ssh远程连接主机及sshkey加密配置

客户端连接方式

ssh 远程主机用户@远程主机ip            ##普通连接
ssh 远程主机用户@远程主机ip -X         ##调用远程主机图形工具
ssh 远程主机用户@远程主机ip command    ##直接在远程主机运行某条命令

sshkey加密配置

注：本次实验在两台虚拟机下进行，加密主机ip是172.25.254.132；客户端（获得私匙方）ip是172.25.254.232。

1.生成公钥及私钥

[root@Client  Desktop]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
c9:52:14:ba:cf:b5:d5:9c:e9:e0:50:bc:c9:f8:aa:8d root@Client 
The key's randomart image is:
+--[ RSA 2048]----+
|        o.       |
|       o   .     |
|      . .   o    |
|       + . + = o |
|      o S + * =  |
|       + . * o   |
|        o . o .  |
|         o .     |
|        E.o      |
+-----------------+

此时，可以看到在/root/.ssh/目录下生成了id_rsa及id_rsa.pub文件。id_rsa为私匙，id_rsa.pub为公匙。

[root@Client  Desktop]# ls /root/.ssh/
authorized_keys  id_rsa  id_rsa.pub  known_hosts

2.添加key认证方式

[root@Client  Desktop]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.132
The authenticity of host '172.25.254.132 (172.25.254.132)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.25.254.132's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@172.25.254.132'"
and check to make sure that only the key(s) you wanted were added.

3.分发钥匙给客户端

[root@Client  Desktop]# scp /root/.ssh/id_rsa root@172.25.254.232:/root/.ssh/
The authenticity of host '172.25.254.232 (172.25.254.232)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.232' (ECDSA) to the list of known hosts.
root@172.25.254.232's password: 
id_rsa                                        100% 1679     1.6KB/s   00:00 

4.客户端下查看钥匙

root@server Desktop]# ls /root/.ssh/
authorized_keys  id_rsa

至此，客户端便可实现免密登陆

[root@server Desktop]# ssh root@172.25.254.132
The authenticity of host '172.25.254.132 (172.25.254.132)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.132' (ECDSA) to the list of known hosts.
Last login: Tue Jul 25 22:35:00 2017
[root@Client  ~]# 

提升openssh的安全级别

**修改openssh-server配置文件**
/etc/ssh/sshd_config
78 PasswordAuthentication yes|no    ##是否开启用户密码认证，yes为支持no为关闭
48 PermitRootLogin yes|no           ##是否允许超级用户登陆
49 AllowUsers student westos        ##用户白名单，只有在名单中出现的用户可以使用sshd建立shell
50 DenyUsers westos                 ##用户黑名单
注：白名单优先级较黑名单高

**控制ssh客户端访问**
vim /etc/hosts.deny
sshd:ALL                             ##拒绝所有人链接sshd服务

vim /etc/hosts.allow
sshd:172.25.254.250                  ##允许250主机链接sshd

sshd:172.25.254.250，172.25.254.180  ##允许250和180链接

sshd:ALL EXCEPT 172.25.254.200       ##只不允许200链接sshd


**ssh登陆提示修改**
vim /etc/motd       ##编辑登陆后显示的字符

编辑/etc/hosts.allow文件，将远程主机的登陆信息输出到系统日志

sshd:172.25.254.132 :spawn echo `date` from %c to %s >> /var/log/messages
##输出到当前终端设备
sshd:172.25.254.132 :spawn echo `date` from %c to %s >> /dev/pts/0

当指定ip主机连接本台主机时，将会在屏幕上显示远程主机登陆信息，如下所示