centos密钥密码双认证登录

vlambda
2022-04-15

centos密钥密码双认证登录

1. 生成密钥

[root@161 ~]# ssh-keygen -t rsaGenerating public/private rsa key pair.Enter file in which to save the key (/root/.ssh/id_rsa):Created directory '/root/.ssh'.Enter passphrase (empty for no passphrase):Enter same passphrase again:Your identification has been saved in /root/.ssh/id_rsa.Your public key has been saved in /root/.ssh/id_rsa.pub.The key fingerprint is:SHA256:Rr57CNV0XoitUaf4Nyd0uH5d6woWBaRvwCGZvBg+3xo root@161The key's randomart image is:+---[RSA 2048]----+| ..o..*... || . +o *.=o.. || . o o*.=.oo .|| + +. =.o. o || o.S +. = o|| .E o. .o ++|| .+. o ..o|| ...o . .. || .. ... |+----[SHA256]-----+

2.创建密钥认证文件

[root@161 ~]# cd ~/.ssh/[root@161 .ssh]# lsid_rsa id_rsa.pub[root@161 .ssh]# cat id_rsa.pub >> authorized_keys[root@161 .ssh]#[root@161 .ssh]# cat id_rsa.pubssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GZ1E2k7fLIVpoHnVAA5BAS98qtkdOiCl8JG8PiQH57jKz78Jx/WSnWsT0/DxW4Dif290t/EItVtWk3W5ykVl9siuD+Q8sH44xh1xyk9j8tpLL8+ZgQfGP3l9AKaudPMwObq6jT18RHYsKoGSOHO39M1xIi0WH1aqIBSuTplnJvIhG2z+vQh2mBw2bAF6zbX6evGNaBMfyp8ulv54tNU9EsrcK4M/7f+flqzCgob9oaTin9oFVIkb+6e7LZuRhoMjLGed/hvWjz2X6F1xv9YtMsUcdHwYoNPEshWQyYcSzSvuWd1VzOks+A4R4TKiDUTmIahx5gY96MENi0aQB7cF root@161[root@161 .ssh]# cat authorized_keysssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GZ1E2k7fLIVpoHnVAA5BAS98qtkdOiCl8JG8PiQH57jKz78Jx/WSnWsT0/DxW4Dif290t/EItVtWk3W5ykVl9siuD+Q8sH44xh1xyk9j8tpLL8+ZgQfGP3l9AKaudPMwObq6jT18RHYsKoGSOHO39M1xIi0WH1aqIBSuTplnJvIhG2z+vQh2mBw2bAF6zbX6evGNaBMfyp8ulv54tNU9EsrcK4M/7f+flqzCgob9oaTin9oFVIkb+6e7LZuRhoMjLGed/hvWjz2X6F1xv9YtMsUcdHwYoNPEshWQyYcSzSvuWd1VzOks+A4R4TKiDUTmIahx5gY96MENi0aQB7cF root@161

3.修改ssh配置文件

#禁用root账户登录，如果是用root用户登录请开启PermitRootLogin yes# 是否让 sshd 去检查用户家目录或相关档案的权限数据，# 这是为了担心使用者将某些重要档案的权限设错，可能会导致一些问题所致。# 例如使用者的 ~.ssh/ 权限设错时，某些特殊情况下会不许用户登入StrictModes no# 是否允许用户自行使用成对的密钥系统进行登入行为，仅针对 version 2。# 至于自制的公钥数据就放置于用户家目录下的 .ssh/authorized_keys 内RSAAuthentication yesPubkeyAuthentication yesAuthorizedKeysFile .ssh/authorized_keys#是否开启密码登录PasswordAuthentication yes#然后再加一条：AuthenticationMethods publickey,password

4. 设备间互相认证

将管理端（主机公钥）放到服务器的密钥认证文件中；

服务器161

管理端162

[root@161 .ssh]#echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8JuKQDDpy/7gp5qXWd7raGdN7otUgQZ7zjm+QiCtKkZk6b7nWUcQjW37OS35FhvWe+b1UbbrcMNKhsW7zeh6XE0AvWK/0SdXSXVcLc2IXlwge1yyy3+/oFgwguYKBaO+tpVPdiBQ7gs0WJnQWKIh8K3mcZwMoe4nKtlycaO8IiQEMSDC5V4qkPUzPSZbAfGvsk9hmsZM/L4elN/vX5T3mCHOFvuRtYpCu3enNusOLM70bK3DXM/0JN/y1oQ8AwA4bPPKJEBvXRZlGjU+dGmczuXpzbHwzzJbsJMifvcTQmb6IHzxFo9sCHtt0FdDRzqfwfpBE8t0YZUQT3KJhoN/f root@162" >> authorized_keys[root@162 .ssh]#echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GZ1E2k7fLIVpoHnVAA5BAS98qtkdOiCl8JG8PiQH57jKz78Jx/WSnWsT0/DxW4Dif290t/EItVtWk3W5ykVl9siuD+Q8sH44xh1xyk9j8tpLL8+ZgQfGP3l9AKaudPMwObq6jT18RHYsKoGSOHO39M1xIi0WH1aqIBSuTplnJvIhG2z+vQh2mBw2bAF6zbX6evGNaBMfyp8ulv54tNU9EsrcK4M/7f+flqzCgob9oaTin9oFVIkb+6e7LZuRhoMjLGed/hvWjz2X6F1xv9YtMsUcdHwYoNPEshWQyYcSzSvuWd1VzOks+A4R4TKiDUTmIahx5gY96MENi0aQB7cF root@161" >> authorized_keys

密钥认证完成后，添加完成后重启sshd服务

systemctl restart sshd

5.连接测试

查看密钥认证文件

[root@161 ~]# cat ~/.ssh/authorized_keysssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GZ1E2k7fLIVpoHnVAA5BAS98qtkdOiCl8JG8PiQH57jKz78Jx/WSnWsT0/DxW4Dif290t/EItVtWk3W5ykVl9siuD+Q8sH44xh1xyk9j8tpLL8+ZgQfGP3l9AKaudPMwObq6jT18RHYsKoGSOHO39M1xIi0WH1aqIBSuTplnJvIhG2z+vQh2mBw2bAF6zbX6evGNaBMfyp8ulv54tNU9EsrcK4M/7f+flqzCgob9oaTin9oFVIkb+6e7LZuRhoMjLGed/hvWjz2X6F1xv9YtMsUcdHwYoNPEshWQyYcSzSvuWd1VzOks+A4R4TKiDUTmIahx5gY96MENi0aQB7cF root@161ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8JuKQDDpy/7gp5qXWd7raGdN7otUgQZ7zjm+QiCtKkZk6b7nWUcQjW37OS35FhvWe+b1UbbrcMNKhsW7zeh6XE0AvWK/0SdXSXVcLc2IXlwge1yyy3+/oFgwguYKBaO+tpVPdiBQ7gs0WJnQWKIh8K3mcZwMoe4nKtlycaO8IiQEMSDC5V4qkPUzPSZbAfGvsk9hmsZM/L4elN/vX5T3mCHOFvuRtYpCu3enNusOLM70bK3DXM/0JN/y1oQ8AwA4bPPKJEBvXRZlGjU+dGmczuXpzbHwzzJbsJMifvcTQmb6IHzxFo9sCHtt0FdDRzqfwfpBE8t0YZUQT3KJhoN/f root@162

161连接162登录测试

[root@161 ~]# ssh [email protected][email protected]'s password:Last login: Thu Apr 14 04:44:00 2022 from 192.168.160.131[root@162 ~]#

另外一台查看密钥认证文件

[root@162 ~]# cat ~/.ssh/authorized_keysssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8JuKQDDpy/7gp5qXWd7raGdN7otUgQZ7zjm+QiCtKkZk6b7nWUcQjW37OS35FhvWe+b1UbbrcMNKhsW7zeh6XE0AvWK/0SdXSXVcLc2IXlwge1yyy3+/oFgwguYKBaO+tpVPdiBQ7gs0WJnQWKIh8K3mcZwMoe4nKtlycaO8IiQEMSDC5V4qkPUzPSZbAfGvsk9hmsZM/L4elN/vX5T3mCHOFvuRtYpCu3enNusOLM70bK3DXM/0JN/y1oQ8AwA4bPPKJEBvXRZlGjU+dGmczuXpzbHwzzJbsJMifvcTQmb6IHzxFo9sCHtt0FdDRzqfwfpBE8t0YZUQT3KJhoN/f root@162ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GZ1E2k7fLIVpoHnVAA5BAS98qtkdOiCl8JG8PiQH57jKz78Jx/WSnWsT0/DxW4Dif290t/EItVtWk3W5ykVl9siuD+Q8sH44xh1xyk9j8tpLL8+ZgQfGP3l9AKaudPMwObq6jT18RHYsKoGSOHO39M1xIi0WH1aqIBSuTplnJvIhG2z+vQh2mBw2bAF6zbX6evGNaBMfyp8ulv54tNU9EsrcK4M/7f+flqzCgob9oaTin9oFVIkb+6e7LZuRhoMjLGed/hvWjz2X6F1xv9YtMsUcdHwYoNPEshWQyYcSzSvuWd1VzOks+A4R4TKiDUTmIahx5gY96MENi0aQB7cF root@161

162连接161登录测试

[root@162 ~]# ssh [email protected][email protected]'s password:Last login: Thu Apr 14 04:43:53 2022 from 192.168.160.132[root@161 ~]#

其他未添加密钥主机登录

[root@node2 ~]# ssh [email protected]Permission denied (publickey).[root@node2 ~]# ssh [email protected]The authenticity of host '192.168.160.132 (192.168.160.132)' can't be established.ECDSA key fingerprint is SHA256:rTZjp+Ac5slJzmSHweenKrELL4KQDJdx4Ts1harJDBo.ECDSA key fingerprint is MD5:ae:e1:80:75:70:6a:fc:d8:1b:c3:a3:e7:42:4a:33:0c.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '192.168.160.132' (ECDSA) to the list of known hosts.Permission denied (publickey).