Linux ssh 密钥的生成与使用

本机的Linux

在客户端生成密钥对

ssh-keygen -t rsa  

szm@LENOVO:~$ ssh-keygen -t rsa <== 建立密钥对，-t代表类型，有RSA和DSA两种
Generating public/private rsa key pair.
Enter file in which to save the key (/home/szm/.ssh/id_rsa): < == 密钥文件默认存放位置，按Enter即可
Created directory ‘/home/szm/.ssh’.
Enter passphrase (empty for no passphrase): <== 输入密钥锁码，或直接按 Enter 留空
Enter same passphrase again: <== 再输入一遍密钥锁码
Your identification has been saved in /home/szm/.ssh/id_rsa <== 生成的私钥
Your public key has been saved in /home/szm/.ssh/id_rsa.pub <== 生成的公钥
The key fingerprint is:
SHA256:Ed27eJpaMXOcaXaUeiYGG4X6hD7M/yrYfw9vYKv1XjI szm@LENOVO
The key’s randomart image is:
±–[RSA 3072]----+
| … o. |
| .o… . |
| .oo .o |
| o…=.= |
| +So=.@.+ |
| = oO== |
| o o.=ooE .|
| . o.+.o+.+ |
| .++=.+= |
±—[SHA256]-----+

密钥锁码在使用私钥时必须输入，这样就可以保护私钥不被盗用。当然，也可以留空，实现无密码登录，这里密钥锁码设置为空。完成上述步骤后，在 root 用户的家目录中生成了一个 .ssh 的隐藏目录，内含两个密钥文件，其中id_rsa 为私钥，id_rsa.pub 为公钥。

目标Linux

把公钥传输至远程服务器
这里的远程服务器是192.168.0.232

ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.0.232

szm@LENOVO:~$ ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.0.232
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: “/home/szm/.ssh/id_rsa.pub”
The authenticity of host ‘192.168.0.232 (192.168.0.232)’ can’t be established.
ECDSA key fingerprint is SHA256:mWVkLagrWvOrd9ZXRVPK+puNciwZOJRyXYbZCgTa3ho.
Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type ‘yes’, ‘no’ or the fingerprint: yes <== 是否继续连接，回答为yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed – if you are prompted now it is to install the new keys
root@192.168.0.232’s password: <== 输入远程主机的密码

Number of key(s) added: 1

Now try logging into the machine, with: “ssh ‘root@192.168.0.232’”
and check to make sure that only the key(s) you wanted were added.

测试

[root@localhost ~]# ssh 192.168.0.232

可以看出，无需输入密码即可直接登录