ssh免密登录配置

ssh服务

默认端口号：22

配置文件：/etc/ssh/sshd_config

启动服务：service sshd start

  登录方式:
[root@jia1 ~]# ssh [email protected] 指定用户登录
[root@jia1 ~]# ssh 192.168.1.1  使用当前用户登录

报错:
[root@jia1 ~]# ssh 172.16.20.1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
7b:fb:7d:3a:8f:c9:dd:45:28:fa:86:4e:7c:31:28:71.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:1
RSA host key for 172.16.20.1 has changed and you have requested strict checking.
Host key verification failed.

解决:是因为known_hosts与实际不一致
[root@jia1 ~]# rm -rf /root/.ssh/known_hosts


远程拷贝:

[root@jia1 ~]# scp /boot/grub/grub.conf 192.168.1.254:/tmp/ 拷贝文件
[root@jia1 ~]# scp -r /boot/ 192.168.1.254:/tmp/ 拷贝目录

不登录拷贝:
[root@jia1 ~]# scp 172.16.20.19:/root/install.log /tmp/


远程执行命令:
[root@jia1 ~]# ssh 192.168.1.1 "useradd robin"
[root@jia1 ~]# ssh 192.168.1.1 "echo 123|passwd --stdin robin"


修改sshd的默认端口:
[root@jia1 ~]# vim /etc/ssh/sshd_config
Port 12345

[root@jia1 ~]# ssh 192.168.1.1
ssh: connect to host 192.168.1.1 port 22: Connection refused
端口已经改变,需要指定端口
[root@jia1 ~]# ssh -p 12345 192.168.1.1
[email protected]'s password:

[root@jia1 ~]# scp -P 12345 192.168.1.1:/root/install.log /tmp/  
 

ssh的密钥登录 （免密登录）

第一步：生成密钥对

[root@jia1 ~]# ssh-keygen                  ssh-keygen生成密钥对。默认使用rsa算法。可以使用-t参数指定如ssh-keygen -t dsa 使用dsa算法加密
[root@jia1 ~]# ls /root/.ssh/
id_rsa    id_rsa.pub
私钥          公钥
 

第二步：把公钥传到需要免密登录的机器上

[root@jia1 ~]# ssh-copy-id   -i   192.168.1.1              
[email protected]'s password:
Now try logging into the machine, with "ssh '192.168.1.1'", and check in:

.ssh/authorized_keys 服务器上的公钥文件必须为这个名字

to make sure we haven't added extra keys that you weren't expecting.


可以设置必须密钥登录   如果设置了那么就只能使用密钥而不能再使用账号密码。              
[root@jia1 ~]# vim /etc/ssh/sshd_config
PasswordAuthentication no

错误:因为多次密钥操作缓存为更新
[root@jia1 .ssh]# ssh 192.168.1.1
Agent admitted failure to sign using the key.
[email protected]'s password: 

 

解决:ssh-add
[root@jia1 .ssh]# ssh-add
Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)
[root@jia1 .ssh]# ssh 192.168.1.1
Last login: Thu Aug 25 13:14:37 2016 from 192.168.1.10

 

第三步：当多台需要免密登录时可以这样做

生成密钥对:
[root@jia1 ~]# ssh-keygen

将公钥传输给本机:
[root@jia1 ~]# ssh-copy-id -i 192.168.1.254   

 

上边这条命令实际就是把id_rsa.pub复制一份改名成authorized_keys。

        所以也可以这样：[root@jia1 ~]# cd  /root/.ssh/  && cat id_rsa.pub > authorized_keys

拷贝.ssh目录到其他主机,完成免密登录
[root@jia1 ~]# scp -r /root/.ssh/  192.168.1.1:/root/