参考
Centralized authorized_keys (AuthorizedKeysFile) for sshd
ssh key management
需求
登录用户有3类权限，访客权限，部署权限，管理权限.
访客权限为最小权限，仅能对登录用户目录进行读写，对其他用户目录只读，系统目录无读写.
部署权限对app部署用户目录具有读写权限（程序不依赖系统服务，如java -jar 程序）.
管理权限对系统目录具读写权限（程序依赖系统服务，nginx, mysql, tomcat）.
不同主机对不同用户权限不同。
运维组具有管理权限，业务组管理的主机具有部署权限或者管理权限，访客权限一般不开，除非有特殊要求，如需要查看部署结果.
| user | group | sudo app? | sudo root? | sudo su? |
|---|---|---|---|---|
| admin | adm | y | y | y |
| web | app | y | y | n |
| db | n | y | n | |
| test | n | n | n |
生成服务器匙
ssh-keygen -t rsa -f /tmp/admin
# /tmp/admin & /tmp/admin.pub
ssh-keygen -t rsa -f /tmp/test
# /tmp/test & /tmp/test.pub
ssh-keygen -t rsa -f /tmp/web
# /tmp/web & /tmp/web.pub
ssh-keygen -t rsa -f /tmp/db
# /tmp/db & /tmp/db.pub
目标服务器
# /etc/ssh/sshd_config
Port 60022
ListenAddress 192.168.100.100 # 绑定主机内网地址
PermitRootLogin no # without-password
AuthorizedKeysFile /etc/ssh/authorized_keys/%u
PasswordAuthentication no
GSSAPIAuthentication no
GSSAPIKeyExchange no
GSSAPIStoreCredentialsOnRekey no
GSSAPICleanupCredentials no
GSSAPIStrictAcceptorCheck no
ChallengeResponseAuthentication no
UsePAM yes
UseDNS no
mkdir /etc/ssh/authorized_keys # 建立key目录
/etc/init.d/sshd restart # 重启ssh服务
useradd -u 500 -d /opt/app app # 建立部署用户app, 用户id 500, 用户目录/opt/app
chmod 755 /opt/app # 改变用户权限为755
useradd -u 501 admin # 建立登录用户admin, 用户id 501
cp /tmp/admin.pub /etc/ssh/authorized_keys/admin # 拷贝用户公匙到key目录，文件名为用户名
chmod 644 /etc/ssh/authorized_keys/admin # 改变key权限为644
ssh -i /tmp/admin admin@192.168.100.100 # 测试key登录
非wheel组成员禁用su
/etc/pam.d/su
#auth required pam_wheel.so use_uid
auth required pam_wheel.so use_uid
usermod -G adm admin
usermod -G web app
sudo配置
/etc/sudoers.d/security
# User alias specification
User_Alias ADMIN = admin
User_Alias SERVICE = db
User_Alias APP = web
# Cmnd alias specification
Cmnd_Alias SU = /bin/su
# Cmnd alias specification
Cmnd_Alias SU = /bin/su
# User specification
ADMIN ALL=(ALL) NOPASSWD: ALL, !SU
APP ALL=(ALL) NOPASSWD: !SU, /bin/chgrp, /bin/chmod, /bin/chown, (app) NOPASSWD: ALL
SERVICE ALL=(ALL) NOPASSWD: !SU, /bin/chgrp, /bin/chmod, /bin/chown, (app) NOPASSWD: ALL
# nginx
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/nginx start
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/nginx stop
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/nginx restart
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/nginx reload
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/nginx status
# php-fpm
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/php-fpm start
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/php-fpm stop
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/php-fpm restart
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/php-fpm reload
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/php-fpm status
# apache
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/httpd start
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/httpd stop
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/httpd restart
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/httpd reload
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/httpd status
# mysql
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/mysqld start
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/mysqld stop
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/mysqld restart
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/mysqld reload
%SERVICE ALL =(ALL) NOPASSWD: /etc/init.d/mysqld status
# web
sudo -u app vim /opt/app/1.txt
sudo su -
