The SSH connection between computers without passwords

原创 2011年10月18日 11:29:36

关于SSH服务器, 鸟哥私房菜上有一个比较详细的解释: 关于SSH服务器


Secure Shell or SSH is a network protocol that allows data to be exchanged using a secure channel between two computers. SSH uses public-key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user. However, before the user is given a login prompt, a key will be generated to encrypt and decrypt all of the data that will be passed between the two computers. That is, more is happening behind the scenes.


Generally there are three ssh keypairs which are used by corresponidng SSH protocal such SSH1.0, SSH-RSA, SSH-DSA. These key pairs are located in /etc/ssh/ssh_host*. One pair key could represent the key of the Host. 这些密钥是在sshd服务器启动时自动生成的:/etc/init.d/sshd restart  

当客户端通过ssh连接服务端时,服务端的公钥将被copy到客户端的~/.ssh/knowhosts中,The key pair would be used to be copied to the known_hosts files of client.

Once user logins to a remote host using ssh command successfully, defaultly the host key of the Host would be added to the locally $HOME/.ssh/known_hosts file using the (hostname,(or)ip,key) pair. 


下面插入一些从鸟哥网站上拿来的,一些知识上的盲点。SSH服务器端和客户端通过SSH协议通信流程如下:

  1. 服务器建立公钥档: 每一次启动 sshd 服务时,该服务会主动去找 /etc/ssh/ssh_host* 的档案,若系统刚刚安装完成时,由于没有这些公钥档案,因此 sshd 会主动去计算出这些需要的公钥档案,同时也会计算出服务器自己需要的私钥档;

  2. 客户端主动联机要求: 若客户端想要联机到 ssh 服务器,则需要使用适当的客户端程序来联机,包括 ssh, pietty 等客户端程序;

  3. 服务器传送公钥档给客户端: 接收到客户端的要求后,服务器便将第一个步骤取得的公钥档案传送给客户端使用 (此时应是明码传送,反正公钥本来就是给大家使用的!);

  4. 客户端记录/比对服务器的公钥数据及随机计算自己的公私钥: 若客户端第一次连接到此服务器,则会将服务器的公钥数据记录到客户端的用户家目录内的 ~/.ssh/known_hosts 。若是已经记录过该服务器的公钥数据,则客户端会去比对此次接收到的与之前的记录是否有差异。若接受此公钥数据, 则开始计算客户端自己的公私钥数据;

  5. 回传客户端的公钥数据到服务器端: 用户将自己的公钥传送给服务器。此时服务器:『具有服务器的私钥与客户端的公钥』,而客户端则是: 『具有服务器的公钥以及客户端自己的私钥』,你会看到,在此次联机的服务器与客户端的密钥系统 (公钥+私钥) 并不一样,所以才称为非对称式密钥系统喔。

  6. 开始双向加解密: (1)服务器到客户端:服务器传送数据时,拿用户的公钥加密后送出。客户端接收后,用自己的私钥解密; (2)客户端到服务器:客户端传送数据时,拿服务器的公钥加密后送出。服务器接收后,用服务器的私钥解密。

在上述的第 4 步骤中,客户端的密钥是随机运算产生于本次联机当中的,所以你这次的联机与下次的联机的密钥可能就会不一样啦! 此外在客户端的用户家目录下的 ~/.ssh/known_hosts 会记录曾经联机过的主机的 public key ,用以确认我们是连接上正确的那部服务器。

ssh -f 参数和-o参数的妙用,简单的说就是-f可以通过将ssh在远程执行的命令进行执行而客户端不用等其返回,而-o就是默认接受将远程的公钥放到本地的known_hosts文件中,但是-o只是一个开启参数,后面还要跟StrictHostKeyChecking=no:

选项与参数:
-f :需要配合后面的 [指令] ,不登入远程主机直接发送一个指令过去而已;
-o 参数项目:主要的参数项目有:
 ConnectTimeout=秒数 :联机等待的秒数,减少等待的时间
 StrictHostKeyChecking=[yes|no|ask]:预设是 ask,若要让 public key
           主动加入 known_hosts ,则可以设定为 no 即可。
-p :如果你的 sshd 服务启动在非正规的埠口 (22),需使用此项目;
[指令] :不登入远程主机,直接发送指令过去。但与 -f 意义不太相同。

#  登入对方主机执行过指令后立刻离开的方式:
[root@www ~]# ssh student@127.0.0.1 find / &> ~/find1.log
student@localhost's password:
# 此时你会发现怎么画面卡住了?这是因为上头的指令会造成,你已经登入远程主机,
# 但是执行的指令尚未跑完,因此你会在等待当中。那如何指定系统自己跑?
#  与上题相同,但是让对方主机自己跑该指令,你立刻回到近端主机继续工作:
[root@www ~]# ssh -f student@127.0.0.1 find / &> ~/find1.log
# 此时你会立刻注销 127.0.0.1 ,但 find 指令会自己在远程服务器跑喔!
# 删除掉 known_hosts 后,重新使用 root 联机到本机,且自动加上公钥记录
[root@www ~]# rm ~/.ssh/known_hosts
[root@www ~]# ssh -o StrictHostKeyChecking=no root@localhost
Warning: Permanently added 'localhost' (RSA) to the list of known hosts.
root@localhost's password:
# 如上所示,不会问你 yes 或 no 啦!直接会写入 ~/.ssh/known_hosts 当中!


the process:
(1) ssh abc@10.0.0.1
The authenticity of host '10.0.0.1 (10.0.0.1)' can't be established.
RSA key fingerprint is 22:69:d7:05:23:c6:db:d9:55:2a:20:a3:34:bd:f4:ef.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.1' (RSA) to the list of known hosts.
Password:
(2) then next time he could loggin to this host just input the password.

Said for an example, I have a Linux cluster (called bbom with the IP 192.168.0.100) running on 2 machines(active/standy mode), called A and B, with sperately IP 192.168.0.6 and 192.168.0.7.  These two computers could swtich over to each other once the other encounters a problem. and usually users are connect using the hostname or IP address to the cluster, when SWO happens, mostly, they would encounter a warning:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
44:28:35:a0:79:94:d8:fd:e3:78:68:3d:ce:7a:59:5d.
Please contact your system administrator.
Add correct host key in $HOME/.ssh/known_hosts to get rid of this message.

Offending key in $HOME/.ssh/known_hosts:2 <==冒号后面接的数字就是有问题数据行号

RSA host key for host has changed and you have requested strict checking.

Host key verification failed.

Annoying right? 

You could solve this problem by removing the $HOME/.ssh/knwon_hosts file temporarily. But if you want to solve this problem from the root, there two ways:

Option 1: 
   ssh A and type yes if required
   ssh B and type yes if required
   edit $HOME/.ssh/known_hosts
   modify known_hosts and add hostname and IP address as example below:
   bbom,192.168.0.100,192.168.0.6 ssh-rsa AAAAB32Nsomething…… (Key @ A)
   bbom,192.168.0.100,192.168.0.7 ssh-rsa AAAAB32Nsomethingelse……(Key @ B)
Option 2:
   Option 2:
   SSH to A
   Copy SSH DSA and RSA key from A to B
   ssh_host_dsa_key
   ssh_host_dsa_key.pub
   ssh_host_rsa_key
   ssh_host_rsa_key.pub
   scp /etc/ssh/ssh_host_dsa_key* B:/etc/ssh/.
   scp /etc/ssh/ssh_host_rsa_key* B:/etc/ssh/.
   /etc/init.d/sshd restart for B 

 The next step, if user wants to login to the remote host without password;
 (1)command: ssh-keygen -t rsa 
        the rsa parameter means using the rsa cryptography
    and a public-private key pair would be generated at $HOME/.ssh directory
such as id_ra, and id_ra.pub
 (2)command: ssh-copy-id -i $HOME/.ssh/id_rsa.pub  abc@IP of A
        this command would copy the id_rsa.pub key to the $HOME of abc/.ssh/authorized_keys
For the cluster, user should execute this command at every computer belong to this cluster
 (3)command: ssh abc@ip of A
         users could login a without inputing password

OK, enjoy!!


SSH Manual: http://www.employees.org/~satch/ssh/faq/ssh-faq.html 

Trouble Shootings:

the Secure Log:   /var/log/secure : many logs about the authority are in this file. This File is very important, for the ssh problems, please analyse this file.

(1)  Nov 29 10:09:57 pcp318136pcs sshd[2536]: Server listening on :: port 22.

       Nov 29 10:09:57 pcp318136pcs sshd[2536]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

 this error not affect the sshd service behaves badly, pls ignores it

(2) Nov 29 09:25:58 pcp318136pcs sshd[2174]: Authentication refused: bad ownership or modes for directory /home/feng

this problems would cause the service sshd behaves badly, should use the root account to chmod this directory and the subdirectory .ssh  be 700. 

    chmod 700 /home/feng  

    chmod 700 ~/.ssh -R

    chmod 644 ~/.ssh/* 

or when you use 'ssh users@ip' to login, the SSH would ask you passwords despite you had ssh-copy-id the pub key to this compute.

(3)Nov 29 19:43:31 pcp465599pcs sshd[3691]: pam_tally2(sshd:setcred): unknown option: reset

 this error not affect the sshd service behaves badly, pls ignores it

(4) The authenticity of host 192.168.0.xxx can't be established.  Should type yes.

For the scripts, it is a hard case,  so should use the ssh like ssh  -o StrictHostKeyChecking=no  192.168.0.xxx  Or mkdir a config file located at the $HOME.

pilotPC$ mkdir –p ~usrt/.ssh

pilotPC$ cd ~usrt/.ssh

pilotPC$ echo "StrictHostKeyChecking no" > config

pilotPC$ echo "ServerAliveInterval 300" >> config

-bash-3.2$ echo "ServerAliveCountMax 36" >> config

-bash-3.2$ chmod 600 config

(5) Permission not allowed, or when you copy-id, allays ssh said that the permission problems:

Firstly,  should add the username to the /etc/ssh/sshd_config,  

    vi /etc/ssh/sshd_config  and add the 'AllowUsers user1' to this file

Secondly, Except the usual password authorization, there is also a PAM authority, you can see the  /etc/ssh/sshd_config file, there is 

a UsePAM =yes parameter.  The problem may be this user may be locked, then the solution are as bellow:


在建立密钥系统的步骤中要记得的是:

  • Client 必须制作出 Public & Private 这两把 keys,且 Private 需放到 ~/.ssh/ 内;
  • Server 必须要有 Public Key ,且放置到用户家目录下的 ~/.ssh/authorized_keys,同时目录的权限 (.ssh/) 必须是 700 而档案权限则必须为 644 ,同时档案的拥有者与群组都必须与该账号吻合才行。

How do I lock out a user after a set number of login attempts?

by The editorial team

Version: Red Hat® Enterprise Linux® 3 and 4

The PAM (Pluggable Authentication Module) module pam_tally keeps track of unsuccessful login attempts then disables user accounts when a preset limit is reached. This is often referred to as account lockout.

To lock out a user after 4 attempts, two entries need to be added in the /etc/pam.d/system-auth file:

auth        required        /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root
account     required        /lib/security/$ISA/pam_tally.so deny=3 no_magic_root reset

The options used above are described below:

  • onerr=fail
    If something strange happens, such as unable to open the file, this determines how the module should react.
  • no_magic_root
    This is used to indicate that if the module is invoked by a user with uid=0, then the counter is incremented. The sys-admin should use this for daemon-launched services, like telnet/rsh/login.
  • deny=3The deny=3 option is used to deny access if tally for this user exceeds 3.
  • reset
    The reset option instructs the module to reset count to 0 on successful entry.

See below for a complete example of implementing this type of policy:

auth        required      /lib/security/$ISA/pam_env.so
auth        required      /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok auth        required      /lib/security/$ISA/pam_deny.so  account     required      /lib/security/$ISA/pam_unix.so account     required      /lib/security/$ISA/pam_tally.so deny=5 no_magic_root reset  password    requisite     /lib/security/$ISA/$ISA/pam_cracklib.so retry=3 password    sufficient    /lib/security/$ISA/$ISA/pam_unix.so nullok use_authtok md5 shadow password    required      /lib/security/$ISA/$ISA/pam_deny.so  session     required      /lib/security/$ISA/$ISA/pam_limits.so session     required      /lib/security/$ISA/$ISA/pam_unix.so

For more detailed information on the PAM system please see the documentation contained under/usr/share/doc/pam-&lt;version&gt;

For information on how to unlock a user that has expired their deny tally see additional Knowledgebase articles regarding unlocking a user account and seeing failed logins with the faillog command.

contributed by David Robinson

Red Hat’s customer service and support teams receive technical support questions from users all over the world. Red Hat technicians add the questions and answers to Red Hat Knowledgebase on a daily basis. Access to Red Hat Knowledgebase is free. Every month, Red Hat Magazine offers a preview into the Red Hat Knowledgebase by highlighting some of the most recent entries.


Reference: 

http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html

http://magazine.redhat.com/2007/01/25/how-do-i-lock-out-a-user-after-a-set-number-of-login-attempts/


elk(1)-趁离职总结下我前公司elk方案

elk
  • qq_14972057
  • qq_14972057
  • 2017-04-08 18:24:06
  • 970

pam_tally.so模块详细介绍

pam_tally.so模块详细介绍 来源: ChinaUnix博客  日期: 2009.06.27 00:21 (共有0条评论) 我要评论 pam_tally - login counter (ta...
  • cheungjustin
  • cheungjustin
  • 2010-03-17 17:08:00
  • 3293

Redhat关于pam_tally2计数器在每次sudo时都增加的bug

这个问题跟sudo的版本有关,有人说在sudo 1.7.6p1之后已经OK了,谨以此文献给那些被百度搞得一头雾水而谷歌又被墙的同学。 我用的sudo是1.7.2p1版本,CentOS5.9,问题现象先...
  • napolunyishi
  • napolunyishi
  • 2014-04-10 19:42:33
  • 3370

you must install the sshpass program 解决方式

安装完ansible之后,使用的时候发生如下错误:ansible 192.168.1.2 -i ./hosts -m shell -a "date" 192.168.1.2 | FAILED => t...
  • u012949658
  • u012949658
  • 2017-07-19 09:47:13
  • 1062

MySQL主从复制基础搭建

在学习配置Mysql的主从 这个文章只是 把基础主从配置通了 但是有很多设定的配置没有进行搭建 MySQL版本:5.6.24 1、修改主从配置(就是/etc/my.cnf文件) ...
  • HeatherYun
  • HeatherYun
  • 2015-05-15 17:43:06
  • 825

PAM的原理与应用

一、PAM简介PAM(Pluggable Authentication Modules,可插拔认证模块)是一种高效而且灵活便利的用户级别的认证方式。起初它是由美国Sun公司为Solaris操作系统开发...
  • shenlan211314
  • shenlan211314
  • 2011-06-27 09:56:00
  • 4748

linux登录次数限制

参阅:http://fedoranews.org/contributors/sonny_nguyen/pam/ http://yodeforever.blog.163.com/blog/static...
  • arch_seeker
  • arch_seeker
  • 2012-06-21 16:41:43
  • 2157

WARN: Establishing SSL connection without server's identity verification is not recommended解决方案

WARN: Establishing SSL connection without server's identity verification is not recommended. Accordi...
  • LANGZI7758521
  • LANGZI7758521
  • 2016-06-22 10:04:33
  • 8105

Mysql SSL

Establishing SSL connection without server's identity verification is not recommended. According to ...
  • EvanCJW
  • EvanCJW
  • 2018-04-07 10:27:21
  • 9

Ansible无法远程连接客户机

Ansible主机环境:CentOs 7 Error description: “failed”: true, “msg”: “to use the ‘ssh’ connection type wi...
  • minxihou
  • minxihou
  • 2016-12-01 22:00:28
  • 1821
收藏助手
不良信息举报
您举报文章:The SSH connection between computers without passwords
举报原因:
原因补充:

(最多只允许输入30个字)