sshd服务的用途
- 作用：可以实现通过网络在远程主机中开启安全shell的操作
- Secure SHell ===>ssh ##客户端
- Secure SHell daemon ===>sshd ##服务端
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY ! Someone could be eavesdropping on you right now (man - in - the - middle attack) ! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256 : 1uLJ3EuYzt16BrtDrGdbjOY6wxCZcfppTLSwTI3BuCs. Please contact your system administrator. Add correct host key in / home / lee / .ssh / known_hosts to get rid of this message. Offending ECDSA key in / home / lee / .ssh / known_hosts : 1 ECDSA host key for 192.168.2.200 has changed and you have requested strict checking. Host key verification failed. 当连接因为认证问题被拒绝时解决方案 vim -rf ~/ .ssh / know_hosts ## 在此文件中删除报错提示相应的行即可 ssh 常用参数
-l ##指定登陆用户
-i ##指定私钥
-X ##开启图形
-f ##后台运行
-o ##指定连接参数
ssh -l root@192.168.2.200.x -o "StrictHostKeyChecking=no" 首次连接不许要输入yes
-t ##指定连接跳板
ssh -l root 192.168.2.100 -t ssh -l root 192.168.2.200
三.sshd key认证
认证类型
1.
对称加密
加密和解密是同一串字符
容易泄漏
可暴力破解
容易遗忘
2.
非对称加密
加密用公钥
，
解密用私钥
不会被盗用
攻击者无法通过无密钥方式登陆服务器
生成非对称加密密钥
方法
1
[root@free1 Desktop]# ssh-keygen
Generating public
/
private rsa key pair.
Enter file in which to save the key (
/
root
/
.ssh
/
id_rsa)
:
##
输入保存密钥文件
Enter passphrase (empty
for
no passphrase)
:
##密钥密码
Enter same passphrase again
:
##确认密码
Your identification has been saved in
/
root
/
.ssh
/
id_rsa. ##
私钥
Your public key has been saved in
/
root
/
.ssh
/
id_rsa.pub. ##
公钥
The key fingerprint is
:
SHA256:Dml0KdfKvk72cCh2xNr1o3dnnjBBkq5dfN1it7t+V1E root@free1The key's randomart image is:
注意：以上输入密码时一般都点回车，可以免密，如果要输入密码必须大于四位数
方法2 $ssh - keygen - f / root / .ssh / id_rsa - P "" 对服务器加密 ssh - copy - id - i / root / .ssh / id_rsa.pub username @westos 对用户加密，登陆时用使用密钥登陆 ssh - copy - id - i / root / .ssh / id_rsa.pub root @192.168.2.200 对root加密，登陆时用使用密钥登陆 测试 ssh -l root 192.168.2.200 ## 登陆root 用户不需要输入密码 sshd 安全优化参数详解 setenforce 0 systemctl disable -- now firewalld Port 2222 #设定端口为 2222 PermitRootLogin yes | no # 对超级用户登陆是否禁止PasswordAuthentication yes|no #是否开启原始密码认证方式
AllowUsers lee #用户白名单 DenyUsers lee #用户黑名单
