笔记【SSH免密登录 in CentOS7.x】

SSH免密登录原理

场景

• A、B两台Linux终端，其中需要A通过SSH远程登录B时，能够免密码直接通过用户名进行登录的配置

公钥 & 私钥

1. 公钥与私钥是成对出现的，单独存在的公钥或私钥是没有价值的
2. 公开的密钥叫公钥，只要自己知道的叫私钥
3. 用公钥加密的数据只要对应的私钥能够解密；用私钥加密的数据只要对应的公钥能够解密
4. 假如能够用公钥解密，则必定是对应的私钥加的密；假如能够用私钥解密，则 必定是对应的公钥加的密
5. 用公钥加密数据，用私钥来解密数据 （推荐）

登录

• 实现登录的两种方式：
  • 口令登录：先请求远程登录，远程服务器返回公钥；客户端使用远程返回的公钥对口令进行加密传输给远程。口令验证通过则登录成功
  • 公钥登录：先请求远程登录并携带客户端的公钥；远程验证公钥是否存在~/.ssh/authrized_keys文件中；存在则返回自己的公钥+并使用客户端的公钥加密随机串；客户端拿到远程公钥，并用本地的私钥解密随机串，用远程的公钥加密+本地私钥签名返回随机串；远程解密+验签。通过则登录成功。
    

SSH免密登录配置

生成秘钥

# 生成rsa公钥私钥，此处-P=''是为了免密登录（否则每次ansible执行命令需要输入此密码）
[root@etcd01 ~]# ssh-keygen -t rsa -P ''
[root@etcd01 ~]# ll .ssh/
总用量 12
-rw-------. 1 root root 1766 6月  23 21:57 id_rsa
-rw-r--r--. 1 root root  399 6月  23 21:57 id_rsa.pub
# 查看rsa公钥内容
[root@etcd00 ~]# cat .ssh/id_rsa.pub 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuOqIoY4B3kDAdfn3pPL15FySnT78E0t4/9x98WUbpmjVFmqOnMaHYBOSkgH47Z/v411MAS+x4GutB44R4zcZchwG0CXCJTKCn0HWx6Pp5hV7HvbPhC6+7roZRunn9yYM+MxVrmWPFFhpVA6bZbhGmPuE3u/QPwYSySz1jFFBEKJwkHtLfdn6BV6trrtBOVPgc7qAEIWq1b/KaB6KTdVHgjVKYjMHp2xSKlohRhnFAVKqJCDTdyYNvNKlWv2Nn+FI5xB7ZHW3LsB14v0+87keOXKV/Wv7M1O8Ad2eKVGTCukrVUYVRSeAeTi5DH4InFL4/7Aj/C173T9pSq4dRqFwn root@etcd00.zangh

配置免登

• 利用ssh-copy-id远程复制到被管理的节点机器（前提：知道登录密码）

[root@etcd00 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.1.151
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.1.151 (192.168.1.151)' can't be established.
ECDSA key fingerprint is SHA256:NAUj3sgJfx+4I6HVEhLYa2WxCAV9mxiMD/gV63u044U.
ECDSA key fingerprint is MD5:a2:12:1b:41:e6:c1:6e:ea:22:b6:b7:38:70:78:72:b6.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.1.151's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.1.151'"
and check to make sure that only the key(s) you wanted were added.
# 到192.168.1.151节点上查看authorized_keys文件
[root@etcd01 ~]# ll .ssh/
总用量 16
-rw-------. 1 root root  399 6月  24 13:23 authorized_keys
-rw-------. 1 root root 1766 6月  23 21:57 id_rsa
-rw-r--r--. 1 root root  399 6月  23 21:57 id_rsa.pub
-rw-r--r--. 1 root root  350 6月  24 12:35 known_hosts
# authorized_keys内存放的秘钥与上一小节一致
[root@etcd01 ~]# cat .ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuOqIoY4B3kDAdfn3pPL15FySnT78E0t4/9x98WUbpmjVFmqOnMaHYBOSkgH47Z/v411MAS+x4GutB44R4zcZchwG0CXCJTKCn0HWx6Pp5hV7HvbPhC6+7roZRunn9yYM+MxVrmWPFFhpVA6bZbhGmPuE3u/QPwYSySz1jFFBEKJwkHtLfdn6BV6trrtBOVPgc7qAEIWq1b/KaB6KTdVHgjVKYjMHp2xSKlohRhnFAVKqJCDTdyYNvNKlWv2Nn+FI5xB7ZHW3LsB14v0+87keOXKV/Wv7M1O8Ad2eKVGTCukrVUYVRSeAeTi5DH4InFL4/7Aj/C173T9pSq4dRqFwn root@etcd00.zangh

• 离线复制秘钥

# authorized_keys文件名为linux默认名
[root@localhost ~]# cat .ssh/id_rsa.pub >> .ssh/authorized_keys
[root@localhost ~]# ll .ssh/
总用量 16
-rw-r--r-- 1 root root  408 7月   8 10:19 authorized_keys
-rw------- 1 root root 1679 7月   8 10:13 id_rsa
-rw-r--r-- 1 root root  408 7月   8 10:13 id_rsa.pub
# 复制到被管理节点，192.168.88.15为被管理节点，接下来需要输入密码
[root@localhost ~]# scp -r .ssh/authorized_keys root@192.168.88.15:/root/.ssh/

• 验证一下免密登录

# 未配置免密登录前
[root@localhost ~]# ssh root@192.168.11.99
root@192.168.11.99's password: #需要输入密码
# 配置了免密登录后
[root@localhost ~]# ssh root@192.168.11.99
Last login: Fri Jul  8 10:25:29 2022 from 192.168.64.8
[root@ejy-kf-jyxt ~]# ll # 成功进行了ssh远程登录，无需输入密码了
total 148
-rw-r--r--  1 root root    484 Jan 27  2021 agent-stack.yml
-rw-------. 1 root root    980 May 18  2016 anaconda-ks.cfg
-rw-r--r--  1 root root    408 Jul  8 10:26 authorized_keys
-rw-r--r--  1 root root      1 Jan 10  2020 catalina.out
drwxr-xr-x  5 root root     43 Nov 26  2021 logs
drwxr-xr-x  4 root root     32 Nov 26  2021 nacos
-rw-------  1 root root 132843 Jun 23  2021 nohup.out
drwxr-xr-x  4 root root     32 Sep 21  2020 rpmbuild
[root@ejy-kf-jyxt ~]# logout
Connection to 192.168.11.99 closed.