linux配置ssh某用户只允许证书登陆-CSDN博客

1，客户端

生成公钥与私钥

ssh-keygen -t rsa -C ‘email’ -f ~/.ssh/user_ssh

然后会在~/.ssh生成user_ssh, user_ssh.pub

2，服务端

user登录服务端，并上传user_ssh.pub到服务端

配置ssh

touch ~/.ssh/authorized_keys 

cat user_ssh.pub >> ~/.ssh/authorized_keys 

sudo /etc/init.d/ssh start

禁止root账户并禁止所有用户密码登录

# Subsystem sftp /usr/lib/openssh/sftp-server  #关闭sftp

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PAM authentication via ChallengeResponseAuthentication may bypass
# If you just want the PAM account and session checks to run without
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
UseDNS no
AddressFamily inet
PermitRootLogin no  #禁止root
SyslogFacility AUTHPRIV
PasswordAuthentication no #禁止密码方式验证

3, 客户端测试　　

使用xshell，指定服务器信息之后，在验证设置中选择使用验证方法为public key

输入用户名，选择我们在客户端生成的密钥，如果生成公钥与私钥时候有输入通行密码即passphrase这里也要输入