1.客户端(mac)
为了安全起见,不要在服务器上生成公私钥下发。而是应该让用户再自己电脑上生成公私钥,上传到服务器上
生成证书
保险起见,加上密码
yourusername@name: cd ~/.ssh
yourusername@name:ssh-keygen -t rsa
Enter passphrase (empty for no passphrase):XXXXXX
Enter same passphrase again:XXXXXX
Your identification has been saved in /Users/yourusername/.ssh/yourusername.pem
Your public key has been saved in /Users/yourusername/.ssh/yourusername.pem.pub
设置权限
chmod 400 ~/.ssh/yourusername.pem
2.服务器端
创建用户
创建用户、修改密码
[root@VM ~]# adduser linuxusername
[root@VM_~]# passwd linuxusername
Changing password for user it.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
拷贝客户端的公钥
root下 将用户的证书复制到服务器,并移动到 ~/.ssh/
目录下,导入公钥
cat ~/.ssh/yourusername.pub >> ~/.ssh/authorized_keys
文件夹权限设置
root下 设置文件和文件夹权限
chown -R 0700 ~/.ssh
chown -R 0644 ~/.ssh/authorized_keys
chown -R linuxusername:linuxusername /home/linuxusername
root下 开启SELinux时,还需要执行(root用户把/home改成/root)
restorecon -R -v /home
修改SSH配置文件
root下 修改SSH配置文件,支持使用证书登录
vi /etc/ssh/sshd_config
插入以下代码
RSAAuthentication yes
StrictModes no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
重启SSH服务
systemctl restart sshd.service
3.客户端登录方法
ssh -i ~/.ssh/yourusername.pem linuxusername@ip/domain
输入证书密码:XXXXXX