SSH 为 Secure Shell 的缩写,SSH 为建立在应用层基础上的安全协议,
SSH是目前较可靠,专为远程登录会话和其他网络服务提供安全性的协议,
利用 SSH 协议可以有效防止远程管理过程中的信息泄露问题。
使用SSH,还有一个额外的好处就是传输的数据是经过压缩的,所以可以加快传输的速度。SSH有很多功能,它既可以代替Telnet,又可以为FTP、PoP、甚至为PPP提供一个安全的通道。
1.ssh语法
ssh:远程执行命令后返回信息并退出
-p port:远程服务器监听的端口
-b:指定连接的源IP
-v:调试模式
-C:压缩方式
-X: 支持x11(图形)转发
-Y:支持信任x11转发
ForwardX11Trusted yes
-t: 强制伪tty分配
2.基于密钥的登录方式
1 首先在客户端生成一对密钥(ssh-keygen)
2 并将客户端的公钥ssh-copy-id 拷贝到服务端
3 当客户端再次发送一个连接请求,包括ip、用户名
4 服务端得到客户端的请求后,会到authorized_keys中查找,如果有响应的IP和用户,就会随机生成一个字符串,例如:acdf
5 服务端将使用客户端拷贝过来的公钥进行加密,然后发送给客户端
6 得到服务端发来的消息后,客户端会使用私钥进行解密,然后将解密后的字符串发送给服务端
7 服务端接受到客户端发来的字符串后,跟之前的字符串进行对比,如果一致,就允许免密码登录
具体步骤:
1.准备环境:
centos8 ip:192.168.136.219 控制端
centos8 ip:192.168.136.145 受管端
2.首先生成一对密钥
[root@master ~]# ssh-keygen -t rsa #t:加密算法
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):#密钥自动创建并且保存在.ssh下,ls-al查看:id_rsa id_rsa.pub known_hosts
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): #输入密钥密码
Enter same passphrase again: #再次输入密钥密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:dIOwBUpEt5KxfZrRGXlxE9+Kh+/LqZXmPZaG1CYwgNg root@master
The key's randomart image is:
+---[RSA 3072]----+
| o= *.+...+. |
| . O E.=.. o . |
| = = *.+ . .|
| . * . + o . |
| o S = + |
| = + |
| . O .|
| B B |
| ..O.o|
+----[SHA256]-----+
3.发送密钥到受管端
[root@master ~]# ssh-copy-id root@192.168.136.145
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.136.145 (192.168.136.145)' can't be established.
ECDSA key fingerprint is SHA256:SEhN+MsuyBvAaWMPriq++QOreGxs75+A4Xy4lk9P4mw.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes #是否连接
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.136.145's password: #输入受管主机的密码
Number of key(s) added: 1 #添加的密钥数
Now try logging into the machine, with: "ssh 'root@192.168.136.145'"
and check to make sure that only the key(s) you wanted were added.
4.使用ssh-agent代理免密操作
[root@master ~]# ssh-agent bash #启动代理更新
[root@master ~]# ssh-add #添加代理的密钥文件
Enter passphrase for /root/.ssh/id_rsa: #输入密钥密码
Identity added: /root/.ssh/id_rsa (root@master)
[root@master ~]# ssh root@192.168.136.145
Activate the web console with: systemctl enable --now cockpit.socket
Last login: Wed Jul 14 10:27:50 2021 from 192.168.136.219
[root@slave ~]# #不输入密码直接登录到受管主机界面了
#重启则重新刷新代理才生效
3.加深操作
1.ansible运维工具,主机配置文件加入受管主机ip
## green.example.com
## blue.example.com
## 192.168.100.1
## 192.168.100.10
[web]
192.168.136.145
2.ansible利用模块ping
[root@master ~]# ansible web -m ping
192.168.136.145 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/libexec/platform-python"
},
"changed": false,
"ping": "pong" #可以看到不需要密码还安全
}
[root@master ~]# ansible web -a "yum -y install httpd"
(9/9): httpd-2.4.37-40.module_el8.5.0+852+0aafc 2.5 MB/s | 1.4 MB 00:00
--------------------------------------------------------------------------------
总计 1.4 MB/s | 2.0 MB 00:01
运行事务检查
事务检查成功。
运行事务测试
事务测试成功。
4.密钥管理
#查看私钥
ssh-add -l
#查看私钥对应的公钥
ssh-add -L
#移除指定的私钥
ssh-add -d id_rsa
#移除所有的私钥
#ssh-add -D