ssh 配置使用密钥登录

说明：

服务器IP：192.168.1.200

管理员账号：root 密码：chenyi

普通登录账号: itchenyi.com 密码：chenyi

实现目的：

1、配置普通账号通过密钥验证远程SSH登录服务器

2、禁用root账号通过远程SSH登录服务器

3、禁用所有账号通过密码验证远程SSH登录服务器

具体操作：

1、配置普通账号通过密钥验证远程SSH登录服务器

使用普通账号itchenyi.com登录服务器操作

ssh-keygen -t rsa #生成密钥

双击代码全选


[itchenyi.com@chenyi ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/itchenyi.com/.ssh/id_rsa): 
Created directory '/home/itchenyi.com/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/itchenyi.com/.ssh/id_rsa.
Your public key has been saved in /home/itchenyi.com/.ssh/id_rsa.pub.
The key fingerprint is:
b6:4c:c3:3c:24:c1:57:d6:11:b5:8f:f7:37:75:f5:69 itchenyi.com@chenyi
The key's randomart image is:
+--[ RSA 2048]----+
|     ..  .o.o+.  |
|      ....  .  . |
|      ...     . .|
|       =       o+|
|        S     .E*|
|       + +    ..+|
|        o      .o|
|                o|
|                 |
+-----------------+

双击代码全选
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22	`[itchenyi.com@chenyi ~]$ ssh-keygen -t rsa` `Generating public/private rsa key pair.` `Enter file in which to save the key (/home/itchenyi.com/.ssh/id_rsa):` `Created directory '/home/itchenyi.com/.ssh'.` `Enter passphrase (empty for no passphrase):` `Enter same passphrase again:` `Your identification has been saved in /home/itchenyi.com/.ssh/id_rsa.` `Your public key has been saved in /home/itchenyi.com/.ssh/id_rsa.pub.` `The key fingerprint is:` `b6:4c:c3:3c:24:c1:57:d6:11:b5:8f:f7:37:75:f5:69 itchenyi.com@chenyi` `The key's randomart image is:` `+--[ RSA 2048]----+` `\| .. .o.o+. \|` `\| .... . . \|` `\| ... . .\|` `\| = o+\|` `\| S .E*\|` `\| + + ..+\|` `\| o .o\|` `\| o\|` `\| \|` `+-----------------+`

[itchenyi.com@chenyi ~]$ cd /home/itchenyi.com/.ssh/ #进入目录

[itchenyi.com@chenyi ~]$ mv id_rsa.pub authorized_keys #生成验证文件

下载服务器/root/.ssh/id_rsa文件到本地（这里采用flashfxp工具下载）

打开puttygen.exe

下载地址：http://www.itchenyi.com/2911.html

选择Conversions-Import key打开上一步下载到本地的文件id_rsa

点Save private key，根据提示选择“是”，最后保存为id_rsa.ppk

双击代码全选


C:UsersAdministratorDesktopwww.itchenyi.com>dir
2012/12/19 周三  00:00             1,675 id_rsa
2012/12/19 周三  00:02             1,464 id_rsa.ppk          cmd查看的信息，省去了截图

双击代码全选
1 2 3	`C:UsersAdministratorDesktopwww.itchenyi.com>dir` `2012/12/19 周三 00:00 1,675 id_rsa` `2012/12/19 周三 00:02 1,464 id_rsa.ppk cmd查看的信息，省去了截图`

2、禁止root通过SSH远程登录服务器、禁用所有账号通过密码验证远程SSH登录服务器下面为有效配置，其中只修改了3个点，可针对你的环境自行设置

双击代码全选


[root@chenyi .ssh]# grep -v "^#" /etc/ssh/sshd_config | grep -v "^$"
Port 8888                            设置端口为 8888
Protocol 2
SyslogFacility AUTHPRIV
PermitRootLogin no                 禁止root远程登录
PasswordAuthentication no      禁止所有帐号通过密码验证登录
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes
Subsystem   sftp    /usr/libexec/openssh/sftp-server

双击代码全选
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16	`[root@chenyi .ssh]# grep -v "^#" /etc/ssh/sshd_config \| grep -v "^$"` `Port 8888 设置端口为 8888` `Protocol 2` `SyslogFacility AUTHPRIV` `PermitRootLogin no 禁止root远程登录` `PasswordAuthentication no 禁止所有帐号通过密码验证登录` `ChallengeResponseAuthentication no` `GSSAPIAuthentication yes` `GSSAPICleanupCredentials yes` `UsePAM yes` `AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES` `AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT` `AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE` `AcceptEnv XMODIFIERS` `X11Forwarding yes` `Subsystem sftp /usr/libexec/openssh/sftp-server`