1: 在 root用户下创建用户及密码
[root@master ~]# adduser centos
[root@master ~]# passwd centos
2: 将此用户授权
#编辑文件
[root@master ~]# sudo vim /etc/sudoers#修改文件内容
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
centos ALL=(ALL) ALL #将新用户添加再这里#保存,退出
3: 使用 创建的centos用户登录, 创建密钥, 记得将id_rsa 私钥下载,登录用的
#在root下直接切创建的用户
su centos
[centos@master ~]$ ssh-keygen -t rsa #建立密钥对
Generating public/private rsa key pair.
Enter file in which to save the key (/home/centos/.ssh/id_rsa): #直接回车
Created directory '/home/centos/.ssh'.
Enter passphrase (empty for no passphrase): # 输入密码,或者直接按回车,实现无密码登录
Enter same passphrase again: #重新输入密码或按回车
Your identification has been saved in /home/centos/.ssh/id_rsa.
Your public key has been saved in /home/centos/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:HfIkWBAJNCHFKLWuYJW/jWbSMRx2GdfSfV/vnVOL+DI centos@master
The key's randomart image is:
+---[RSA 2048]----+
| .o=*oo=..o . |
|. .oo..o+. o . ..|
| ..o o.oo + . +|
| .. + o * . +|
|... = S o . ..=|
|o. . * . . +o|
|. . * . . .|
| + E . |
| o |
+----[SHA256]-----+
[hadoop@master ~]$ cd .ssh
[hadoop@master .ssh]$ ll
total 8
-rw------- 1 centos root 1675 Jun 24 16:14 id_rsa #私钥,下载到本地
-rw-r--r-- 1 centos root 395 Jun 24 16:14 id_rsa.pub #公钥
4: 在服务器上安装公钥
#键入以下命令,在服务器上安装公钥:
[centos @master .ssh]$ cd .ssh
[centos @master .ssh]$ cat id_rsa.pub >> authorized_keys#设置权限
[centos @master .ssh]$ chmod 600 authorized_keys
[centos @master .ssh]$ chmod 700 ~/.ssh #只要700的时候,sshd才能读到
5: ssh设置
编辑 /etc/ssh/sshd_config:
[centos@master ~]$ sudo vim /etc/ssh/sshd_config
#将如下root远程登录 从yes改为no, su root 还是可以密码登录的, 只是不能远程登录
PermitRootLogin no
#禁止使用密码登录,注释掉下面这行,或者将yes改为no
#PasswordAuthentication yes
PasswordAuthentication no
#在文件末尾新增
RSAAuthentication yes
PubkeyAuthentication yes
6: 重启 ssh服务
[centos@host .ssh]$ service sshd restart
7: 验证:
root 或者 centos 用户密码登录会无权限。 必须配置证书登录。