各主机之间相互基于key验证

各主机之间相互基于key验证

注:此方法是各主机之间用相同的公钥、私钥对

可能出现的弊端:一但私钥丢失,各主机的安全得不到保证(解决办法:可以给私钥加对应的密码:ssh-keygen  -p).
加上对应的密码之后,在登录各主机时就需要输入私钥的对应密码(闲麻烦还可以添加代理,代理完之后:ssh-agent bash,只需第一次输入密码即可,之后个主机也能够互相登录了)

1. 步骤一:生成公、私钥对

[root@7centos7 ~]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 		#对应的路径
/root/.ssh/id_rsa already exists.				#在这之前生成过,就不在重复生成了。没有生成过的一路回车就行。

2. 步骤二:将生成的公、私钥对相应的文件夹拷贝至各主机中(包括自己)

#3台主机
[root@7centos7 ~]# ssh-copy-id 127.0.0.1
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@127.0.0.1's password: 		#输入当前主机的密码

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '127.0.0.1'"
and check to make sure that only the key(s) you wanted were added.

########################################################################
[root@7centos7 .ssh]# rsync -av /root/.ssh 10.0.8.17:/root/
root@10.0.8.17's password: 
sending incremental file list
.ssh/
.ssh/authorized_keys
.ssh/known_hosts

sent 1,281 bytes  received 70 bytes  900.67 bytes/sec
total size is 3,505  speedup is 2.59

#######################################################################
[root@7centos7 .ssh]# rsync -av /root/.ssh 10.0.8.8:/root/
root@10.0.8.8's password: 
sending incremental file list
.ssh/
.ssh/authorized_keys
.ssh/id_rsa
.ssh/id_rsa.pub
.ssh/known_hosts

sent 3,445 bytes  received 108 bytes  7,106.00 bytes/sec
total size is 3,505  speedup is 0.99

3. 验证

[root@7centos7 ~]# ssh 10.0.8.17
Last login: Thu Jul  4 16:27:37 2024 from 10.0.8.1
[root@17centos7 ~]# ssh 10.0.8.8
静以修身，俭以养德。
淡泊明志，宁静致远。
自强不息，厚德载物。
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Thu Jul  4 16:27:34 2024 from 10.0.8.1
[16:28:25 root@CS8-VM8-10 ~][#ssh 10.0.8.7
Last login: Thu Jul  4 16:27:37 2024 from 10.0.8.1
[root@7centos7 ~]# 

#给私钥添加完密码之后的验证
[root@7centos7 ~]# ssh-keygen -p
Enter file in which the key is (/root/.ssh/id_rsa):    
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.
[root@7centos7 ~]# ssh 10.0.8.17
Enter passphrase for key '/root/.ssh/id_rsa': 

[root@7centos7 ~]# 
######################################################################################
#添加代理之后的验证:ssh-agent bash
[root@7centos7 ~]# ssh-agent bash
[root@7centos7 ~]# 
[root@7centos7 ~]# ssh 10.0.8.17
Enter passphrase for key '/root/.ssh/id_rsa': 			#输入密码
Last login: Thu Jul  4 16:34:44 2024 from 10.0.8.7
[root@17centos7 ~]# ssh 10.0.8.8
静以修身，俭以养德。
淡泊明志，宁静致远。
自强不息，厚德载物。
Activate the web console with: systemctl enable --now cockpit.socket

Last failed login: Thu Jul  4 16:41:41 CST 2024 from 10.0.8.7 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Thu Jul  4 16:33:31 2024 from 10.0.8.17
[16:42:44 root@CS8-VM8-10 ~][#ssh 10.0.8.17
Last login: Thu Jul  4 16:42:39 2024 from 10.0.8.7
[root@17centos7 ~]# ssh 10.0.8.7
Last login: Thu Jul  4 16:34:47 2024 from 10.0.8.1
[root@7centos7 ~]# ps aux | grep agent
root       3590  0.0  0.0  72472   780 ?        Ss   16:42   0:00 ssh-agent bash
root       3668  0.0  0.0 112824   988 pts/5    S+   16:43   0:00 grep --color=auto agent
[root@7centos7 ~]#