标签：SSH

• 用ssh-keygen创建公钥

[root@qzweb1 .ssh]# ssh-keygen -t rsa    //生成密钥
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):    //回车，使用默认目录
Enter passphrase (empty for no passphrase):     //直接回车设置空密码           
Enter same passphrase again:            //也是回车
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
e0:be:39:e4:08:a0:4c:e7:16:f5:bc:80:68:14:59:8a root@qzweb1
The key's randomart image is:
+--[ RSA 2048]----+
| .+.             |
|.o.  .           |
|E.. o +          |
|.+ + o +         |
|=.o . o S        |
|...o ...         |
|  .. +.          |
|    . oo         |
|      o.         |
+-----------------+

• 查看生成出来的密钥

[root@qzweb1 .ssh]# cd ~/.ssh/
[root@qzweb1 .ssh]# ls -l
总用量 12
-rw-------  1 root root 1675 11月 23 15:14 id_rsa
-rw-r--r--  1 root root  393 11月 23 15:14 id_rsa.pub
-rw-r--r--. 1 root root 3176 11月 22 10:45 known_hosts
[root@qzweb1 .ssh]#

• 下发公钥至目标机器

[root@qzweb1 .ssh]# scp id_rsa.pub 192.168.113.132:~/.ssh/
[email protected]'s password: 
id_rsa.pub                                                                                                                                                                                                                                  100%  393     0.4KB/s   00:00    
[root@qzweb1 .ssh]#

• 配置目标机并设置文件和目录权限

[root@qzweb2 ~]# cd ~/.ssh/
[root@qzweb2 .ssh]# ls
id_rsa.pub
[root@qzweb2 .ssh]# cat id_rsa.pub >> authorized_keys
[root@qzweb2 .ssh]# chmod 600 authorized_keys  
[root@qzweb2 .ssh]# chmod 700 -R ~/.ssh 
[root@qzweb2 .ssh]#

• 使用SSH进行连接

[root@qzweb1 .ssh]# ssh 192.168.113.132
Last login: Thu Nov 23 13:42:21 2017 from 192.168.81.24

相关说明

创建的~/.ssh/id_rsa、id_rsa.pub的文件，其中第一个为密钥，第二个为公钥。过程中会要求输入密码，为了ssh访问过程无须密码，可以直接回车。

ssh-keygen:生成秘钥的部分参数：
-t指定算法
-f 指定生成秘钥路径
-N 指定密码

相关说明2

ssh-copy-id 命令可以把本地的ssh公钥文件安装到远程主机对应的账户下。用法：

ssh-copy-id -i /root/.ssh/id_rsa 192.168.1.11

0
The authenticity of host '192.168.1.11 (192.168.1.11)' can't be established.
RSA key fingerprint is 6e:34:d4:8c:fb:72:72:3a:49:7a:14:23:20:59:ea:28.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.11' (RSA) to the list of known hosts.
[email protected]'s password: (输入192.168.1.11 root密码)
Now try logging into the machine, with "ssh '192.168.2.11'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

ssh-copy-id -i /root/.ssh/id_rsa 192.168.1.12
同上

ssh-copy-id -i /root/.ssh/id_rsa 192.168.1.13
同上

SSH介绍

SSH服务由服务端软件OpenSSH(openssl)和客户端(常见的有SSH(linux),SecureCRT,xshell,Putty)组成,SSH服务默认使用22端口提供服务,它有两个不兼容的SSH协议版本,分别是1.x和2.x.

SSH 1.x协议存在被黑客针对联机的Key pair插入恶意程序代码的风险,而SSH 2.x针对这个问题,多加了一个确认联机正确性的Diffie-Hellman机制,每次数据传输中,都会以该机制检查输出来源是否正确.

SSH的服务认证类型主要分为:

• 基于口令的安全认证
• 基于密钥的安全认证:首先建立一对密钥对,把公钥(public key)放在需要访问的目标服务器上.另外还需要吧私有密钥(private key)放到SSH的客户端或对应的客户端服务器上.

SSH的操作命令

SSH连接其他服务器

ssh -p22 [email protected] #被连接的主机

SSH通过远程连接执行命令

ssh -p22 [email protected] /sbin/ifconfig eht0

ssh 链接主机记录信息位置

~/.ssh/known_hosts

ssh客户端文件拷贝至远端服务器

可以通过 -l 参数限制传输速度.

scp -P22 -rp /tmp/oldboy [email protected]:/tmp/oldboy #方向由左至右

sftp功能?(不要用)

sftp无法显示登陆用户的目录,可以随时跳到别的目录

sftp -oPort=55555 [email protected]
get(download) put(upload)

实现SSH密钥批量分发

#确认系统版本信息
cat /etc/redhat-release
uname -r
uname -m
#添加批量分发账号
useradd fenfa (所有计算器创建分发账号)
echo 123456|passwd --stdin fenfa
#分发账号需要sudo授权rsync
echo "fenfa ALL=(ALL) NOPASSWD: /usr/bin/rsync" >>/etc/sudosers
visudo -c
#生成密钥对
ssh-keygen -t dsa
#查看密钥对
ls -l .ssh/
#分发密钥
ssh-copy-id -i .ssh/id_dsa.pub "-p [email protected]"
#测试
ssh -p55555 [email protected] /sbin/ifconfig

增量,加密传输文件:

rsync -avz hosts -e 'ssh -p55555' [email protected]:~

简单文件批量分发脚本(有待修改)

#！/bin/sh
. /etc/init.d/functions
if [ $# -ne 2 ]
then
echo "USAGE:/bin/sh $0 localfile remotedir"
exit 1
fi
for n in 1 2 3
do
scp -P55555 -r ~/$1 [email protected].$n:~ &>dev/null &&
ssh -p55555 -t [email protected].$n sudo rsync ~/$1 $2 &>/dev/null
if [ $? -eq 0 ]
then
action "fenfa $1 192.$n is ok" /bin/true
else
action "fenfa $1 192.$n is false" /bin/false
fi
done

简单的批量查看脚本

#!/bin/sh
if [ $# -ne 1 ]
then
echo "USAGE:$0 COMMAND"
exit 1
fi
for n in 1 2 3
do
echo ============192.168.117.$n========
ssh -p55555 [email protected].$n $1
done

非交互式生成密钥并实现批量管理

1、为所有机器创建传输用用户及密码

useradd key888
echo 123456|passwd --stdin key888
id key888
echo "key888 ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers 
visudo -c
su - key888

2、管理机创建密钥对

ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa >/dev/null 2>&1

3、分发密钥

yum install expect -y #只安装在管理机
ssh-copy-id -i.ssh/id_dsa.pub "-p 52113 [email protected]"

4、此处需要三个脚本实现

fenfa_auto.sh

ssh_expect.exp

~/intall.sh

vi ssh_expect.exp

#!/usr/bin/expect
if { $argc != 2 }{
send_user "usage: expect ssh_expect.exp file hostn"
exit
}
#define var
set file [lindex $argv 0]
set host [lindex $argv 1]
set password "123456"
#spawn scp /etc/hosts [email protected]:/etc/hosts
#spawn scp -P55555 $file kendally@$host:$dirn
spawn ssh-copy-id -i $file "-p 55555 key888@host"
expect {
"yes/no"   {send "yes/r";exp_continue}
"*password"{send "$passwordr"}
}
expect eof
exit -onexit {
send_user "kendall say good bye to you!n"
}
#script usage
#expect kendall-6.exp file host 
#expaple
#expect ssh_expect.exp file host 
#expect ssh_expect.exp ~/.ssh/id_dsa.pub 172.16.1.31

vi fenfa_auto.sh

#!/bin/sh
. /etc/init.d/functions
shh-keygen -t dsa -P '' -f ~/.ssh/id_dsa >/dev/null 2>&1
if [ $? -eq 0 ];then
action "ccreat dsa $ip" /bin/true
else
action "create dsa $ip" /bin/false
exit 1
fi
for ip in 8 31 41
do
expect ssh_expect.exp ~/.ssh/id_dsa.pub 172.16.1.$ip >dev/null 2>&1
if [ $? -eq 0 ];then
action "$ip" /bin/true
else
action "$ip" /bin/false
fi
done
#dis fenfa scripts
for m in 8 31 41
do
scp -P55555 -rp ~/scripts [email protected].$m:~
done
#install service
for n in 8 31 41
do
ssh -t -p55555 [email protected].$n sudo /bin/bash ~/scripts/install.sh
done

vim intall.sh

yum install httpd -y