linux使用秘钥访问

一、linux之间使用秘钥登录

1、资源分配

名称	ip
跳板机	10.0.0.21
node2	10.0.0.22
node3	10.0.0.23

2、需要实现场景

使用跳板机通过秘钥的方式来远程访问资源下的机器

3、实现原理

1、再跳板机上生成一个秘钥对，将公钥分别发送到每个需要管理的远程主机下或者拷贝放到/root/.ssh/authorized_keys文件下即可
2、没有/root/.ssh/authorized_keys文件可以新建一个加上600的权限即可
3、跳板机会拿着私钥去访问远程主机，这个时候远程主机会读取本机上的公钥是否和跳板机的私钥是一个秘钥对，正确校验通过就会成功访问

4、操作步骤

第一步：跳板机上生成密钥对

ssh-keygen -t rsa

[root@node_01 ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:zOb8yE3qyDG71sCWUyElPZELcYh1U6PAWLL5oOeZeq4 root@node_01
The key's randomart image is:
+---[RSA 2048]----+
|    .**=*+o      |
|    o+===o .     |
|    +  o.+       |
|   . o oo        |
|  . ...oS        |
|   o o*+         |
|    +.o+o .      |
|   ....*.*       |
|  E+..=o= o      |
+----[SHA256]-----+

公钥会放在/root/.ssh/id_rsa.pub
私钥会放在/root/.ssh/id_rsa

第二步：将公钥分别发送到各个需要访问的主机上即可

第一种方式：使用ssh-copy-id user@remote_ip发送到远程主机

ssh-copy-id user@remote_ip

[root@node_01 ~]# ssh-copy-id root@10.0.0.22
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@10.0.0.22's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@10.0.0.22'"
and check to make sure that only the key(s) you wanted were added

这个时候可以在远程主机上看到/root/.ssh/authorized_keys 有公钥写入的
[root@node_02 ~]# cat /root/.ssh/authorized_keys 

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGLsIRGJc0cEkd19lxLzIqqiiSelziGS9qT7fXhZ+5DiHMJ6gLfujevKdprVHUvcr10V7U5pdowX6oGq7gF3cQtC0klCZAKDpsxuX4GHZ5I26Ilm0SlroLfKI2RjhSxzwLYrmQm6Yfc59TxmHC4c1aNp4LfPtMgt7ZTUdaJamwzlQpyf5xFDm5E4Z3TnF5yJolReK9bCvrY9aIk9RIgndhO6nadh2UAOl6L2yVLlgBs5qQe2G0+fB2FZqrlgMZAYzA2VHu8SXuZDKUiE0I6nmU4MYVtaNdykjMhK6fGBciZEkLcVX9ZbdhK3ZzmoReenPYx0iEubnjPjRKy3Gd+4JP root@node_01

第二种方式：使用拷贝的方式直接将跳板机公钥拷贝到远程主机的/root/.ssh/authorized_keys文件即可

第三步：测试验证

[root@node_01 ~]# ssh root@10.0.0.22
Last login: Sat Sep  2 22:43:24 2023 from node_01
[root@node_02 ~]#