2.8. 远程登录Linux系统

2.8.1. 1.使用密钥认证登录

windows上使用密钥登录Linux系统

下载安装puttygen或者其他ssh客户端软件

点击生成，在指点区域晃动鼠标，
会自动生成公钥----点击保存私钥，
可以重命名，后缀为ppk文件


使用puttygen或者CRT生成公钥，将公钥保存到本地
mkdir /root/.ssh
chmod 700 /root/.ssh/
vim /root/.ssh/authorized_keys
将生成的公钥 拷贝粘贴到/root/.ssh/authorized_keys文件中

例如：

[root@localhost ~]# cat /root/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA5Sd4R39caEI7qEHLogTfc1HiytTV2qWYRvWxmYn/lD/oKX+o8Cr/JPl8aWhghNuIISYzVme6s+zVPLFVARIc7pOlvYXYNZ9yCPUbb5Q94JYngjoBFhNsf
mBCf0m6qitR0TsPsMRDYrlOmTwzo1bvd2O1Vrp0FtJuBJp6tXN7knpGVFqfaOTdbzgg2POWNc4gQpvUI4PhOmMzFnDN5DK+Vz4gSBNKocdl1M7ysQJ559xy/7x7DCRj3gh8s00EqiNzSsduIKRJcqEpvFHg0MgSG5qsYMk5uxwrhTDIBKpuybmAMZ+IV5s9ri7cR207Mwthdb3v3xGrQP9+kDIAF7dhBw== rsa-key-20190221

puttygen将保存的私钥进行登录即可

2.8.2. 2.两台Linux之间互访

Linux主机A

[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

[root@localhost ~]# whoami
root

[root@localhost ~]# who am i
root     pts/0        2019-02-22 19:19 (192.168.1.101)

[root@localhost ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:JpnjSg2DkiIvPRWeVyNngSyeyIOSflqltgGhtSuku+Y root@localhost.localdomain
The key's randomart image is:
+---[RSA 2048]----+
|     . ..        |
| .. . o  .       |
|.=.+.o. =        |
|=+=oo+ B .       |
|X ooO * S        |
|==.B * +         |
|.oO + o          |
|.+ + .           |
|+E  .            |
+----[SHA256]-----+

​

ssh-keygen 程序会生成两个文件：

~/.ssh/id_rsa.pub和~/.ssh/id_rsa。其中前者是公钥，后者是
私钥。公钥必须添加到想要自动登入的远程服务器的~/.ssh/authorized_keys文件中

分发公钥到远程主机上

可以使用下列命令添加密钥文件：
$ ssh root@192.168.1.80 'mkdir -p .ssh && cat >>.ssh/authorized_keys' <~/.ssh/id_rsa.pub

上面的命令是使用Shell脚本的方式将公钥保存到远程服务器，除此之外，OpenSSH专门提供了一个名为ssh-copy-id的工具。我们可以使用该工具将公钥保存到远程服务器中，这种方式比前面Shell脚本的方式更加方便。如下所示:

 $ ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.1.80

或者手动的进行粘贴

#将此公钥的内容复制粘贴到Linux主机B的/root/.ssh/authorized_keys文件中。
[root@localhost ~]# cat /root/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD2siSU9RiPxoNja2rQ4KDVMacMgjrVMmnM4umCI5Hqvxv/CH737XfCaUQIDdLRFMp3Q
/Hc4K6nERXlrxW/lLN8E8hUkzcmk4L1LmO4H+hljCyGWSUcBfemRyj7ACV8jls0AqftiVIgG+8eCZaLcrEmF6bLUs1Cs2n2/uIbY8karfH
/Rct3T1HsBtk6C7i9ZzOExDsg6p8ZutLYnjnlGdF5HyV0gVkGJyIJx+gm230TqLNwYKQXi8zCWJehj1XKLqGn9UJEQoj6dK7bagstWxNvVvz8u
njAs0cZv3d/KF0Uk24j1+CNY4yGReQIHHF2zHMs0jOhe+yteUnvkwXF/vml root@localhost.localdomain

Linux主机B

mkdir -p /root/.ssh/
[root@localhost ~]# cat /root/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD2siSU9RiPxoNja2
rQ4KDVMacMgjrVMmnM4umCI5Hqvxv/CH737XfCaUQIDdLRFMp3Q/Hc4K6nERXlrxW/
lLN8E8hUkzcmk4L1LmO4H+hljCyGWSUcBfemRyj7ACV8jls0AqftiVIgG+8eCZaLcrEmF6bLU
s1Cs2n2/uIbY8karfH/Rct3T1HsBtk6C7i9ZzOExDsg6p8ZutLYnjnlGdF5HyV0gVkGJyIJx+
gm230TqLNwYKQXi8zCWJehj1XKLqGn9UJEQoj6dK7bagstWxNvVvz8unjAs0cZv3d/KF0Uk24j1
+CNY4yGReQIHHF2zHMs0jOhe+yteUnvkwXF/vml root@localhost.localdomain

chmod 600 /root/.ssh/authorized_keys

#vi  /etc/ssh/sshd_config
修改如下几个配置。
    Protocol 2  #仅允许使用SSH2
    PubkeyAuthentication yes        #启用PublicKey
    认证
    AuthorizedKeysFile .ssh/authorized_keys  #PublicKey文件路径
    PasswordAuthentication no         #不使用密码认证
最后重启sshd服务即可。
[root@localhost ～]#/etc/rc.d/init.d/sshd restart
sshd服务启动完毕，就可以利用SecureCRT通过PublicKey认证远程登录Linux系统了。

实现免密码登录

把之前生成的后缀名为 pub 的密钥文件传到 Linux 服务器上，如果已经在用 Securecrt连接Linux系统，可以直接使用rz命令将密钥文件传到服务器上。然后开始导入pub文件。
ssh-keygen -i -f Identity.pub >> /root/.ssh/authorized_keys

完成后，在 /root/.ssh/ 下面就会多出一个 authorized_keys 文件。
这个就是服务器端的密钥文件。


[root@localhost ~]# ssh root@192.168.1.107
The authenticity of host '192.168.1.107 (192.168.1.107)' can't be established.
ECDSA key fingerprint is SHA256:DPLRhkaYF3bsC4pZ36gj9HUhKiTASX0vZtrKAulscD4.
ECDSA key fingerprint is MD5:2d:84:0e:04:e9:94:fc:c5:10:4c:20:08:40:40:99:74.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.107' (ECDSA) to the list of known hosts.
Last login: Fri Feb 22 19:21:01 2019 from 192.168.1.101


[root@localhost ~]# who
root     tty1         2019-02-22 19:18
root     pts/0        2019-02-22 19:21 (192.168.1.101)
root     pts/1        2019-02-22 19:24 (192.168.1.106)
[root@localhost ~]# who am i
root     pts/1        2019-02-22 19:24 (192.168.1.106)
​
### scp远程传输命令 * 1.将本地文件上传到远程服务器
scp /root/readme.txt 192.168.10.20:/home
​
​
* 2.把远程主机的文件下载到本地
scp 192.168.10.20:/etc/redhat-release /root

免密登录转为密码登录

PermitRootLogin这行改为 PermitRootLogin yes
PasswordAuthentication no改为 PasswordAuthentication  yes
UsePAM yes改为UsePAM  no  （Redhat系统保持默认yes）

设置 SSH 通过密钥登录

https://www.runoob.com/w3cnote/set-ssh-login-key.html