標題: linux ssh key [打印本頁] 作者: perl0302 時間: 2011-11-30 21:00 標題: linux ssh key 一：简洁的配置文件
[root@cisco ~]# vi /etc/ssh/sshd_config
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 600
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
RhostsAuthentication no
IgnoreRhosts yes
HostbasedAuthentication no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
MaxStartups 20
Subsystem sftp /usr/libexec/openssh/sftp-server
~
二、使用公钥认证
1、原理：首先由用户生成一对密钥，然后将公钥保存在SSH服务器用户的目录下.ssh子目录中的 authorized_key文件里(/root/.ssh/authorized_key).私钥保存在本地计算机.当用户登陆时,服务器检查 authorized_key文件的公钥是否与用户的私钥对应,如果相符则允许登入,否则拒绝.由于私钥只有保存在用户的本地计算机中,因此入侵者就算得到用户口令,也不能登陆到服务器.
2、启用公钥认证
修改配置文件/etc/ssh/sshd_config
将"PasswordAuthentication yes"修改为"PasswordAuthentication no"
3、生成密钥
[root@rain ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
4d:dd:48:af:76:c2:ba:a8:bc:20:f3:28:1d:6a:28:53 root@rain.fish.com
4、将/root/.ssh/id_rsa.pub改名为/root/.ssh/authorized_keys
mv /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
5、将私钥id_rsa拷贝到客户机
A:linux下可以拷贝到/root/.ssh/就可以直接使用了。