Linux--基于ssh建立免密通道

什么是ssh服务？

SSH(Secure Shell 安全的壳)：是一种应用层的网络协议，主要用于计算机之间的加密登录

ssh服务的相关信息

端口号：22
传输协议：TCP
加密算法：非对称加密(RSA） --分为公钥和私钥

RAS加密

非对称加密，加密与解密使用的密钥不是同一密钥，其中一个对外公开，称为公钥，另一个只有所有者知道，称为私钥。 用公钥加密的信息只有私钥才能解开，反之，用私钥加密的信息只有公钥才能解开（签名验签）。
代表：RSA算法。速度慢，适合少量数据加密。对称加密算法不能实现签名，因此签名只能非对称算法。

公钥加密，私钥解密：最常用作对数据进行加密，这些数据不愿被别人看到，只能由秘钥持有者看到，我们可以使用这个方式来加密。
私钥加密，公钥解密：虽然信息会被多方看到，但是如果私钥没有泄露，数据不会被篡改。

ssh免密通道搭建

一、环境准备

两台Linux虚拟机：centos7

service：192.168.135.129

client：192.168.135.132

二、在client上

1、创建密钥对

[root@mysql_backup ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:4SgTPmnoPyTONgoDDGU2/HY0W93tGADlM23OGceQdXc root@mysql_backup
The key's randomart image is:
+---[RSA 2048]----+
| .=     .+oo.+. E|
| +..  o ....+o..o|
|.  ... +. + ++o  |
|o  ooooo . *.+.  |
|....B.. S   +    |
|.....+           |
|oo.o             |
|..=..            |
|.o ...           |
+----[SHA256]-----+

查看公钥和私钥

[root@mysql_backup ~]# cd /root/.ssh
[root@mysql_backup .ssh]# ls
id_rsa  id_rsa.pub

2、上传公钥到service的/root/.ssh/下

[root@mysql_backup .ssh]# ssh-copy-id -i /root/.ssh/
id_rsa.pub root@192.168.135.129
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.135.129 (192.168.135.129)' can't be established.
ECDSA key fingerprint is SHA256:nRgEdKz1A/bPlta0azB2znLhYCNeKt0qW+lxHxrpa7A.
ECDSA key fingerprint is MD5:05:0f:95:f5:92:5f:7f:06:ff:95:ff:6d:c7:c1:df:b6.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.135.129's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.135.129'"
and check to make sure that only the key(s) you wanted were added.

3、测试免密通道是否成功

[root@mysql_backup .ssh]# ssh 'root@192.168.135.129' mkdir /lianxi/123

三、在service机器上查看效果

[root@mysql ~]# cd /lianxi/
[root@mysql lianxi]# ls
123              192.168.135.134           ansible_playbook_web.yaml  passwd.txt
192.168.135.130  ansible_playbook_sc.yaml  index.html                 sc.conf
[root@mysql lianxi]#