client远程连接server时,如何确保server目标正确
参见: 中间人攻击
1.此时无法确认192.168.178.125这台机器的真实性,但可以获取目标的指纹信息
[root@web01 ~]# ssh root@192.168.178.125 The authenticity of host
‘192.168.178.125 (192.168.178.125)’ can’t be established. ECDSA key
fingerprint is SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q.
ECDSA key fingerprint is
MD5:bb:0e:ce:b0:5d:c3:7b:f1:54:50:c3:2e:76:9f:c5:83. Are you sure you
want to continue connecting (yes/no)?
2.远程获取192.168.178.125公钥指纹信息
#扫描了公钥信息本身
[root@web01 ~]# ssh-keyscan 192.168.178.125 |grep ecdsa
# 192.168.178.125:22 SSH-2.0-OpenSSH_7.4 # 192.168.178.125:22
SSH-2.0-OpenSSH_7.4 # 192.168.178.125:22 SSH-2.0-OpenSSH_7.4
192.168.178.125 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMzD1Qz0iBweRMosfcB8bYZXwIXgvJltBoup6rjn0pXIExALtECoVqNTyyRr9cT2lSB4s9FhTINUK9raNZ0tB9E=
#扫描了公钥的指纹信息
[root@web01 ~]# ssh-keyscan -t ecdsa 192.168.178.125 | ssh-keygen -lf-
- # 192.168.178.125:22 SSH-2.0-OpenSSH_7.4
256SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q 192.168.178.125
(ECDSA)
3.对比指纹信息确认server身份
4.核对正确,登录
Are you sure you want to continue connecting (yes/no)? yes
5.可以登录server机器后查看公钥指纹信息
[root@web02 ~]# ssh-keygen -E SHA256 -lf
/etc/ssh/ssh_host_ecdsa_key.pub 256
SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q no comment (ECDSA)
6.再次对比server机器的公钥指纹信息确认server身份