ssh远程访问及控制

一、ssh远程管理

1.1 概述

ssh是一种安全通道协议

主要功能：实现字符界面的远程登录，远程复制

ssh对通信双方的数据传输进行加密处理，包括用户的口令，具有很好的安全性

1.2 ssh的配置文件

ssh_config：针对客户端的配置文件

sshd_config：针对服务端的配置文件（经常修改）

1.3 ssh组成结构

1、传输层协议：ssh-trans

作用：服务器认证；提供加密技术；校验数据完整；数据压缩

一般运行在TCP/IP的链接上，也可能用于其他可靠的数据流上

2、用户认证协议：ssh-userauth

向服务器提供客户端用户鉴别的功能

运行在ssh-trans之上

作用：开始执行用户认证，从底层协议接收会话标识符；认证私钥的所有权

3、连接协议：ssh-connet

将多个加密隧道分成逻辑隧道

运行在用户认证之上，提供交互式登录会话；远程命令的执行；转发TCP/IP的链接

二、实验

实验一：远程登录

[root@localhost /]# vim /etc/ssh/sshd_config 

[root@localhost /]# systemctl restart sshd

切换到虚拟机2

[root@localhost ~]# ssh -p 10022 root@192.168.147.100		//-p表示指定端口号
root@192.168.147.100's password: 							//输入虚拟机1的root用户的密码
Last login: Wed May 24 10:56:56 2023 from 192.168.147.1		//成功登陆

实验二：远程复制

2.1 复制文件

虚拟机2：

[root@localhost ~]# cd /opt/
[root@localhost opt]# touch 123.txt
[root@localhost opt]# ls
123.txt  backup  rh

虚拟机1：

[root@localhost ~]# cd /
[root@localhost /]# scp root@192.168.147.101:/opt/123.txt /opt/
root@192.168.147.101's password: 
123.txt                                                                          100%    0     0.0KB/s   00:00    
[root@localhost /]# cd opt/
[root@localhost opt]# ls
123.txt  rh

2.2 复制目录

虚拟机1

[root@localhost opt]# ls
123.txt  rh
[root@localhost opt]# mkdir aa
[root@localhost opt]# cd aa/
[root@localhost aa]# touch jkl.txt
[root@localhost aa]# ls
jkl.txt
[root@localhost aa]# echo 7458 > jkl.txt 

虚拟机2

[root@localhost /]# scp -rP 10022 root@192.168.147.100:/opt/aa /opt/		##-r：复制目录   -P：指定端口号
root@192.168.147.100's password: 
jkl.txt                                                                        100%    5     7.2KB/s   00:00

三、sftp

3.1 sftp概述

使用加密技术，基于ssh，传输效率比ftp低，但是安全性更高。使用语法和ftp相同

3.2 实验

虚拟机2

[root@localhost opt]# sftp -P 10022 root@192.168.147.100
root@192.168.147.100's password: 
Connected to 192.168.147.100.
sftp> pwd
Remote working directory: /root
sftp> cd /opt
sftp> pwd
Remote working directory: /opt    
sftp> get abcd 							##下载虚拟机1中opt目录下的abcd文件
Fetching /opt/abcd to abcd
/opt/abcd                                                                      100%    5     2.4KB/s   00:00
sftp> put qwer 							##上传虚拟机2中opt目录下的qwer文件
Uploading qwer to /opt/qwer
qwer                                                                           100%    4     2.6KB/s   00:00 
sftp> exit
[root@localhost opt]# ls
123.txt  aa  abcd  backup  qwer  rh

虚拟机1

[root@localhost opt]# ls
123.txt  aa  abcd  qwer  rh

四、用户登录限制

[root@localhost /]# vim  /etc/ssh/sshd_config 
AllowUsers 用户名 （用户名@IP 限制只能从某某终端登录）
DenyUsers 用户名
：wq！
[root@localhost /]# systemctl restart sshd

五、免密登录

5.1 过程

1. 创建秘钥对
2. 上传公钥文件
3. 导入公钥信息
4. 使用密钥对验证方式

5.2 密钥种类

rsa edusa dsa

5.3 密钥两种形式

对称密钥 非对称密钥

5.4 两种加密方式

用户账户登录密码 密钥登录

5.5 rsa免密登录

[root@localhost ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:7GaCEiKeooUERamzK4Gy1Dg/rRAveMhj/vx30veDs4U root@localhost.localdomain
The key's randomart image is:
+---[RSA 2048]----+
| .o.             |
| ..              |
|..               |
|+      .         |
|+=+     S        |
|@B+o . .    .    |
|B%*.o . =  E..   |
|Oo=+ . * o +..   |
|o..++.. o ..+..  |
+----[SHA256]-----+
[root@localhost ~]# cd .ssh
[root@localhost .ssh]# ls
id_rsa  id_rsa.pub  known_hosts
[root@localhost .ssh]# ssh-copy-id -i id_rsa.pub root@192.168.147.101
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.147.101's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.147.101'"
and check to make sure that only the key(s) you wanted were added.

[root@localhost .ssh]# ssh-agent bash
[root@localhost .ssh]# ssh-add
Enter passphrase for /root/.ssh/id_rsa: 
Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)
[root@localhost .ssh]# ssh root@192.168.147.101					//没有输入密码，实验成功
Last login: Thu May 25 00:02:54 2023 from 192.168.147.1