(1)實驗環境
兩台CentOS7：
youxi1 192.168.1.6
youxi2 192.168.1.7
這里我將防火牆關閉進行實驗，如果防火牆開啟，請將端口加入到防火牆規則中。
(2).目標
在ssh端口不為22的情況下，進行單向免密登錄或雙向免密登錄（端口不一致）
(3).實驗
首先修改兩台服務器的端口，vim /etc/ssh/sshd_config，找到如下部分
|
1
|
#Port 22
|
將#去除，22改為想要的端口號。這里我將youxi1的ssh端口號改為2890，youxi2的ssh端口號改為2891。
接着使用命令systemctl restart sshd重啟服務。再使用netstat -tlunp | grep sshd查看端口號（如果沒有netstat請安裝net-tools）
|
1
2
3
4
5
6
|
[root@youxi1 Packages]# netstat -tlunp | grep sshd
//youxi1
tcp 0 0 0.0.0.0:2890 0.0.0.0:* LISTEN 9953/sshd
tcp6 0 0 :::2890 :::* LISTEN 9953/sshd
[root@youxi2 ~]# netstat -tlunp | grep sshd
//youxi2
tcp 0 0 0.0.0.0:2891 0.0.0.0:* LISTEN 17526/sshd
tcp6 0 0 :::2891 :::* LISTEN 17526/sshd
|
1）單向免密登錄
youxi1使用ssh遠程youxi2不需要密碼，但youxi2使用ssh遠程youxi1需要密碼
在yousi1上使用ssh-keygen生成公鑰和私鑰（這里使用默認的rsa），一路默認即可
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
[root@youxi1 ~]# ssh-keygen -t rsa
//默認指定的是rsa，所以可以沒有-t rsa
Generating
public
/
private
rsa key pair.
Enter file
in
which to save the key (/root/.ssh/id_rsa):
//選項沒有指定生成地址時，此處也可以指定
Created directory
'/root/.ssh'
.
Enter passphrase (empty
for
no passphrase):
Enter same passphrase again:
Your identification has been saved
in
/root/.ssh/id_rsa.
Your
public
key has been saved
in
/root/.ssh/id_rsa.pub.
The key fingerprint
is
:
SHA256:ia+le9ZX3cAxztmIINJbWnEGrK9lq4lY4pYNevgqecM root@youxi1
The key's randomart image
is
:
+---[RSA 2048]----+
| . .ooo |
| . o =o o |
| . B . = * |
| .+. . B .|
| . S. o.|
| . . + . o|
| o o.+. o= . . |
|o E.++.=+.o . |
| o.*+ =+o. . |
+----[SHA256]-----+
|
在沒有指定生成地址時，會默認生成到家目錄下的.ssh/目錄下。使用rsa就會生成id_rsa和id_rsa.pub兩個文件，如果使用的是dsa則生成的是id_dsa和id_dsa.pub兩個文件。
|
1
2
|
[root@youxi1 ~]# ls /root/.ssh/
id_rsa id_rsa.pub
|
接着使用命令ssh-copy-id命令將公鑰發到youxi2服務器上
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@youxi1 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2891 root@192.168.1.7
//-p選項指定被遠程的服務器的端口號
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed:
".ssh/id_rsa.pub"
The authenticity of host
'[192.168.1.7]:2891 ([192.168.1.7]:2891)'
can't be established.
ECDSA key fingerprint
is
SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.
ECDSA key fingerprint
is
MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.
Are you sure you want to
continue
connecting (yes/no)? yes
//yes繼續
/usr/bin/ssh-copy-id: INFO: attempting to log
in
with the
new
key(s), to filter
out
any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed --
if
you are prompted now it
is
to install the
new
keys
root@192.168.1.7's password:
//輸入192.168.1.7服務器上的root用戶的密碼
Number of key(s) added: 1
Now
try
logging
into
the machine, with:
"ssh -p '2891' 'root@192.168.1.7'"
and check to make sure that only the key(s) you wanted were added.
|
公鑰傳完后雖然會在本地生成.ssh/known_hosts文件，但並不生效。而在youxi2服務器的root用戶的家目錄下生成.ssh目錄，並含有authorized_keys文件。
|
1
2
|
[root@youxi1 ~]# ls .ssh/
authorized_keys
|
此時youxi1上的id_rsa.pub文件與youxi2是上的authorized_keys文件相同。
最后測試：在youxi1上ssh遠程youxi2，會發現並不需要輸入密碼
|
1
2
3
4
|
[root@youxi1 ~]# ssh -p 2891 root@192.168.1.7
Last login: Sun May 12 17:46:49 2019
from
youxi1.cn
[root@youxi2 ~]# ls .ssh/
authorized_keys
|
注意：是本機生成的公鑰發給被遠程的服務器，在發送公鑰和遠程服務器時，都需要指定被遠程的服務器的端口號。
2）雙向免密登錄
雙向免密就是互換公鑰即可，這里接着上面把youxi2的公鑰發送到youxi1上，並進行測試。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
[root@youxi2 ~]# ssh-keygen
Generating
public
/
private
rsa key pair.
Enter file
in
which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty
for
no passphrase):
Enter same passphrase again:
Your identification has been saved
in
/root/.ssh/id_rsa.
Your
public
key has been saved
in
/root/.ssh/id_rsa.pub.
The key fingerprint
is
:
SHA256:9+woxNPvkE99zGUEZNcI+DJaUUIZXXMKb7k/Y6kPiJU root@youxi2
The key's randomart image
is
:
+---[RSA 2048]----+
| .+*++*.+|
| +..+.B.|
| o = .|
| + o. o |
| .S+.E . o|
| =.++.. =o|
| . ooo+..==|
| . *. +.o|
| ...+... |
+----[SHA256]-----+
[root@youxi2 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2890 root@192.168.1.6
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed:
".ssh/id_rsa.pub"
The authenticity of host
'[192.168.1.6]:2890 ([192.168.1.6]:2890)'
can't be established.
ECDSA key fingerprint
is
SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.
ECDSA key fingerprint
is
MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.
Are you sure you want to
continue
connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log
in
with the
new
key(s), to filter
out
any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed --
if
you are prompted now it
is
to install the
new
keys
root@192.168.1.6's password:
Number of key(s) added: 1
Now
try
logging
into
the machine, with:
"ssh -p '2890' 'root@192.168.1.6'"
and check to make sure that only the key(s) you wanted were added.
[root@youxi2 ~]# ssh -p 2890 root@192.168.1.6
Last login: Sun May 12 17:24:54 2019
from
youxi2.cn
[root@youxi1 ~]#
|
注：轉自https://www.cnblogs.com/diantong/p/10852042.html