rhce第二次作业

1.ssh免密登录：准备两台Linux虚拟机，第一台可以免密登录到第二台机器
ssh禁止root用户远程登录

准备两台虚拟机并保证可以ping通网络，ip地址不一样

 在第一台输入ssh-keygen -t rsa生成公钥和私钥

ssh-keygen -t rsa

[root@bogon ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:mASZNul0L8zgfKrhm3/BXlW3mFvbb3xz0CQ2weM48iY root@bogon
The key's randomart image is:
+---[RSA 2048]----+
|    .+       .   |
|    O..     . =  |
|   * *..   . * + |
|    +.=o. o = B .|
|     +o.S. o = B |
|  . . o . E + o o|
| . o . o   o   o.|
|  o.  o        .*|
|  oo..         .+|
+----[SHA256]-----+

接着输入命令：ssh-copy-id -i /root/.ssh/id_rsa.pub root@第二台主机号

[root@bogon ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.30.133
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.30.133 (192.168.30.133)' can't be established.
ECDSA key fingerprint is SHA256:6UfzHauTWX6EHbJ9znzXbdOEst4bkV9w1QoehusJQ2M.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.30.133's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.30.133'"
and check to make sure that only the key(s) you wanted were added.

远程拷贝秘钥，第一次需要输入一次密码。
到这里，第一台已经可以实现免密登录第二台了。
输入命令：ssh 第二台机ip地址

[root@bogon ~]# ssh 192.168.30.133
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Wed Nov  9 18:53:19 2022 from 192.168.30.1

第二台也是同样的方式来实现。
首先在第二台机器上输入：ssh-keygen -t rsa生成公钥和私钥
也是一路按回车。
接着输入命令：ssh-copy-id -i /root/.ssh/id_rsa.pub root@第一台主机号
远程拷贝秘钥，第一次需要输入一次密码。
然后第二台已经可以实现免密登录第一台了。
至此，两台主机互相实现免密登录。

2.http：配置基于不同IP的访问不同的站点，要求默认首页文件为 first.html

一、一些基础知识：

 clientHello:
1.ssl/tls的协议版本
2.cipher suite加密套件
3.client_random

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
TLS: 使用的协议
ECDHE_ECDSA: 非对称加密算法
AES_256: 对称加密算法
GCM_SHA384: 完整性校验(hash算法)

ServerHello:
随机数：Random: 7de9b470d34f2a3bdec634ac9f4fc53233f97d1368a017e9783dfbaf6fd45e1b
确定加密套件：Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS版本： Version: TLS 1.2 (0x0303)

certificate: 当你第一次去请求一个网站的时候，服务器会将自己的证书发送客户端，客户端去下载证书(客户端相当于获取到了证书)
                 当第一次去请求的时候，certificate必须有。第二次请求就不需要

Server Key Exchange: 服务器将密钥交换的参数发送给客户端

certificate Request(可选的)：确定如果服务器需要验证客户端的身份，那么可以要求客户端将自己的CA证书发送给服务器

serverHelloDone: 代表告知客户端： 服务器数据发送完毕

 客户端要想服务器发送数据包:
certificate(可选)： 客户端向服务器发送自己的证书, 在我们上一阶段如果有certificate Request，才会有这个数据包。只有服务器要求了才会发

client key exchange: 客户端和服务器进行密钥交换

client_key_exchange: 实质就是使用前面协商加密套件：TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) 
密钥交换算法：ECDHE_RSA，开始进行密钥交换
刚才提到两个随机数：client_random, server_random
第三个随机数：pre_master， 客户端将pre_master发送给服务器
客户端和服务器都掌握三个随机数: (client_random, server_random, pre_master)-》根据三个随机数以及加密算法计算出的会话密钥SessionKey

掌握了一个会话密钥Master Secret

Certificate Verify: 验证证书

客户端向服务器发送Change cipher Spec: 编码改变通知： 其实告诉服务器我们现在握手完成了
客户端向服务器发送Encrypted Handshake message: 对之前我们的握手的所有信息进行hash，拿到一个hash值， 发送给服务器
服务器对应的也发送这个两个消息： change cipher spec, encrypted Handshake message
 

服务器接收到客户端的 hash值之后，进行校验(整个流程中发送消息的完整性)， 校验通过了之后，发送 change cipher spec, encrypted Handshake message
客户端收到服务器发的change cipher spec, encrypted Handshake message, 认为建立的安全的连接，可以进行传输数据了
Application Data

 二、

 建立一个虚拟主机：为ssl来建立一个虚拟主机验证https
1.相当于一个站点：那你访问这个站点的时候，是不是得默认进入一个目录(/www/https)
   mkdir -p /www/https
   echo "This page is for https" > /www/https/index.html

2.设置目录的访问权限
   在/etc/httpd/conf.d/去新建一个配置文件: myssl.conf

<Directory "/www/https">
   AllowOverride None
   Require all granted
</Directory>

3.设置虚拟主机：主要是通过启用ssl来进行访问的
  <VirtualHost 192.168.233.200:443>
  DocumentRoot "/www/https"
  ServerName 192.168.233.200
  # ssl的配置
  SSLEngine on
  SSLProtocol all -SSLv3
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>

4.生成自签证书: crt, csr, key
#生成key文件
openssl genrsa -out server.key 2048
#生成csr文件
openssl req -new -key server.key -out server.csr
#生成自签证书
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

排查的步骤：
1.配置文件现在没有问题，但不代表配置文件的逻辑没有问题
2.看一下日志：先清楚日志再哪里？

1.在ens160下添加两个ip

[root@bogon conf.d]# nmcli c modify ens160 +ipv4.addresses 192.168.30.170/24
[root@bogon conf.d]# nmcli c modify ens160 +ipv4.addresses 192.168.30.180/24

2.重启ens160

[root@bogon conf.d]# nmcli c up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)

3.ip a查看时候添加成功      

[root@bogon conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:02:de:68 brd ff:ff:ff:ff:ff:ff
    inet 192.168.30.131/24 brd 192.168.30.255 scope global dynamic noprefixroute ens160
       valid_lft 1797sec preferred_lft 1797sec
    inet 192.168.30.200/24 brd 192.168.30.255 scope global secondary noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet 192.168.30.170/24 brd 192.168.30.255 scope global secondary noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet 192.168.30.180/24 brd 192.168.30.255 scope global secondary noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::8583:7396:ef3e:8054/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:fb:1c:10 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:fb:1c:10 brd ff:ff:ff:ff:ff:ff

4.创建ip文件夹

[root@bogon conf.d]# mkdir -p /www/ip/{170,180}

5.路劲切换到去/etc/httpd/conf.d目录下vim创建的同时编辑额外配置文件myhost.conf

[root@bogon conf.d]# vim myhosts.conf

6.默认首页文件first进/www/ip(对应写入)；对额外配置文件进行配置

[root@bogon conf.d]# echo "This is server page 170" > /www/ip/170/first.html
[root@bogon conf.d]# echo "This is server page 180" > /www/ip/180/first.html

7.编辑文件配置

[root@bogon conf.d]# vim myhosts.conf

<Directory "/www/ip">
     AllowOverride None
     Require all granted
</Directory>

<VirtualHost 192.168.30.170:80>
      DocumentRoot"/www/ip/170"
      ServerName 192.168.30.170

</VirtualHost>
<VirtualHost 192.168.30.180>
     DocumentRoot "/www/ip/180"
    ServerName 192.168.30.180
</VirtualHost>
~                                                                                                          
~                          

8.systemctl restart httpd服务，发现报错，提示显示vim myhosts.conf第七行有问题，发现documenroot和“”之间没有添加括号

[root@bogon conf.d]# systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2022-11-15 19:15:55 CST; 7min ago
     Docs: man:httpd.service(8)
  Process: 43853 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 43853 (code=exited, status=1/FAILURE)
   Status: "Reading configuration..."

Nov 15 19:15:55 bogon systemd[1]: Starting The Apache HTTP Server...
Nov 15 19:15:55 bogon httpd[43853]: AH00526: Syntax error on line 7 of /etc/httpd/conf.d/myhosts.conf:
Nov 15 19:15:55 bogon httpd[43853]: Invalid command 'DocumentRoot"/www/ip/170"', perhaps misspelled or defin
Nov 15 19:15:55 bogon systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
Nov 15 19:15:55 bogon systemd[1]: httpd.service: Failed with result 'exit-code'.
Nov 15 19:15:55 bogon systemd[1]: Failed to start The Apache HTTP Server.

9.更改之后重启成功并能成功访问

[root@bogon conf.d]# vim myhosts.conf
[root@bogon conf.d]# systemctl restart httpd
[root@bogon conf.d]# curl 192.168.30.170
This is server page 170