Linux的ssh服务

1.开启sshd服务

功能：让远程主机可以通过网络访问sshd服务，开始一个安全shell
systemctl start sshd ##开启sshd服务
systemctl status sshd ##查看sshd服务状态若为active (running)则开启正常

2.客户端连接

ssh 远程主机用户@远程主机ip ##调用远程主机打开一个shell无图形
ssh 远程主机用户@远程主机ip -X ##调用远程主机图形工具
ssh 远程主机用户@远程主机ip command ##直接在远程主机运行某条命令

[kiosk@foundation62 Desktop]$ ssh root@172.25.254.10
The authenticity of host ‘172.25.254.10 (172.25.254.10)’ can’t be established.
ECESA key fingerprint is eb:24:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes ##连接陌生主机时需要建立认证关系
Warning: Permanently added ‘172.25.254.10’ (ECDSA) to the list of known hosts.
root@172.25.254.10’s password: ##远程用户密码
Last login: Sat Jan 14 10:09:19 2017
[root@localhost ~]# ##登陆成功

3.提升ssh的安全级别

/etc/ssh/sshd_config ##sshd配置文件

78 PasswordAuthentication yes|no ##是否开启用户密码认证，yes为支持no为关闭
48 PermitRootLogin yes/no ##是否允许root连接
49 AllowsUsers username1 username2 … ##仅允许username1和username2访问
50 DenyUsers username1 username2 ##仅拒绝username1和username2访问

4.sshkey加密

/etc/ssh/sshd_config ##sshd配置文件
1)ssh-keygen ##生成锁的初始文件

[root@localhost Desktop]# ssh-keygen ##生成公钥私钥工具
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): ##加密字符保存文件（建议用默认）
Enter passphrase (empty for no passphrase): ##密钥密码，必须>4个字符
Enter same passphrase again: ##确认密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
45:a7:e3:62:9f:60:ea:3c:ab:59:41:15:ce:a4:44:e2 root@localhost
The key’s randomart image is:
+–[ RSA 2048]—-+
| ..o +.. . |
| . o * . o |
| E o o + |
| . o . |
| . S . |
| = + . |
| o o |
| =. |
| o.+o |
+—————–+
[root@localhost Desktop]# ls /root/.ssh/
id_rsa ##私钥，就是钥匙
id_rsa.pub ##公钥，就是锁

2)ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.10 ##根据初始文件生成相应锁文件
ssh-copy-id ##添加key认证方式的工具
-i ##指定加密key文件
/root/.ssh/id_rsa.pub ##加密key
root ##加密用户为root
172.25.254.10 ##被加密主机ip

3)修改/etc/ssh/sshd_config中PasswordAuthentication yes/no ##开启/取消密码访问

4)scp /home/ser/.ssh/id_rsa user@172.25.25.10:/home/user/.ssh/ ##发送钥匙文件
服务器端要发送的文件位置 用户@用户ip地址:保存到用户指定位置