openssh远程系统登录
1.概述
在Linux系统中，OpenSSH是目前最流行的远程系统登录与文件传输应用，也是传统Telenet、FTP和R系列等网络应用的换代产品。
其中，ssh（Secure Shell）可以替代telnet、rlogin和rsh，scp（Secure Copy）与sftp（Secure FTP）能后替代ftp。
OpenSSH采用密钥的方式对数据进行加密，确保数据传输的安全。在正式开始传输数据之前，双方首先要交换密钥，当收到对方的数据时，
再利用密钥和相应的程序对数据进行解密。这种加密的数据传输有助于防止非法用户获取数据信息。
OpenSSH采用随机的方式生成公私密钥。密钥通常只需生成一次，必要时也可以重新制作。
当使用ssh命令登录到远程系统时，OpenSSH服务器的sshd守护进行将会发送一个公钥，OpenSSH客户端软件ssh将会提示用户确认是否接收发送的公钥。
同时，OpenSSH客户端也会向服务器回传一个密钥，使OpenSSH连接双方的每个系统都拥有对方的密钥，因而能够解密对方经由加密链路发送的加密数据。
OpenSSH服务器的公钥与私玥均存储在/etc/ssh目录中。在OpenSSH客户端，用户收到的所有公钥，
以及提供密钥的OpenSSH服务器的IP地址均存储在用户主目录下的~/.ssh/known_hosts文件中（.ssh是一个隐藏目录）。
如果密钥与IP地址不再匹配，OpenSSH将会认为某个环节出了问题。例如，重新安装操作系统或者升级OpenSSH都会导致系统再次生成新的密钥，
恶意的网络攻击也会造成密钥的变动。因此，当密钥发生变化时，总是应当先了解密钥发生变化的原因，以确保网络访问期间的数据安全。
2.openssh服务
当主机中开启openssh服务时，那么就对外开放了远程连接的接口
openssh服务的服务端： sshd
openssh服务的客户端： ssh
3.在客户端连接sshd（服务端）的方式
格式：ssh 服务端用户@服务端ip地址
例如：
##在客户端用ssh命令连接172.25.254.130主机的root用户
[root@localhost ~]# ssh root@172.25.254.130
The authenticity of host '172.25.254.130 (172.25.254.130)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)?
#当当前主机第一次连接陌生主机时，会自动建立.ssh/know_hosts，这个文中记录的是连接过的主机信息
root@172.25.254.130's password: #输入密码连接成功
Last login: Fri Mar 30 02:05:52 2018 from 172.25.254.66
[root@localhost ~]# exit #表示退出当前连接
logout
Connection to 172.25.254.130 closed.
## -X表示开启图形
[kiosk@foundation66 Desktop]$ ssh -X root@172.25.254.230
root@172.25.254.230's password:
Last login: Tue Oct 9 07:37:39 2018 from 172.25.254.66
##打开摄像头（拍照）
[root@localhost ~]# cheese
** (cheese:2969): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-iA6qSfPzfH: Connection refused
实验1：远程连接
在虚拟机中：
##running表示服务处于开启状态
[root@localhost ~]# systemctl status sshd.service
sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: active (running) since Wed 2018-10-03 02:22:06 EDT; 2min 45s ago
Process: 1161 ExecStartPre=/usr/sbin/sshd-keygen (code=exited, status=0/SUCCESS)
Main PID: 1178 (sshd)
CGroup: /system.slice/sshd.service
└─1178 /usr/sbin/sshd -D
Oct 03 02:22:06 localhost systemd[1]: Started OpenSSH server daemon.
Oct 03 02:22:06 localhost sshd[1178]: Server listening on 0.0.0.0 port 22.
Oct 03 02:22:06 localhost sshd[1178]: Server listening on :: port 22.
Oct 03 02:24:16 localhost sshd[1598]: Accepted password for root from 172.2...h2
Hint: Some lines were ellipsized, use -l to show in full.
在真机中：
##此时可以ssh远程连接
[kiosk@foundation34 Desktop]$ ssh root@172.25.254.134
root@172.25.254.134's password:
Last login: Wed Oct 3 02:24:16 2018 from 172.25.254.34
在虚拟机中：
[root@localhost ~]# systemctl stop sshd.service
##dead 表示服务已经关闭
[root@localhost ~]# systemctl status sshd.service
sshd.service - OpenSSH server daemon #开机自启
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: inactive (dead) since Wed 2018-10-03 02:25:12 EDT; 6min ago
Process: 1178 ExecStart=/usr/sbin/sshd -D $OPTIONS (code=exited, status=0/SUCCESS)
Process: 1161 ExecStartPre=/usr/sbin/sshd-keygen (code=exited, status=0/SUCCESS)
Main PID: 1178 (code=exited, status=0/SUCCESS)
Oct 03 02:22:06 localhost systemd[1]: Started OpenSSH server daemon.
Oct 03 02:22:06 localhost sshd[1178]: Server listening on 0.0.0.0 port 22.
Oct 03 02:22:06 localhost sshd[1178]: Server listening on :: port 22.
Oct 03 02:24:16 localhost sshd[1598]: Accepted password for root from 172.2...h2
Oct 03 02:25:05 localhost sshd[1629]: Accepted password for root from 172.2...h2
Oct 03 02:25:12 localhost systemd[1]: Stopping OpenSSH server daemon...
Oct 03 02:25:12 localhost systemd[1]: Stopped OpenSSH server daemon.
Hint: Some lines were ellipsized, use -l to show in full.
在真机中：
##此时无法远程连接
[kiosk@foundation34 Desktop]$ ssh root@172.25.254.134
ssh: connect to host 172.25.254.134 port 22: Connection refused
实验2：远程操控
此过程并未一直连接234这台主机，一旦操作完成便会自动退出
##远程关闭230这台主机的图形
[root@localhost ~]# ssh root@172.25.254.234 'init 3'
The authenticity of host '172.25.254.234 (172.25.254.234)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.234' (ECDSA) to the list of known hosts.
root@172.25.254.234's password:
##远程234开启这台主机的图形
[root@localhost ~]# ssh root@172.25.254.230 'init 5'
root@172.25.254.234's password:
^CKilled by signal 2.
4.给ssh服务添加新的认证方式 (KEY认证)
客户端（client）：172.25.254.130
服务端（service）：172.25.254.230
(1）更改主机名
在desktop里：
[root@localhost Desktop]# hostnamectl set-hostname client
[root@localhost Desktop]# hostname
client
在server里：
[root@localhost ~]# hostnamectl set-hostname service
[root@localhost ~]# hostname
service
(2)删除原始配置
[root@service ~]# rm -rf /root/.ssh/*
[root@client ~]# rm -rf /root/.ssh/*
(3）在服务端生成锁和钥匙
1. 生成密钥
方式1：命令的方式
##生成密钥
[root@service ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): #保存加密字符的文件用默认
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): #设定密码；可以为空，如果想为空必须大于4位
Enter same passphrase again: #确认密码
Your identification has been saved in /root/.ssh/id_rsa. ##私钥（钥匙）
Your public key has been saved in /root/.ssh/id_rsa.pub. ##公钥（锁）
The key fingerprint is:
00:4f:b0:72:40:9f:a6:fb:91:86:d2:69:bc:7c:75:5f root@localhost
The key's randomart image is:
+--[ RSA 2048]----+
| .o o.. |
| o * |
| . * o |
| = . |
| . S |
| o + .. . E |
|. B +. . . . |
| + +.. . |
| o.. |
+-----------------+
方式2：脚本的方式自动生成密钥
##删除刚生成的密钥
[root@service ~]# rm -rf /root/.ssh/*
## <<表示输入重定向
[root@service ~]# vim create_ssh_key.sh
###################
#!/bin/bash
ssh-keygen <<EOF
EOF
##执行脚本
[root@service ~]# sh create_ssh_key.sh
[root@service ~]# cd /root/.ssh
[root@service .ssh]# ls
id_rsa id_rsa.pub
私钥（钥匙） 公钥（锁）
注意：用脚本的方式自动生成密钥时，必须以开启图形的方式连接虚拟机才能实现
2.在服务端加密ssh用户的认证（一般用公钥）
##加密root用户认证；注意后边跟的是本机ip
[root@service .ssh]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.230
##authorized_keys为锁文件；而id_rsa.pub只是生成锁文件模板
[root@service .ssh]# ls
authorized_keys id_rsa id_rsa.pub known_hosts
ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.230 ##加密认证
参数详解：
ssh-copy-id ##加密命令
-i ##指定密钥
/root/.ssh/id_rsa.pub ##密钥
root ##加密用户
172.25.254.200 ##主机ip
(3）将私钥发送给客户端
[root@service .ssh]# ls
authorized_keys id_rsa id_rsa.pub known_hosts
[root@service .ssh]# scp /root/.ssh/id_rsa root@172.25.254.130:/root/.ssh
The authenticity of host '172.25.254.130 (172.25.254.130)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.130' (ECDSA) to the list of known hosts.
root@172.25.254.130's password:
id_rsa 100% 1679 1.6KB/s 00:00
(4）测试
在客户端：
[root@client ~]# cd /root/.ssh
[root@client .ssh]# ls
id_rsa
##免密成功
[root@client ~]# ssh root@172.25.254.230
The authenticity of host '172.25.254.230 (172.25.254.230)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.230' (ECDSA) to the list of known hosts.
Last login: Sun Oct 14 09:07:47 2018 from 172.25.254.66
[root@service ~]# exit
logout
Connection to 172.25.254.230 closed.
##@1若删除私钥后,则此时免密连接失效，但还可以密码连接
[root@client .ssh]# ls
id_rsa known_hosts
[root@client .ssh]# rm -rf id_rsa
[root@client .ssh]# ssh root@172.25.254.230
root@172.25.254.230's password:
Last login: Sun Oct 14 09:14:48 2018 from 172.25.254.130
[root@service ~]# exit
logout
Connection to 172.25.254.230 closed.
##解决方案：从服务端重新再传一份钥匙即可
[root@service .ssh]# scp id_rsa root@172.25.254.130:/root/.ssh
root@172.25.254.130's password:
Permission denied, please try again.
root@172.25.254.130's password:
id_rsa 100% 1675 1.6KB/s 00:00
[root@client .ssh]# ls
id_rsa known_hosts
[root@client .ssh]# ssh root@172.25.254.230
Last login: Sun Oct 14 09:17:40 2018 from 172.25.254.130
[root@service ~]# exit
logout
Connection to 172.25.254.230 closed.
##@2若更改ssh认证服务端的配置(关闭ssh的默认认证方式)
[root@service ~]# vim /etc/ssh/sshd_config
#################
78 PasswordAuthentication no
[root@service ~]# systemctl restart sshd
##如果有钥匙便仍然可以免密连接
## known_hosts文件记录了ssh登陆信息；即只要ssh登陆过其他主机便会自动生成此文件
[root@client .ssh]# ls
id_rsa known_hosts
[root@client .ssh]# ssh root@172.25.254.230
Last login: Sun Oct 14 09:22:41 2018 from 172.25.254.130
[root@service ~]# exit
logout
Connection to 172.25.254.230 closed.
##如果没有钥匙，则无法连接
[root@client .ssh]# rm -rf /root/.ssh/id_rsa
[root@client .ssh]# ls
known_hosts
[root@client .ssh]# ssh root@172.25.254.230
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
##解决方案：还原配置/开启ssh的默认认证方式即可
[root@service ~]# vim /etc/ssh/sshd_config
#################
78 PasswordAuthentication yes
[root@client .ssh]# ssh root@172.25.254.230
root@172.25.254.230's password:
Last login: Tue Oct 9 09:28:38 2018 from 172.25.254.130
[root@service ~]# exit
logout
Connection to 172.25.254.230 closed.
注意：加密ssh用户认证必须在更改ssh认证服务端的配置之前，因为加密操作需要开启ssh的默认认证方式
##@3在服务端删除锁文件
[root@service ~]# cd /root/.ssh
[root@service .ssh]# ls
authorized_keys id_rsa id_rsa.pub known_hosts
##重新发送钥匙
[root@service .ssh]# scp id_rsa root@172.25.254.130:/root/.ssh
root@172.25.254.130's password:
id_rsa 100% 1675 1.6KB/s 00:00
##若锁文件被删除，客户端解密文件失效
[root@service .ssh]# rm -rf authorized_keys
[root@service .ssh]# ls
id_rsa id_rsa.pub known_hosts
##此时即使客户端有钥匙，也无法实现免密连接
[root@client .ssh]# ls
id_rsa known_hosts
[root@client .ssh]# ssh root@172.25.254.230
root@172.25.254.230's password:
##解决方案：在服务端copy一份锁文件即可
##再次说明id_rsa.pub只是生成锁文件的模板
[root@service .ssh]# cp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
[root@client .ssh]# ssh root@172.25.254.230
Last login: Tue Oct 9 10:24:07 2018 from 172.25.254.130
注意：
##默认无法密码连接其他用户（非root用户）
[root@client .ssh]# ssh student@172.25.254.230
student@172.25.254.230's password:
Permission denied, please try again.
##加密student用户
[root@service .ssh]# ssh-copy-id -i /root/.ssh/id_rsa.pub student@172.25.254.230
##此时便可以实现免密连接student用户
[root@client .ssh]# ssh student@172.25.254.230
Last failed login: Sat Oct 13 09:59:16 EDT 2018 from 172.25.254.230 on ssh:notty
There were 3 failed login attempts since the last successful login.
5.sshd的安全配置
##禁止原始认证方式
vim /etc/ssh/sshd_config
78 PasswordAuthentication yes|no ##开启或关闭ssh的默认认证方式
48 PermitRootLogin yes|no ##开启或关闭root用户的登陆权限
79 AllowUsers westos ##用户白名单，当前设定是只允许westos登陆
80 DenyUsers linux ##用户黑名单，当前设定是只不允许linux登陆
实验1：
##开启root用户的登陆权限（默认root用户可以的登陆）
[root@service ~]# vim /etc/ssh/sshd_config
#################
48 PermitRootLogin yes
[root@service ~]# systemctl restart sshd
[root@client .ssh]# ssh root@172.25.254.230
Last login: Tue Oct 9 10:55:52 2018 from 172.25.254.66
[root@service ~]# exit
logout
##关闭root用户的登陆权限
[root@service ~]# vim /etc/ssh/sshd_config
#################
48 PermitRootLogin no
[root@service ~]# systemctl restart sshd
[root@client .ssh]# ssh root@172.25.254.230
root@172.25.254.230's password:
Permission denied, please try again.
root@172.25.254.230's password:
实验2：
[root@service ~]# useradd westos
##注意：一定要设定密码，否则会影响后续实验
[root@service ~]# passwd westos
Changing password for user westos.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
[root@service ~]# useradd linux
[root@service ~]# passwd linux
Changing password for user linux.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
##设定白名单
[root@service ~]# vim /etc/ssh/sshd_config
#################
79 AllowUsers westos
[root@service ~]# systemctl restart sshd
[root@client ~]# ssh westos@172.25.254.230
westos@172.25.254.230's password:
Last login: Tue Oct 9 11:23:33 2018 from 172.25.254.130
[westos@service ~]$ exit
logout
Connection to 172.25.254.230 closed.
[root@client ~]# ssh linux@172.25.254.230
linux@172.25.254.230's password:
Permission denied, please try again.
linux@172.25.254.230's password:
实验3：
##设定黑名单
[root@service ~]# vim /etc/ssh/sshd_config
#################
79 #AllowUsers westos
80 DenyUsers westos
[root@service ~]# systemctl restart sshd
[root@client ~]# ssh westos@172.25.254.230
westos@172.25.254.230's password:
Permission denied, please try again.
westos@172.25.254.230's password:
[root@client ~]# ssh linux@172.25.254.230
linux@172.25.254.230's password:
Last failed login: Tue Oct 9 11:24:42 EDT 2018 from 172.25.254.130 on ssh:notty
There was 1 failed login attempt since the last successful login.
348
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
