ICode9
精准搜索请尝试： 精确搜索
首页
编程语言>
数据库
系统相关
互联网
其他分享
Python
Java
JavaScript
android
PHP
首页 > 其他分享> 文章详细

SSH远程管理

2022-05-24 18:00:07  阅读：166  来源： 互联网

标签：rsa SSH 远程管理 172.16 copy root id ssh


SSH远程管理

远程连接

Linux:
     - ssh 端口：22  加密传输数据
     - telnet 端口：23  明文传输数据
windows：
	- rpd 端口 ：3389 remote desktop protocol

抓包演示

SSH数据加密传输

Telnet数据明文传输

企业面试题

# 写出下列服务或协议的端口
ftp			21
ssh			22
telnet		23
dns			53
mysql		3306
http		80
https		443
rsync		873

ssh免密连接

验证方式：

	1. 用户名密码验证
	2. 密钥对验证方式

ssh秘钥对认证流程

#　ssh-keygen :生成密钥对

Generating public/private rsa key pair.
# 将密钥保存到文件中，可以指定其他路径（直接回车）
Enter file in which to save the key (/root/.ssh/id_rsa): 
# 给密钥对设置密码，不需要设置（直接回车）
Enter passphrase (empty for no passphrase): 
# 重复输入设置的密码（直接回车）
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:ZtaU4r/a46kq2e2cTwifzqMw7P/AUfMkMJQOIKnAFU4 root@backup
The key's randomart image is:
+---[RSA 2048]----+
|o.oE..+.         |
|ooo . .o   .     |
|o  . o  = +      |
|.     .o O       |
|      o S o      |
|   . . B +       |
|    +oo.+ o      |
|   .oo.=o+.o     |
|    .o+=X**.     |
+----[SHA256]-----+



# 生成后的密钥对
[root@backup ~]# ll /root/.ssh/

-rw------- 1 root root 1675 May 24 15:41 id_rsa
-rw-r--r-- 1 root root  393 May 24 15:41 id_rsa.pub

# 发送公钥  ：ssh-copy-id
-i ：指定公钥的位置

[root@backup ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@10.0.0.31
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '10.0.0.31 (10.0.0.31)' can't be established.
ECDSA key fingerprint is SHA256:wGVlGAGUpQ81Lnju8l4JWZ1bkzS5HD2QLo+UGdeNrYc.
ECDSA key fingerprint is MD5:f3:9e:dd:de:07:39:20:cc:db:ca:78:6d:90:f7:76:f9.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@10.0.0.31's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@10.0.0.31'"
and check to make sure that only the key(s) you wanted were added.


# .ssh目录中的know_hosts作用
[root@backup ~]# cat ~/.ssh/known_hosts 
10.0.0.31 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBqysXIuaFhCmbuIya4GFDxLImWGWWaBFdRic8ZKzabH7lOf1ekEvY6uqe23wNnn3HTYKRaOmcXJOJ1h6CBb2E8=

# 记录连接过的服务器，如果没有连接过（第一次连），需要输入yes

生成密钥对命令：ssh-keygen

  1. 在当前用户的家目录下创建隐藏目录 .ssh mkdir ~/.ssh
  2. 将密钥存放到目录 .ssh 授权为700 chmod 700 ~/.ssh
  3. 将公钥内容写入 ~/.ssh/id_rsa.pub 文件中
  4. 将私钥内容写入到 ~/.ssh/id_rsa 文件中
  5. 将私钥文件授权为600 chmod 600 ~/.ssh/id_rsa

发送公钥：ssh-copy-id

ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.5

输入yes

输入密码

  1. 在远端的指定用户的家目录下创建隐藏目录.ssh
  2. 将密钥存放目录.ssh 授权为 700
  3. 先将在远端~/.ssh 目录下创建文件authorized_keys
  4. 将authorized_keys文件授权为600
  5. 将公钥内容保存到authorized_keys文件中

免密使用场景

1.批量查看服务器的信息

#!/bin/bash
[ $# -ne 1 ] && echo "请输入执行的命令" && exit 1
for i in 5 7 8 31 41
do
   	echo "#########172.16.1.$i#####"
	ssh root@172.16.1.$i "$1"
done

2.跳板机

#！/bin/bash
#jumpserver
lb01=10.0.0.5
lb02=10.0.0.6
web01=10.0.0.7
web02=10.0.0.8
web03=10.0.0.9
nfs=10.0.0.31
backup=10.0.0.41
db01=10.0.0.51
m01=10.0.0.61
zabbix=10.0.0.71
 
menu(){
        cat <<-EOF
        +-------------------------+
        |     1) lb01             |
        |     2) lb02             |
        |     3) web01            |
        |     4) web02            |
        |     5) web03            |
        |     6) nfs              |
        |     7) backup           |
        |     8) db01             |
        |     9) m01              |
        |     10) zabbix          |
        |     h) help             |
        +-------------------------+
EOF
}
#菜单函数
menu
 
#连接函数
connect(){
  ping -c 1 -w 1 $1 &>/dev/null
  if [ $? -eq 0 ];then
    ssh root@$1
  else
    echo -e "\033[5;4;40;31m 别连了,我的哥,$2:$1机器都没开!!!\033[0m"
  fi
}
 
#控制不让输入ctrl+c,z
trap "" HUP INT TSTP
while true
do
    read -p "请输入要连接的主机编号：" num
    case $num in
            1|lb01)
              connect $lb01 lb01
                    ;;
            2|lb02)
              connect $lb02 lb02
                    ;;
            3|web01)
              connect $web01 web01
                    ;;
            4|web02)
              connect $web02 web02
                    ;;
            5|web03)
                  connect $web03 web03
                    ;;
            6|nfs)
              connect $nfs nfs
                    ;;
            7|backup)
                  connect $backup backup
                    ;;
            8|db01)
                   connect $db01 db01
                    ;;
            9|m01)
                    connect $m01 m01
                    ;;
            10|zabbix)
                    connect $zabbix zabbix
                    ;;
            h|help)
                    clear
                    menu
                    ;;
            close)
                    break
                    ;;
    esac
done

ssh安全优化

# 配置文件
[root@m01 ~]# vim /etc/ssh/ssh_config 
17 Port 52022 # 修改默认端口
115 UseDNS no # 关闭反向解析
38 PermitRootLogin no # 禁止root用户登录
65 PasswordAuthentication no # 禁止使用密码登录
79 GSSAPIAuthentication no # 关闭GSSAPI认证

# 重启服务
[root@m01 ~]# systemctl restart sshd

# 解决方案
如果优化好的ssh发现以下问题
1.没有普通用户
useradd  zh  （无法创建进入单用户模式）
2.Windows上没有推送密钥
	在windows上生成密钥对
	- 使用windows的命令执行ssh-keygen
	- 使用Xshell

使用Xshell生成密钥对

生成密钥对

[hz@m01 ~]$ mkdir .ssh
[hz@m01 ~]$ chmod 700 .ssh
[hz@m01 ~]$ vim .ssh/authorized_keys

  1 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApiqMuZeV5gNd/GOa0wCgofxUyXVF    yUK9gpZokHGbAUPRmmzy8xX5+bic0pM5JQWVidQwmPIpFxbQQXBcXUT1FrMExw8r    VJBvW2C7ktxpyYxxV7pP3Lwd8XzlEW2NfXU7Eyvk5uxULmEGTWSrh9YEr82EFHLQ    v4yIVua7JBz3iqebCmWKGWvjkJ8yLjyzPbXlY2Ju7KWMpCjly5AddNXWv01mPff0    ebzR2koT8xU81wosfaTzPhRRi6OT5b27g8J1iW+qPfiRiyiPNjMP7buC7XoaVuop    xsvZb9ogZFfMtVz0w7Av+mbul6U0jLMFnzJwkqv9XGlqWGWBjbNsDbTDkw==
  
[hz@m01 ~]$ chmod 600 .ssh/authorized_keys

免交互生成密钥对

ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
-t：指定加密类型
-P：空密码
-f：秘钥生成的位置

免交互推送公钥

#!/bin/bash
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.31
ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.41
ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.5
ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.7
ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.8

# 循环
#!/bin/bash
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null

for n in `cat /root/1.txt`;do
	ssh-copy-id -i ~/.ssh/id_rsa.pub root@$n
done

# 解决免交互问题
1.使用expect解决
#!/usr/bin/expect
set ip 172.16.1.31
set pass 1
set timeout 30
spawn ssh-keygen
expect {
	"id_rsa):" {send "\r"; exp_continue}
	"passphrase):" {send "\r"; exp_continue}
	"again:" {send "\r"}
}
expect eof
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@$ip
expect {
		"(yes/no)" {send "yes\r"; exp_continue}
		"password:" {send "$pass\r"}
}
#expect "root@*" {send "df -h\r"}
#expect "root@*" {send "df -h\r"}
expect eof


2.使用sshpass解决
[root@m01 ~]# yum install -y sshpass
[root@m01 ~]# ssh -o 'StrictHostKeyChecking no' root@172.16.1.7
[root@m01 ~]# sshpass -p 1 ssh-copy-id -o 'StrictHostKeyChecking no' -i ~/.ssh/id_rsa.pub
root@172.16.1.8

######################################################
[root@m01 ~]# vim 1.txt

172.16.1.31
172.16.1.41
172.16.1.7
172.16.1.8


[root@m01 ~]# vim send_public_key.sh
#!/bin/bash
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
for n in `cat /root/1.txt`;do
	shpass -p 1 ssh-copy-id -o 'StrictHostKeyChecking no' -i ~/.ssh/id_rsa.pub root@$n
done


# 密码不一致
[root@m01 ~]# vim /root/2.txt
172.16.1.31:1
172.16.1.41: 
172.16.1.5:3
172.16.1.7:4
172.16.1.8:111


#!/bin/bash
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
for n in `cat /root/1.txt`;do
	pass=`echo $n|awk -F ':' '{print $2}'`
	ip=`echo $n|awk -F ':' '{print $1}'`
	sshpass -p $pass ssh-copy-id -o 'StrictHostKeyChecking no' -i ~/.ssh/id_rsa.pub root@$ip
done

优化后的脚本

#!/bin/bash
. /etc/init.d/functions
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
for n in `cat /root/1.txt`;do
	pass=`echo $n|awk -F ':' '{print $2}'`
	ip=`echo $n|awk -F ':' '{print $1}'`
	sshpass -p $pass ssh-copy-id -o 'StrictHostKeyChecking no' -i ~/.ssh/id_rsa.pub root@$ip     &>/dev/null
	if [ $? -eq 0 ];then
		action "$ip send public key " /bin/true
	else
		action "$ip send public key " /bin/false
	fi
done

# 优化后不使用判断的脚本
#!/bin/bash
. /etc/init.d/functions
ls -l ~/.ssh/id_rsa &>/dev/null || ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa &>/dev/null
for n in `cat /root/1.txt`;do
	pass=`echo $n|awk -F ':' '{print $2}'`
	ip=`echo $n|awk -F ':' '{print $1}'`
	sshpass -p $pass ssh-copy-id -o 'StrictHostKeyChecking no' -i ~/.ssh/id_rsa.pub root@$ip
&>/dev/null && \
	action "$ip send public key " /bin/true || \
	action "$ip send public key " /bin/false
done

标签：rsa,SSH,远程管理,172.16,copy,root,id,ssh
来源： https://www.cnblogs.com/ghjhkj/p/16306525.html

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。

关于我们 | 联系我们 | 留言反馈

专注分享技术，共同学习，共同进步。侵权联系[81616952@qq.com]

Copyright (C)ICode9.com, All Rights Reserved.

ICode9版权所有