fuse-connections.mount               static
sys-kernel-config.mount                     static
sys-kernel-debug.mount                      static
tmp.mount                                   disabled
var-lib-nfs-rpc_pipefs.mount                static
brandbot.path                               disabled
cups.path                                   enabled
systemd-ask-password-console.path           static
3[kiosk@foundation60 Desktop]$ systemctl status sshd       //查看sshd的服务状态
● sshd.service - OpenSSH server daemon
###loaded:系统初始化完成，加载过配置
###active(running) 正有一个或多个程序在系统中运行
###active(exited)   仅执行一次就正常结束服务
###active(waiting)  正在执行当中，要等其他事情处理完后，才能继续处理
###inactive         服务关闭
###enabled          服务开机启动
###disabled         服务开机不启动
###static           服务开机启动项不可被管理

   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since 六 2018-04-07 09:46:04 CST; 4h 50min ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 1489 (sshd)
   CGroup: /system.slice/sshd.service
           └─1489 /usr/sbin/sshd -D
[kiosk@foundation60 Desktop]$ systemctl stop sshd             //关闭sshd服务
4[kiosk@foundation60 Desktop]$ systemctl start sshd           //开启sshd服务
[kiosk@foundation60 Desktop]$ systemctl enable sshd           //设定开机时服务开启
PolicyKit daemon disconnected from the bus.
We are no longer a registered authentication agent.
Failed to execute operation: Message did not receive a reply (timeout by message bus)
[kiosk@foundation60 Desktop]$ systemctl disable sshd           //设定开机时服务关闭
Removed symlink /etc/systemd/system/multi-user.target.wants/sshd.service.
[kiosk@foundation60 Desktop]$ systemctl reload  sshd           //从新加载配置
[kiosk@foundation60 Desktop]$ systemctl list-dependencies sshd   //查看依耐关系
sshd.service
● ├─sshd-keygen.service
● ├─system.slice
● └─basic.target
●   ├─alsa-restore.service
●   ├─alsa-state.service
●   ├─firewalld.service
●   ├─microcode.service
●   ├─rhel-autorelabel-mark.service
●   ├─rhel-autorelabel.service
●   ├─rhel-configure.service
●   ├─rhel-dmesg.service
●   ├─rhel-loadmodules.service
●   ├─paths.target
●   ├─slices.target
●   │ ├─-.slice
●   │ └─system.slice
●   ├─sockets.target
●   │ ├─avahi-daemon.socket
●   │ ├─cups.socket
●   │ ├─dbus.socket
●   │ ├─dm-event.socket
●   │ ├─iscsid.socket

[kiosk@foundation60 Desktop]$ systemctl mask sshd   //冻结服务
Created symlink from /etc/systemd/system/sshd.service to /dev/null.
[kiosk@foundation60 Desktop]$ systemctl unmask sshd   //启用服务
Removed symlink /etc/systemd/system/sshd.service.
[kiosk@foundation60 Desktop]$ systemctl set-default multi-user.target  //开机时不开启图形
那我们可使用init 5来进入图形界面
Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.
[kiosk@foundation60 Desktop]$ systemctl set-default graphical.target  //开机时启用图形界面
Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/graphical.target.

#######
如何对外开放远程连接的接口
openssh          //开启远程连接的接口
openssh sshd      //开启服务端
openssh ssh       //开启客户端
那么如何通过主机连接虚拟机
ssh    username@id   -X
[kiosk@foundation60 Desktop]$ ssh root@172.25.254.160  //连接客户端虚拟机
The authenticity of host '172.25.254.160 (172.25.254.160)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.160' (ECDSA) to the list of known hosts.
root@172.25.254.160's password:
Permission denied, please try again.
root@172.25.254.160's password:                       //输入密码
Last failed login: Sat Apr  7 03:55:29 EDT 2018 from 172.25.254.60 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Fri Apr  6 21:48:16 2018
本次连接未加-X，所以不能打开图形功能

[root@localhost ~]# gedit

(gedit:5635): Gtk-WARNING **: cannot open display:

那如何查看id 呢
ifconfig etho
[root@localhost Desktop]# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.25.254.225  netmask 255.255.255.0  broadcast 172.25.254.255
        inet6 fe80::5054:ff:fe00:3c0b  prefixlen 64  scopeid 0x20<link>
        ether 52:54:00:00:3c:0b  txqueuelen 1000  (Ethernet)
        RX packets 686  bytes 29124 (28.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 10032  bytes 429917 (419.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
如何重置id呢？
[root@localhost Desktop]# nm-connection-editor     //修改id
注意在修改id时，首先应删除原有的id,然后再去创建添加，选用internet便于信息的传送。
子网掩码：是一个32位的地址，用于屏蔽IP地址的一部分，用于网络标识和主机标识，Ip地址在局域网上，而不是远程网上。

ip是一种在Internet上的给主机编址的方式，也称为网络协议地址。常见的IP地址，分为IPv4与
IPv6两大1.IP地址（英语：Internet Protocol Addx种在Internet上的给主机编址的方式，也称为
网络协议地址。常见的IP地址，分为IPv4与IPv6两大
IP协议实际上是一套由软件程序组成的协议软件，它把各种不同“帧”统一转换成“IP数据报”格式，
这种转换是因特网的一个最重要的特点，使所有各种计算机都能在因特网上实现互通，即具有“开>放性”的特点。
(1)A类IP地址:A类IP地址就由1字节的网络地址和3字节主机地址组成,网络地址的最高位必须是“0”。A类IP地址中网络的标识长度为8位，主机标识的长度为24位，A类网络>地址数量较少，有126个网
络，每个网络可以容纳主机数达1600多万台。
A类IP地址的子网掩码为255.0.0.0，每个网络支持的最大主机数为256的3次方-2=16777214台。

(2)B类IP地址的子网掩码为255.255.0.0，每个网络支持的最大主机数为256的2次方-2=65534台。i
B类网络地址适用于中等规模的网络，有16384个网络，每个网络所能容纳的计算机数为6万多台。
(3)C类IP地址的子网掩码为255.255.255.0，每个网络支持的最大主机数为256-2=254台
适用于小规模的局域网络，每个网络最多只能包含254台计算机。

如何进行加密
[root@localhost Desktop]# ssh-keygen           //生成锁子
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
41:91:1e:99:bb:d7:5d:5a:e5:66:ac:3d:67:ee:17:da root@localhost
The key's randomart image is:
+--[ RSA 2048]----+
|        o=       |
|       .=       .|
|       ..o     o.|
|        o.      B|
|        S. . . O |
|        . . . +o+|
|         .    oo+|
|             . Eo|
|               .o|
+-----------------+

[root@localhost Desktop]# ssh-copy-id -i  /root/.ssh/id_rsa.pub  root@172.25.254.xxx
##加密ssh用户的认证
## ssh-copy-id     加密命令
## -i    指定密匙，这里加密的是公共钥匙
##  /root/.ssh/id_rsa.pub       公共钥匙
##root@172.25.254.xxx          主机的id
                                                                                                                                    911,1         94%

The authenticity of host '172.25.254.xxx (172.25.254.xxx)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.25.254.xxx's password:        //输入服务端密码

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@172.25.254.xxx'"
and check to make sure that only the key(s) you wanted were added.
此时加密成功，那么如何从客户端连接服务端时，不需要秘密
首先我可以将我自己（服务端）的钥匙给客户端，那么此时客户端连接服务端是免密的
[root@localhost Desktop]# scp  /root/.ssh/id_rsa  root@172.25.254.qqq:/root/.ssh/
将私有钥匙给客户端，那么当客户端进入服务端时是不需要密码的
The authenticity of host '172.25.254.qqq (172.25.254.qqq)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.160' (ECDSA) to the list of known hosts.
root@172.25.254.qqq's password:              //输入客户端的密码
id_rsa                                        100% 1675     1.6KB/s   00:00


[root@localhost Desktop]# ls -a /root/.ssh/     查看服务端的.ssh
.  ..  authorized_keys  id_rsa  id_rsa.pub  known_hosts
## authorized_keys   解密
## id_rsa            私有钥匙
## id_rsa.pub        共有钥匙

root@localhost Desktop]# ssh root@172.25.254.XXX
The authenticity of host '172.25.254.XXX (172.25.254.XXX)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.XXX' (ECDSA) to the list of known hosts.
Last login: Fri Apr  6 22:22:53 2018
将服务端的密码给客户端，那么从客户端连接服务端时，是不需要密码的
通过exit 或 ctrl+d 可以退出服务端

[root@localhost Desktop]# rm -fr /root/.ssh/authorized_keys
[root@localhost Desktop]# ls -a /root/.ssh/
.  ..  id_rsa  id_rsa.pub  known_hosts
删除authorized_keys  ,那么解密文件失效
[root@localhost Desktop]# ssh root@172.25.254.XXX
root@172.25.254.XXX's password:
Last login: Sat Apr  7 05:13:58 2018 from 172.25.254.qqq
删除之后登陆时就需要 输入服务端密码
那么如何做才能才能使它恢复呢
[root@localhost Desktop]# cp  /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
[root@localhost ~]# logout
Connection to 172.25.254.xxx closed.
[root@localhost Desktop]# ssh root@172.25.254.xxx
Last login: Sat Apr  7 05:45:44 2018 from 172.25.254.qqq
## known_hosts        记录了历史信息，可通过这个文件来查看谁登陆了这台主机