一.主機互信原理
兩個主機之間ssh登錄需要提示輸入對方的密碼，當頻繁需要登錄操作時,可以通過linux公鑰和秘鑰，建立雙機信任關系。
把你源主機的公鑰文件內容追加到目的主機對應用戶下的authorized_keys文件中(如果沒有這個文件，則創建一個)
二.操作流程
兩台主機分別是node1的ip是1192.168.37.8，node2的ip是192.168.37.9
1. 生成秘鑰(兩台主機分別操作)
ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa #生成rsa
1) node1節點操作 - 生成密鑰
[root@node1 ~]# ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa #node1節點生成密鑰 Generating public/private rsa key pair. Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:1RzOG0HzkXAAZz6YdYMp6vgGev0zzv3zzM3VF5cKb30 root@node1 The key's randomart image is:
+---[RSA 2048]----+
| .o@==. |
| .%oB.o |
| .+.O . |
| .. + .|
| oS .. o.|
| o . o o +|
| . + + .E|
| . . +.o.. .+=|
| . . o+o...o*|
+----[SHA256]-----+ [root@node1 ~]#
2) node2節點操作 -生成密鑰
[root@node2 ~]# ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa #node2節點生成密鑰 Generating public/private rsa key pair. Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:9mRYbTPIQ3pSYwdMO5/byswezu7uicSAF9AJAxPisqU root@node2 The key's randomart image is:
+---[RSA 2048]----+
| . +o+o +B.. |
| . . . oo*.* |
|. o + O = |
| = . * = + |
|E . S o o |
| o * o |
| + o . |
| . B + |
| .*# |
+----[SHA256]-----+ [root@node2 ~]#
2.信任主機操作(兩台主機分別操作)
ssh-copy-id -i ~/.ssh/id_rsa.pub root@對方ip
1) node1節點設置互信
[root@node1 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.37.9 #復制37的公鑰到38機器上，這樣就可以使用在37機器上免密碼登錄38機器了。 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.37.9's password:
Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'root@192.168.37.9'" and check to make sure that only the key(s) you wanted were added. [root@node1 ~]#
2) node2節點設置互信
[root@node2 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.37.8 #復制node2的公鑰到node1機器上，這樣就可以使用在node2機器上免密碼登錄node1機器了 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.37.8's password:
Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'root@192.168.37.8'" and check to make sure that only the key(s) you wanted were added. [root@node2 ~]#
3.測試ssh機器免密
1) node1節點訪問node2
[root@node1 ~]# [root@node1 ~]# ssh 192.168.37.9 Last login: Wed Oct 13 22:13:07 2021 from 192.168.37.8 [root@node2 ~]#
node2節點訪問node1
[root@node2 ~]# ssh 192.168.37.8 Last login: Mon Sep 20 18:30:35 2021 from 192.168.37.9 [root@node1 ~]#