SSH密钥登录二三事

在日常使用中，除了密码登录更多的是使用密钥方式登录SSH。密钥对分成公钥和私钥，将公钥添加到需要登录的服务器用户的家目录下.ssh/authorized_keys文件中，在ssh登录时使用’-i’参数指定私钥 或 将私钥天骄到Xshell用户密钥中。

使用密钥登录通常需要经过以下步骤：

• 客户端软件：Xshell 6
• 客户端终端：Linux company 4.4.0-18362-Microsoft
• 服务端版本：OpenSSH_7.9p1 Raspbian-10+deb10u2, OpenSSL 1.1.1d 10 Sep 2019

生成登录密钥对

• 方法一：使用ssh-keygen命令生成密钥对

ssh-keygen -t 加密方式 -C 备注

mars@company:~$ ssh-keygen -t rsa #加密方式为rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mars/.ssh/id_rsa): /home/mars/.ssh/id_rsa_mars #置空使用默认路径和命名
Enter passphrase (empty for no passphrase): #置空表示不为密钥设置密码
Enter same passphrase again:
Your identification has been saved in /home/mars/.ssh/id_rsa_mars
Your public key has been saved in /home/mars/.ssh/id_rsa_mars.pub
The key fingerprint is:
SHA256:Y11r6HcjCAK35/6N0ry1e7aEeQoIdhfws1F02YmpNl4 mars@company
The key's randomart image is:
+---[RSA 3072]----+
|        .  .o +o.|
|         o . +...|
|    . .   = o    |
|     o . . @ E   |
|      = S B =    |
|     . B * + o   |
|        oo+ * =  |
|       .. o* Bo. |
|        .o+.=+.. |
+----[SHA256]-----+
mars@company:~$ cd .ssh/ && ll
total 8.0K
-rw------- 1 mars mars 2.6K Oct 26 15:22 id_rsa_mars #私钥的权限必须为0600
-rw-r--r-- 1 mars mars  566 Oct 26 15:22 id_rsa_mars.pub

• 方法二：使用Xshell客户端生成密钥对

点击Xshell菜单栏上的"工具"->“新建用户密钥生成向导”，按下图操作生成和保存密钥对。
密钥类型默认RSA，长度2048位，名称随意，密码可选，最后把用户密钥也导出来(非必要步骤，保存以备复用)。

两种方法都可以显式地看到生成文件：

文件	作用
id_rsa_mars.pub	公钥(主机密钥)，保存到服务器上，来验证请求登录用户的私钥
id_rsa_mars	私钥(用户密钥)，SSH登录时指定，提供给服务器进行登录验证

服务器注册公钥

需要把公钥添加到要登录的用户家目录下的.ssh路径下的authorized_keys文件中，一个便捷的方式是使用 ssh-copy-id 命令上传公钥，这一步需要登录用户的密码。

ssh-copy-id -i 公钥路径 登录用户名@登录主机名或ip -p 端口

mars@company:~/.ssh$ ssh-copy-id -i id_rsa_mars.pub pi@192.168.0.125 -p 22
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa_mars.pub"
The authenticity of host '[192.168.0.125]:22 ([192.168.0.125]:22)' can't be established.
ECDSA key fingerprint is SHA256:YG43kzBF5jzsbL2yo9Uw/negmUvVMyiGACksK5/ppUc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
pi@192.168.0.125's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '22' 'pi@192.168.0.125'"
and check to make sure that only the key(s) you wanted were added.

# 检查是否上传完成
pi@raspberrypi:~ $ cat .ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1BzYNq7RB5/OCXVbPIs6EGj2OjS9ug0mHpdFgWngLFAaC3/msX9kvgLvM90mklExljtCXu3mNXiPDJpItWiQJcdKn90leciEtgJQiAa/hNbIeurGrN6D9+uCYbNFjzwezTTEghXzeHCC/aP+M3M+TbyLSTAdadcSSFQJ8jgYh/wYvgeR03tSZrfwoFvkKeiep0z4P1hKz7weMPGpr+GIW3egutx/8gXfJ80ZE8ErPUsdasmsyHSNO3SjkDpXXarMkeb8bc6LLrZaxtp4uPw9M7YLcyuiLvUjyHvqM7D4Kh4bDJTXOL5mpVdAXrB3C8a32hMzwzn6REW1o6Yqh8Tl6qw==

客户端登录时指定私钥

• 方法一：使用ssh命令指定私钥

ssh -i 私钥路径 登录用户名@登录主机名或ip -p 端口

mars@company:~/.ssh$ ssh -i id_rsa_mars pi@192.168.0.125 -p 21414
Linux raspberrypi 4.19.97-v7l+ #1294 SMP Thu Jan 30 13:21:14 GMT 2020 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Oct 26 16:17:34 2020 from 192.168.137.1
pi@raspberrypi:~ $

• 方法二：使用Xshell指定用户密钥

可能出现的错误

1.权限问题，改为0600即可解决

mars@company:~/.ssh$ ssh -i id_rsa_mars -p 21414 'pi@103.46.128.21'
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for 'id_rsa_mars' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa_mars": bad permissions
pi@103.46.128.21's password:

mars@company:~/.ssh$ chmod 0600 id_rsa_mars   #修改私钥权限为0600

2.ssh -i指定密钥登录仍需要输入密码，Xshell提示所选的用户密钥未在远程主机上注册

原因是公钥(主机密钥)没有添加成功，重新添加后即可解决

ssh命令备忘

• 从某主机的80端口开启到本地主机2001端口的隧道

ssh -N -L2001:localhost:80 somemachine

现在你可以直接在浏览器中输入http://localhost:2001访问这个网站。

• 直接连接到只能通过主机B连接的主机A

ssh -t hostA ssh hostB

当然，你要能访问主机A才行。