9-2 远程控制服务sshd与远程传输命令scp

最新推荐文章于 2024-08-12 23:17:10 发布

wangmiaoyan

最新推荐文章于 2024-08-12 23:17:10 发布

阅读量1.2k

点赞数

分类专栏： Linux

本文链接：https://blog.csdn.net/wangmiaoyan/article/details/104722036

版权

Linux 专栏收录该内容

57 篇文章 1 订阅

订阅专栏

一、远程控制服务sshd

SSH是一种能够以安全的方式提供远程登录的协议，也是目前远程管理Linux的首选方式。想要使用SSH协议来远程管理Linux系统，则需要部署配置sshd服务程序。

sshd是基于SSH协议开发的远程管理服务程序，能够提供两种安全验证的方法：

基于口令的验证-用账户和密码来验证登录。
基于密钥的验证-需要在本地生成密钥对，然后把密钥对中的公钥上传到服务器，并与服务器中的公钥进行比较；该方式相对来说更安全。

Linux中配置服务说明：
1、Linux中一切都是文件
2、配置服务实际上就是修改配置文件
3、重启相应服务来加载最新配置参数
4、为了保证下次还能生效，加入到开机启动项中。

sshd的配置文件路径：vim /etc/ssh/sshd_config ，想修改sshd的相关配置的话，修改此文件即可。
在这里插入图片描述
接下来演示客户端templete（192.168.136.10）访问服务器redhat（192.168.136.20）
1、账号密码验证
2、秘钥验证
3、服务器禁止使用密码连接，客户端使用密码连不上，使用公钥则能连上

1、账号密码验证

ssh 用户名@ip

##远程登录root用户，再退出
[root@templete ~]# ssh 192.168.136.20
The authenticity of host '192.168.136.20 (192.168.136.20)' can't be established.
ECDSA key fingerprint is SHA256:XM5owrAjO85q+GiWt1AmbDqJRqxQUlBss3Qt50uWZII.
ECDSA key fingerprint is MD5:f2:c1:32:65:a0:f0:79:d3:1c:8b:9c:2b:51:f5:e1:0e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.136.20' (ECDSA) to the list of known hosts.
root@192.168.136.20's password: 
Last login: Sat Mar  7 17:25:23 2020
[root@redhat ~]# exit
logout
Connection to 192.168.136.20 closed.
[root@templete ~]# 

##远程登录sunny用户
[root@templete ~]# ssh sunny@192.168.136.20
sunny@192.168.136.20's password: 
[sunny@redhat ~]$

2、秘钥验证

在客户端主机生成密钥对

[root@templete ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:/fFTCyUAo4vR2GODznLYOK1+emJ+BSpoQfBeg81nA8U root@templete
The key's randomart image is:
+---[RSA 2048]----+
|o   .o.  o..     |
| o + .E . . .    |
|. o =++B     . . |
| o .B=+.+.    o  |
|. o=.B..S . ..  .|
|.o .=  .   . o...|
|. ..  .     . o. |
|  .o +         . |
|  o+*            |
+----[SHA256]-----+

##上面可以看到保存的路径，打开可以看到随机生成的2048位的秘钥
[root@templete ~]# cat /root/.ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA7U8dGDU5qUkse656Tntxe989Iq9NLn317+viEhmQVu6wLT1v
3RMBh+R+Beu22yf7P4n2ahv0UemD44y1o+oaqitOvhhCwH82+u2gfvCxW5jPSKi5
rW6N/7djCW6b0n76HPQPSwvQ77ejH7tmNRuEaoTqFQ/EAwALX2unGByHJi9b53XA
vhMcy8fGfIKvo288ZgDWpd/v3xeGXEWF3PfWJhRE7G8zJFQjT2bUzPLtZWTA82Ht
kmKmNz53Wyt1VIsoawK4BmHNvHBji0gR4ELAR+/oT4X0neO7AehjWGcz+on+647d
yBSLImSHi2GinIYHMST+IxGjSjMt8FkHwzk5HwIDAQABAoIBAQCuBmJTqlSKrDqO
yLiwbR4ftOnkUaHMAlskglra4xxSY9+WjYNHH/TzbsBsHxuNQ5igU8/8qFtW5mPt
rvZVKgw71l58UNZCzAfJpBEahe/KOBlqMzFW2cgQSq+57v8eMjfAm8nLQvMJmCVr
08V0FKXaZ3Yx08nuWU39v7hdmi4R9SdfBLMEu7vuHNw/DCDJKxSFt1LrfU+Migpb
5i4IamouCUFwahWcKQA5hJNQNtT3FkDfCOlguzhh4W4NQLcJW07Hc5ckshwTlzJ+
CtI1HtiKkrLtXC63rb6LJPi4mbPCPRKtleyGInlAKSizL+hujUiATi6vMlrTZo41
2Kw3aRihAoGBAPvDOSZZUaDQS+eidTtL223IiJ79YS2CTfdbn0wbL4jbyF5elDbY
+SG8TfjWOu+kUgZKrlC6C9uqdw4F564zKYroF0R3jN13ZuoseppHhl1nUVo0SsAt
cPuISeNUMicJBps6Lo+kT5Vr6FjtSywhkeG1dnoMkV6cuYg6U78+X/o9AoGBAPFN
nSzu9Su7QuJC5pz9Bkzf1z3tvZ5+UMxQGWDG6jrLKZQLsgCASeqHVOAzFyl3Hywn
Jbqqa37R7kvqYCgmayN+mmh/jFeu72eoaQar4o8aQg4Cmv/VcIUs2osGDEn3U1aC
3EcWPrWmnryq3lfOjVNIuRxcCmOKrIpZ4Ac2pWKLAoGAOes2qZjgy5M/8yEPwT15
VK9Opuz5v0N79k0Qv6x9agnN9c/iXx/ZaKZudbGrS1hNOn9RzOaQNc/opcQ8AXpp
szgjqi+qq4R9m5/x8K5FvhU3xP3EuKN7m5JGFVNYWlycNXfUIF2XpXN2t4aXxaZP
blKV2AwuIUsC79EjVRrfb60CgYArVDx87QupJp8D8e9nESgodak4vY/m/deUWG22
KwG0PPbiVpdH78FWE6bx+zqVf4Zhb0YfFqrmwtt/Vj6d9wgV/43KZdzVgdwLSPpS
8FpmR9jEm0Mp3TGvODal8BgU0Axu5GCZgy0PgTPPvP7f1X8bDVvv87cJ2MTSswC/
Sti3sQKBgQCZZ+cOcsKH08hL6uglBVi5J3YS3tryB4FiHFiepXghNmLgtPMkS6pT
hXStSMX99+rA1Ero+HFp/aLOec7csxKEX5G9EyX88tBBDwhx9BMhMONf22JnAnkI
rgbZdy+XSZCnxO5JWgsU9kVKh8Q4gNNwER8w28kzeNSDX2EmjDZzAw==
-----END RSA PRIVATE KEY-----

把客户端主机中生成的公钥传送至远程主机

[root@templete ~]# ssh-copy-id 192.168.136.20
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.136.20's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.136.20'"
and check to make sure that only the key(s) you wanted were added.

登录服务器，发现不需要再输入密码就可登录成功

[root@templete ~]# ssh 192.168.136.20
Last login: Sat Mar  7 21:44:23 2020 from 192.168.136.10
[root@redhat ~]#

3、服务器禁止使用密码连接

登录服务器，修改sshd服务配置文件vim /etc/ssh/sshd_config

 75 # To disable tunneled clear text passwords, change to no here!
 76 #PasswordAuthentication yes
 77 #PermitEmptyPasswords no
 78 PasswordAuthentication yes

##将上面第77行的内容修改为禁止使用密码登录
76 PasswordAuthentication no

找一台客户机连接这个服务器，发现能连上

[root@node1 ~]# ssh 192.168.136.20
The authenticity of host '192.168.136.20 (192.168.136.20)' can't be established.
ECDSA key fingerprint is SHA256:XM5owrAjO85q+GiWt1AmbDqJRqxQUlBss3Qt50uWZII.
ECDSA key fingerprint is MD5:f2:c1:32:65:a0:f0:79:d3:1c:8b:9c:2b:51:f5:e1:0e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.136.20' (ECDSA) to the list of known hosts.
root@192.168.136.20's password: 
Last login: Sat Mar  7 21:59:02 2020 from 192.168.136.10
[root@redhat ~]# exit
logout
Connection to 192.168.136.20 closed.

重启服务器上的sshd服务后

[root@redhat Desktop]# systemctl restart sshd

客户端再连接，发现连不上了

[root@node1 ~]# ssh 192.168.136.20
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

而之前的发送了秘钥的客户端则还是能正常登录

[root@templete ~]# ssh 192.168.136.20
Last login: Sat Mar  7 22:10:29 2020 from 192.168.136.11

远程传输命令scp

scp是基于SSH协议在网络之间进行安全传输的命令，格式为"scp [参数] 本地文件远程账户@远程ip地址:远程目录".
在这里插入图片描述
scp既可以把文件上传到远程服务器，又可以从远程服务器下载文件到本地。

上传

##上传文件
[root@templete ~]# echo "my name is templete" > a.txt
[root@templete ~]# ls
anaconda-ks.cfg  busybox.tgz  Documents  initial-setup-ks.cfg  Pictures  Templates
a.txt            Desktop      Downloads  Music                 Public    Videos
[root@templete ~]# scp a.txt 192.168.136.20:/home
a.txt                                                100%   20    18.1KB/s   00:00    

##传完后去到服务器home目录，会发现多了这个a.ttx文件
[root@redhat Desktop]# cd /home/
[root@redhat home]# ls
a.txt  sunny
[root@redhat home]# cat a.txt 
my name is templete

下载文件

## 在服务器新建b.txt文件
[root@redhat home]# echo "my name is redhat" > b.txt
[root@redhat home]# ls
a.txt  b.txt  sunny

##下载文件
[root@templete ~]# scp 192.168.136.20:/home/b.txt /home
b.txt                                                100%   18    16.6KB/s   00:00 
[root@templete ~]# cd /home/
[root@templete home]# ls
b.txt  sunny
[root@templete home]# cat b.txt 
my name is redhat
[root@templete home]#