sshd服务

快来打我* 2022-06-07 11:28 211阅读 0赞

\#\#\#\#1.openssh-server\#\#\#\#

功能：让远程主机可以通过网络访问sshd服务，开始一个安全shell

\#\#\#\#2.客户端连接方式\#\#\#\#

ssh 远程主机用户@远程主机ip

\[root@desktop0 ~\]\# ssh root@172.25.254.11

The authenticity of host '172.25.254.11 (172.25.0.11)' can't be established.

ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.

Are you sure you want to continue connecting (yes/no)? yes \#\#连接陌生主机时需要建立认证关系

Warning: Permanently added '172.25.254.11' (ECDSA) to the list of known hosts.

root@172.25.254.11's password: \#\#远程用户密码

Last login: Wed Oct  18 10:33:06 2017

\[root@server ~\]\# \#\#登陆成功

![Center][]

ssh 远程主机用户@远程主机ip -X \#\#调用远程主机图形工具

![Center 1][]

ssh     远程主机用户@远程主机ip command \#\#直接在远程主机运行某条命令

![Center 2][]

\#\#\#\#3.sshkey加密\#\#\#\#

1.生成公钥私钥

\[root@server0 ~\]\# ssh-keygen \#\#生成公钥私钥工具（注意，如果这里要实现无密码链接，则可以一直可以输入回车，直到完成密钥的生成）

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id\_rsa):\[enter\] \#\#加密字符保存文件（建议用默认）

Created directory '/root/.ssh'.

Enter passphrase (empty for no passphrase): \[enter\] \#\#密钥密码，必须>4个字符

Enter same passphrase again: \[enter\] \#\#确认密码

Your identification has been saved in /root/.ssh/id\_rsa.

Your public key has been saved in /root/.ssh/id\_rsa.pub.

The key fingerprint is:

ab:3c:73:2e:c8:0b:75:c8:39:3a:46:a2:22:34:84:81 root@server0.example.com

The key's randomart image is:

\+--\[ RSA 2048\]----+

|o                |

|E.               |

|..               |

|.  . o           |

|.o. \* . S        |

|oo.o o   .       |

|+ =. .  .        |

|o. oo.+..        |

|    ..o\*.        |

\+-----------------+

![Center 3][]

\[root@server0 ~\]\# ls /root/.ssh/

id\_rsa  id\_rsa.pub

id\_rsa \#\#私钥，就是钥匙

id\_rsa.pub \#\#公钥，就是锁

2.添加key认证方式

\[root@server0 ~\]\# ssh-copy-id    -i    /root/.ssh/id\_rsa.pub     root@172.25.254.11            （这里要注意命令中的空格键）

ssh-copy-id \#\#添加key认证方式的工具

\-i \#\#指定加密key文件

/root/.ssh/id\_rsa.pub \#\#加密key

root \#\#加密用户为root

172.25.254.11 \#\#被加密主机ip

![Center 4][]

3.分发钥匙给client主机

\[root@server0 ~\]\# scp   /root/.ssh/id\_rsa root@172.25.254.10:/root/.ssh/

![Center 5][]

4.测试

\[root@desktop0 ~\]\# ssh root@172.25.254.11 \#\#通过id\_rsa直接连接不需要输入用户密码

\[root@server ~\]\#

![Center 6][]

\#\#\#\#4.提升openssh的安全级别\#\#\#\#

1.openssh-server配置文件

/etc/ssh/sshd\_config

![Center 7][]

78 PasswordAuthentication yes|no \#\#是否开启用户密码认证，yes为支持no为关闭

![Center 8][]

48 PermitRootLogin yes|no \#\#是否允许超级用户登陆

![Center 9][]

49 AllowUsers student westos \#\#用户白名单，只有在名单中出现的用户可以使用sshd建立shell

50 DenyUsers westos \#\#用户黑名单

![Center 10][]

2.控制ssh客户端访问

vim /etc/hosts.deny

![Center 11][]

sshd:ALL \#\#拒绝所有人链接sshd服务

![Center 12][]

vim /etc/hosts.allow

![Center 13][]

sshd:172.25.254.10\#\#允许10主机链接sshd

![Center 14][]

sshd:172.25.254.10， 172.25.254.180 \#\#允许10和180链接

sshd:ALL EXCEPT 172.25.254.200 \#\#只不允许200链接sshd

3.ssh登陆提示修改该

使用命令    vim /etc/motd  进入vim，然后加入要显示的登录信息，这里输入的是     hello   world    （\#\#显示登陆后字符）

然后保存退出，输入reboot，重启虚拟机。

hello world \#\#在登陆后就会显示这个字符

![Center 15][]

[Center]: /images/20220607/f7fb8387f2884b6b80a9e38414f8e1e3.png
[Center 1]: /images/20220607/60cb81fb3c60484990198e582ddc5e7f.png
[Center 2]: /images/20220607/d016cd68ec9a4692808171a486cb3e2b.png
[Center 3]: /images/20220607/0a86deddf0ec49329fab6c1575091ad6.png
[Center 4]: /images/20220607/2a39fdc569304e3e9b6303ed33457894.png
[Center 5]: /images/20220607/b1b9bec98ba24e7ca9b573ca83cc49ab.png
[Center 6]: /images/20220607/bcc065aab4694cde87e4278145ea3dd3.png
[Center 7]: /images/20220607/943aca234227458e99a0b70463929e46.png
[Center 8]: /images/20220607/773d4952e04a4bc981dde0e676554107.png
[Center 9]: /images/20220607/ef052ac5b3b24d159c4386fdc4a314ed.png
[Center 10]: /images/20220607/ca87671c7f9c4e7ab32cded0e4db3074.png
[Center 11]: /images/20220607/b3f1a28c61db451cbc79d0b4a46eee57.png
[Center 12]: /images/20220607/0b864e2a50114a3691b4688926c91d36.png
[Center 13]: /images/20220607/ff69f2999c4d482d8dd07d35ad5871d4.png
[Center 14]: /images/20220607/2d837509534a49d38293a55ee2aab5be.png
[Center 15]: /images/20220607/65715ffa619f40a198ba12ba806f46da.png