第二天作业

一.配置ntp时间服务器，确保客户端主机能和服务主机同步时间

1.配置server端的时间服务器

[root@server ~]# vim /etc/chrony.conf 
server  ntp.aliyun.com  iburst

2.在server端重启服务，并查看是否同步

[root@server ~]# systemctl restart chronyd
[root@server ~]# timedatectl status 
               Local time: 日 2023-05-21 11:33:14 CST
           Universal time: 日 2023-05-21 03:33:14 UTC
                 RTC time: 日 2023-05-21 03:33:14
                Time zone: Asia/Shanghai (CST, +0800)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no
[root@server ~]# chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 203.107.6.88                  2   6    17    15  -1599us[-2404us] +/-   31ms

3.在server端配置允许访问的主机IP，并重启服务

[root@server ~]# vim /etc/chrony.conf 
allow 192.168.30.0/24 #此处要将前面的#号删除
[root@server ~]# systemctl restart chronyd

4.在node1端修改配置文件，配置时间服务器到server端

[root@node1 ~]# vim /etc/chrony.conf 
pool 192.168.30.128 iburst
[root@node1 ~]# systemctl restart chronyd

5.在node1端测试时间同步

[root@node1 ~]# chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 192.168.30.128                3   6    37    12  -7440ns[ -784us] +/-   34ms

二.配置ssh免密登陆，能够通过客户端主机通过redhat用户和服务端主机基于公钥验证方式进行远程连接

1.定位客户端，制作密钥对

[root@node1 ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:gjcWEkgRmE4Bicr1AcXbuDgHr+DCoNOER4Kkx0YQecs root@node1
The key's randomart image is:
+---[RSA 3072]----+
|*X===.           |
|*o+. +           |
|O=..o *          |
|=oE. * o         |
| *  = * S        |
|o.oo * o         |
|=+. +            |
|+o..             |
|..               |
+----[SHA256]-----+

2.定位客户端，上传公钥

[root@node1 ~]# ssh-copy-id root@192.168.30.128
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.30.128 (192.168.30.128)' can't be established.
ED25519 key fingerprint is SHA256:cUwa1+n9OILUC8E3q9+uoe5MFU6wrafGjwmPnH6P9pk.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.30.128's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.30.128'"
and check to make sure that only the key(s) you wanted were added.

3.定位服务端，制作密钥对

[root@server ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:m8c1qKE9yeT5w9Zk7U20F4PFwjvdp0JAAlGV1lNwOrE root@server
The key's randomart image is:
+---[RSA 3072]----+
|      o+oooo+o+  |
|         .+ oB o |
|         . .E.* .|
|           ..= ++|
|        S ..o..o=|
|       * O .+.o.o|
|      . @.o+ o o.|
|         ++ . . .|
|         ...     |
+----[SHA256]-----+

4.定位服务端，上传公钥

[root@server ~]# ssh-copy-id root@192.168.30.129
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.30.129 (192.168.30.129)' can't be established.
ED25519 key fingerprint is SHA256:cUwa1+n9OILUC8E3q9+uoe5MFU6wrafGjwmPnH6P9pk.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.30.129's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.30.129'"
and check to make sure that only the key(s) you wanted were added.

5.测试免密登录

[root@server ~]# ssh 192.168.30.129
Activate the web console with: systemctl enable --now cockpit.socket

Register this system with Red Hat Insights: insights-client --register
Create an account or view all your systems at https://red.ht/insights-dashboard
Last login: Sun May 21 19:02:01 2023 from 192.168.30.1
[root@node1 ~]# 

[root@node1 ~]# ssh 192.168.30.128
Activate the web console with: systemctl enable --now cockpit.socket

Register this system with Red Hat Insights: insights-client --register
Create an account or view all your systems at https://red.ht/insights-dashboard
Last login: Sun May 21 19:01:42 2023 from 192.168.30.1
[root@server ~]#