|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@node2 ~]
# rm -f .ssh/*
[root@node2 ~]
# ssh 192.168.30.10
The authenticity of host
'192.168.30.10 (192.168.30.10)'
can't be established.
RSA key fingerprint is a3:d3:a0:9d:f0:3b:3e:53:4e:ee:61:87:b9:3a:1c:8c.
Are you sure you want to
continue
connecting (
yes
/no
)?
yes
Warning: Permanently added
'192.168.30.10'
(RSA) to the list of known hosts.
root@192.168.30.10's password:
Last login: Tue Nov 24 17:33:25 2015 from node2
[root@node1 ~]
# logout
Connection to 192.168.30.10 closed.
[root@node2 ~]
# cat .ssh/known_hosts
192.168.30.10
ssh
-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAzanDCNAhPaTOyvmOF3zWM0LaxPTTZnYqNeRAdtiEj5F4SS3f0JRbCt9vDNELLOtOMpPwehqmvxDtfjQ4l
/3nQkMlt7FXJuLCuLSjORTEK3T5GDLXh7S8ZoiNy8TQqg
+XqfI+7GTkMpgsQ+ITbvSVXlhyOXKKCgrVQmPnIkzRSuutfJH
/PdoCz/cK3txgk8uWUdE
+OahoFcxpjZH7qk
/ly98QfgEZz36U1adH1upvd6NQzLJtFNAJapBgUmnCWriOytj2Nyu8QAHFvef9ZATUxI6vup99wfXKHBzeszWNeC9ttvKmn/qlDf2M37H3YcKJ1FJ6YM
+t77lIIh41zMdagw==
[root@node2 ~]
# ssh -2 192.168.30.10
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
|
[root@node2 ~]
# vim /etc/ssh/sshd_config
# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
#Port 22 #默认监听22号端口
port 7796
#修改监听的端口
#AddressFamily any #监听的地址家族（ipv4还是ipv6）
#ListenAddress 0.0.0.0 #默认监听在本机所有地址（ipv4）上
#ListenAddress :: #默认监听在本机所有地址（ipv6）上
# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2
#优先使用ssh v2
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key #ssh v1所用的密钥指纹
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h #对称密钥每隔一小时换一次
#ServerKeyBits 1024
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m #等待客户端执行登录操作的时长
#PermitRootLogin yes #是否允许以管理员身份直接登录；建议改为no，以普通用户登录后再su到管理员
#StrictModes yes
#MaxAuthTries 6 #最大尝试次数，避免暴力攻击
#MaxSessions 10 #最大ssh会话数
#RSAAuthentication yes
#PubkeyAuthentication yes #是否支持公钥认证
#AuthorizedKeysFile .ssh/authorized_keys #认证密钥文件
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication
yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes
# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication
yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials
yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM
yes
# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding
yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
# no default banner path
#Banner none
# override default of no subsystems
Subsystem
sftp
/usr/libexec/openssh/sftp-server
#默认启用sftp功能
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server
[root@node2 ~]
# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
[root@node2 ~]
# ss -tnl
State Recv-Q Send-Q Local Address:Port
Peer Address:Port
LISTEN 0 128 :::111
:::*
LISTEN 0 128 *:111
*:*
LISTEN 0 128 :::49553
:::*
LISTEN 0 128 :::7796
:::*
LISTEN 0 128 *:7796
*:*
LISTEN 0 128 127.0.0.1:631
*:*
LISTEN 0 128 ::1:631
:::*
LISTEN 0 128 127.0.0.1:6010
*:*
LISTEN 0 128 ::1:6010
:::*
LISTEN 0 128 127.0.0.1:6011
*:*
LISTEN 0 128 ::1:6011
:::*
LISTEN 0 128 *:49951
*:*
[root@node2 ~]
# iptables -R INPUT 4 -p tcp --dport 7796 -j ACCEPT
[root@node2 ~]
# logout
...
[c:\~]$
ssh
192.168.30.20 7796
Connecting to 192.168.30.20:7796...
Connection established.
To escape to
local
shell, press
'Ctrl+Alt+]'
.
Last login: Tue Nov 24 19:46:16 2015 from 192.168.30.1
[root@node2 ~]
#
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
[root@node1 ~]
# ssh-keygen -t rsa
Generating public
/private
rsa key pair.
Enter
file
in
which
to save the key (
/root/
.
ssh
/id_rsa
):
Enter passphrase (empty
for
no passphrase):
Enter same passphrase again:
Your identification has been saved
in
/root/
.
ssh
/id_rsa
.
Your public key has been saved
in
/root/
.
ssh
/id_rsa
.pub.
The key fingerprint is:
ca:8c:ba:06:7a:33:58:73:54:fe:f1:f6:59:89:a7:d0 root@node1
The key's randomart image is:
+--[ RSA 2048]----+
| |
| . |
| o |
| . . . |
| . .So . . . |
|. o .+ .. + E + |
|.+ o. + . o = |
|o =. + |
| oo+ |
+-----------------+
[root@node1 ~]
# ls .ssh
id_rsa id_rsa.pub known_hosts
[root@node1 ~]
# ll .ssh
total 12
-rw------- 1 root root 1675 Nov 24 21:23 id_rsa
-rw-r--r-- 1 root root 392 Nov 24 21:23 id_rsa.pub
-rw-r--r-- 1 root root 395 Nov 24 09:51 known_hosts
[root@node1 ~]
# chmod 600 .ssh/id_rsa.pub
[root@node1 ~]
# scp -P 7796 .ssh/id_rsa.pub 192.168.30.20:/root
root@192.168.30.20's password:
id_rsa.pub 100% 392 0.4KB
/s
00:00
[root@node1 ~]
# ssh-copy-id -i .ssh/id_rsa.pub '-p 7796 tesla@192.168.30.20'
tesla@192.168.30.20's password:
Now try logging into the machine, with
"ssh '-p 7796 tesla@192.168.30.20'"
, and check
in
:
.
ssh
/authorized_keys
to
make
sure we haven
't added extra keys that you weren'
t expecting.
[root@node1 ~]
# ssh -p 7796 tesla@192.168.30.20
Last login: Fri Nov 27 03:30:38 2015 from 192.168.30.1
[tesla@node2 ~]$
logout
Connection to 192.168.30.20 closed.
|
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@node2 ~]
# ls
anaconda-ks.cfg boot.iso digest Downloads httpd.crt id_rsa.pub
install
.log.syslog key2 messages.cipher Pictures Templates
test
.sh vmware-tools-distrib
awk
.txt Desktop Documents fstab httpd.csr
install
.log key1 messages Music Public
test
Videos
[root@node2 ~]
# cat id_rsa.pub >> .ssh/authorized_keys
[root@node2 ~]
# cat .ssh/authorized_keys
ssh
-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAzMvlCKm+I3UgisZAak3Os6MTcNaC2mtP8H31L+mf0m+hsrq1fXk+QTMPsel1NHkPF5k3p3aMzbar+xpw57Tv97
/amnhFATDA
+rFCwT6bHyoxV2z+UhlhAFPGzin9bbBsBAqnxtNxuCDdQPUpXgbmz7zF3Impy
/386Xt03fO3nnbcVnF5n6kMQ1tMD7x0ldPaR6N5kc92FtFMPrEKBiponsck8duW
+73zHk9alcK0Q8e7Y+KFcMJtJogQsWjzjBbcunDLpzmHN3qAFna9sHQ93Xxy2WRuqfcJT
/kYBWTHWHm7i
+xW+fKhbvvuKRARXH8nVCdumELE44xACoPbCKIThQ== root@node1
[root@node2 ~]
# ll .ssh
total 8
-rw-r--r-- 1 root root 392 Nov 27 22:59 authorized_keys
-rw-r--r-- 1 root root 395 Nov 27 19:02 known_hosts
[root@node2 ~]
# chmod 600 .ssh/authorized_keys
|
|
1
2
3
|
[root@node2 ~]
# ssh wittgenstein@192.168.30.10 hostname
wittgenstein@192.168.30.10's password:
node1
|
|
1
2
3
4
5
6
7
8
9
|
[root@node2 ~]
# scp anaconda-ks.cfg 192.168.30.10:/tmp
root@192.168.30.10's password:
anaconda-ks.cfg 100% 1282 1.3KB
/s
00:00
[root@node2 ~]
# scp -r 192.168.30.10:/root/test /tmp/
root@192.168.30.10's password:
c.txt 100% 0 0.0KB
/s
00:00
b.txt 100% 0 0.0KB
/s
00:00
[root@node2 ~]
# ls /tmp/test
b.txt c.txt
|
663
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
