ssh首次登录避免输入yes、两台服务器间免密钥登录

约定不等于承诺〃 2021-12-24 02:07 365阅读 0赞

user从服务器A首次登录服务器B，会被询问是否继续连接，这时输入yes才能继续，并把B的信息添加到A服务器user夹目录下的~/.ssh/known\_hosts文件中。

即，服务器A（10.123.123.11）首次连服务器B（10.123.123.22）

[root@serverA Downloads]# ssh root@10.123.123.22
    
    The authenticity of host '10.123.123.22 (10.123.123.22)' can't be established.
    
    RSA key fingerprint is 78:8b:2d:20:cb:16:43:d7:b9:f5:27:c1:9c:1c:a0:66.
    
    Are you sure you want to continue connecting (yes/no)? yes
    
    Warning: Permanently added '10.123.123.22' (RSA) to the list of known hosts.
    
    root@10.123.123.22's password:

输入密码成功连接后，A服务器的文件 ~/.ssh/known\_hosts最后会新增一行 "10.123.123.22 ssh-rsa ACAAB……DWQQ=="

1.有的时候脚本中用ssh连接需要避免被询问

可以在ssh的时候带上 -o "StrictHostKeyChecking=no"参数。直接要求输入密码，连接后将Server B添加到 ~/.ssh/known\_hosts

[root@serverA Downloads]# ssh -o StrictHostKeyChecking=no root@10.123.123.22
    
    root@10.123.123.22's password:

希望登录其它服务器避免被询问也可以在/etc/ssh/ssh\_config中设置 "StrictHostKeyChecking no"，默认是注释掉的 "\#   StrictHostKeyChecking ask"。修改后不会被询问而直接要求输入密码，连接后同样会将Server B添加到 ~/.ssh/known\_hosts

[root@serverA Downloads]# ssh root@10.123.123.22
    
    Warning: Permanently added '10.123.123.22' (RSA) to the list of known hosts.
    
    root@10.123.123.22's password:

2.如果服务器B发生变化，比如重装了，服务器A再去连接服务器B就会失败，出现如下提示，

[root@serverA ~]# scp test.zip root@10.123.123.22:/root
    
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    
    @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
    
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    
    IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
    
    Someone could be eavesdropping on you right now (man-in-the-middle attack)!
    
    It is also possible that the RSA host key has just been changed.
    
    The fingerprint for the RSA key sent by the remote host is
    
    6b:f4:e5:3d:52:e3:34:a7:77:54:45:0f:de:83:4b:37.
    
    Please contact your system administrator.
    
    Add correct host key in /root/.ssh/known_hosts to get rid of this message.
    
    Offending key in /root/.ssh/known_hosts:159
    
    RSA host key for 10.123.123.22 has changed and you have requested strict checking.
    
    Host key verification failed.
    
    lost connection
    
    [root@serverA ~]#

根据提示，host key不对，去/root/.ssh/known\_hosts这个文件将Server B 旧信息的那行删除就可以了。

3.两台服务器间配置免密钥登录

1）在服务器 A 上生成 rsa密钥。

登录服务器后，在任意路径下执行以下命令（要求输入 file in which to save the key 和 passphrase 时按回车）：

\# ssh-keygen -t rsa

[root@serverA Downloads]# ssh-keygen -t rsa
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    The key fingerprint is:
    a1:70:76:16:d7:60:3f:72:ee:9a:38:b4:bc:22:06:e8 root@serverA
    The key's randomart image is:
    +--[ RSA 2048]----+
    |        ..oo     |
    |         o...    |
    |    . o + . +    |
    |     + . . + .   |
    |   .  . S   .    |
    |  . .     ..     |
    | .   .   o ..    |
    |  E   o . ++     |
    |     . . .=o     |
    +-----------------+
    [root@serverA Downloads]#

生成的 id\_rsa.pub 默认存放在 /root/.ssh

2）将 id\_rsa.pub 重命名为serverA.pub传到服务器B，需要输入服务器B的密码

\# scp id\_rsa.pub root@10.123.123.22:/root/.ssh/serverA.pub

登录服务器B,把该密钥追加到authorized\_keys

\# cd /root/.ssh/

\# cat serverA.pub >> authorized\_keys

至此，服务器B可以免密钥登录服务器A

3)同理在服务器 B 上生成 rsa密钥。

\# ssh-keygen -t rsa

将 id\_rsa.pub 重命名为serverA.pub传到服务器A

\# scp id\_rsa.pub root@10.123.123.11:/root/.ssh/serverB.pub

登录服务器A,把该密钥追加到authorized\_keys

\# cd /root/.ssh/

\# cat serverB.pub >> authorized\_keys

至此，服务器A和服务器B之间可以免密钥登录

注意：例子中用的是root用户，所以密钥默认放在/root/.ssh，其它用户生成的密钥也会默认放在自己的家目录下。

例如新建一个用户test，生成rsa密钥

[test@serverA ~]$ ssh-keygen -t rsa
    
    Generating public/private rsa key pair.
    
    Enter file in which to save the key (/home/test/.ssh/id_rsa):
    
    Created directory '/home/test/.ssh'.
    
    Enter passphrase (empty for no passphrase):
    
    Enter same passphrase again:
    
    Your identification has been saved in /home/test/.ssh/id_rsa.
    
    Your public key has been saved in /home/test/.ssh/id_rsa.pub.
    
    The key fingerprint is:
    
    dc:41:89:d6:f7:63:81:57:88:87:40:91:42:73:cf:c6 test@serverA
    
    The key's randomart image is:
    
    +--[ RSA 2048]----+
    
    |       .o+*= + o.|
    
    |        ++*+= =  |
    
    |       . ...E+ . |
    
    |       . . o  +  |
    
    |        S .  . . |
    
    |                 |
    
    |                 |
    
    |                 |
    
    |                 |
    
    +-----------------+
    
    [test@serverA ~]$