原创发表更新Tools / SSH18 分钟读完 (大约2719个字)0次访问

SSH

版权申明：本文为原创文章，转载请注明原文出处

原文链接：http://blog.pp6f.com/2022/03/03/Tools/ssh/

  • SSH（Secure Shell ）是一种安全通道协议，主要用来实现字符界面的远程的登录、远程复制等功能。
  • SSH协议对通信双方的数据传输进行了加密处理，其中包括用户登录时输入的用户口令。因此SSH协议具有很好的安全性。

索引

Server SSH配置

  • 参考文章

    服务端使用的工具

  • OpenSSH
  • OpenSSH 是实现 SSH 协议的开源软件项目，适用于各种 UNIX、Linux 操作系统。
  • CentOS7 系统默认已安装 OpenSSH 相关软件包，并已将 sshd 服务添加为开机自启动。

SSH服务开启 状态查询

  • 开启

      sudo systemctl start sshd

  • 状态查询

      sudo systemctl status sshd

SSH配置

  • sshd 默认端口号为 22

  • /etc/ssh/sshd_config 针对服务端的配置文件

    1
    vi /etc/ssh/sshd_config
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135
    136
    137
    138
    139
    140
    141
    142
    #	$OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

    # This is the sshd server system-wide configuration file.  See
    # sshd_config(5) for more information.

    # This sshd was compiled with PATH=/usr/local/bin:/usr/bin

    # The strategy used for options in the default sshd_config shipped with
    # OpenSSH is to specify options with their default value where
    # possible, but leave them commented.  Uncommented options override the
    # default value.

    # If you want to change the port on a SELinux system, you have to tell
    # SELinux about this change.
    # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
    #
    #Port 22                            # 监听端口
    #AddressFamily any
    #ListenAddress 0.0.0.0              # 指定监听地址  0.0.0.0表示监听所有地址
    #ListenAddress ::

    HostKey /etc/ssh/ssh_host_rsa_key
    #HostKey /etc/ssh/ssh_host_dsa_key
    HostKey /etc/ssh/ssh_host_ecdsa_key
    HostKey /etc/ssh/ssh_host_ed25519_key

    # Ciphers and keying
    #RekeyLimit default none

    # Logging
    #SyslogFacility AUTH
    SyslogFacility AUTHPRIV
    #LogLevel INFO

    # Authentication:

    #LoginGraceTime 2m                  # 登录验证事件为2分钟
    #PermitRootLogin yes                # 允许root用户登录
    #StrictModes yes
    #MaxAuthTries 6                     # 重试最大次数为6
    #MaxSessions 10

    #PubkeyAuthentication yes           # 启用密钥对验证
    # RSAAuthentication yes             # RSA认证 非必须 不存在不添加此项

    # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
    # but this is overridden so installations will only check .ssh/authorized_keys
    AuthorizedKeysFile	.ssh/authorized_keys        # 指定公钥库文件

    #AuthorizedPrincipalsFile none

    #AuthorizedKeysCommand none
    #AuthorizedKeysCommandUser nobody

    # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # HostbasedAuthentication
    #IgnoreUserKnownHosts no
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes

    # To disable tunneled clear text passwords, change to no here!
    #PasswordAuthentication yes             # 启用密码验证
    #PermitEmptyPasswords no                # 是否允许空密码登录
    PasswordAuthentication yes

    # Change to no to disable s/key passwords
    #ChallengeResponseAuthentication yes
    ChallengeResponseAuthentication no

    # Kerberos options
    #KerberosAuthentication no
    #KerberosOrLocalPasswd yes
    #KerberosTicketCleanup yes
    #KerberosGetAFSToken no
    #KerberosUseKuserok yes

    # GSSAPI options
    GSSAPIAuthentication yes
    GSSAPICleanupCredentials no
    #GSSAPIStrictAcceptorCheck yes
    #GSSAPIKeyExchange no
    #GSSAPIEnablek5users no

    # Set this to 'yes' to enable PAM authentication, account processing,
    # and session processing. If this is enabled, PAM authentication will
    # be allowed through the ChallengeResponseAuthentication and
    # PasswordAuthentication.  Depending on your PAM configuration,
    # PAM authentication via ChallengeResponseAuthentication may bypass
    # the setting of "PermitRootLogin without-password".
    # If you just want the PAM account and session checks to run without
    # PAM authentication, then enable this but set PasswordAuthentication
    # and ChallengeResponseAuthentication to 'no'.
    # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
    # problems.
    UsePAM yes

    #AllowAgentForwarding yes
    #AllowTcpForwarding yes
    #GatewayPorts no
    X11Forwarding yes
    #X11DisplayOffset 10
    #X11UseLocalhost yes
    #PermitTTY yes
    #PrintMotd yes
    #PrintLastLog yes
    #TCPKeepAlive yes
    #UseLogin no
    #UsePrivilegeSeparation sandbox
    #PermitUserEnvironment no
    #Compression delayed
    #ClientAliveInterval 0
    #ClientAliveCountMax 3
    #ShowPatchLevel no
    #UseDNS yes                         # 是否允许dns反向解析, 禁止可以提升反应速度
    #PidFile /var/run/sshd.pid
    #MaxStartups 10:30:100
    #PermitTunnel no
    #ChrootDirectory none
    #VersionAddendum none

    # no default banner path
    #Banner none

    # Accept locale-related environment variables
    AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
    AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
    AcceptEnv XMODIFIERS

    # override default of no subsystems
    Subsystem	sftp	/usr/libexec/openssh/sftp-server

    # Example of overriding settings on a per-user basis
    #Match User anoncvs
    #	X11Forwarding no
    #	AllowTcpForwarding no
    #	PermitTTY no
    #	ForceCommand cvs server
    # AllowUsers root@192.168.1.1 test            # 设置允许登录的用户 这里设置只允许test 和 root登录 而且root只允许在192.168.1.1访问
    # DenyUsers test2                             # 禁止test2用户登录

  • /etc/ssh/ssh_config 针对客户端的配置文件

    1
    vi /etc/ssh/ssh_config
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    #	$OpenBSD: ssh_config,v 1.30 2016/02/20 23:06:23 sobrado Exp $

    # This is the ssh client system-wide configuration file.  See
    # ssh_config(5) for more information.  This file provides defaults for
    # users, and the values can be changed in per-user configuration files
    # or on the command line.

    # Configuration data is parsed as follows:
    #  1. command line options
    #  2. user-specific file
    #  3. system-wide file
    # Any configuration value is only changed the first time it is set.
    # Thus, host-specific definitions should be at the beginning of the
    # configuration file, and defaults at the end.

    # Site-wide defaults for some commonly used options.  For a comprehensive
    # list of available options, their meanings and defaults, please see the
    # ssh_config(5) man page.

    # Host *
    #   ForwardAgent no
    #   ForwardX11 no
    #   RhostsRSAAuthentication no
    #   RSAAuthentication yes
    #   PasswordAuthentication yes
    #   HostbasedAuthentication no
    #   GSSAPIAuthentication no
    #   GSSAPIDelegateCredentials no
    #   GSSAPIKeyExchange no
    #   GSSAPITrustDNS no
    #   BatchMode no
    #   CheckHostIP yes
    #   AddressFamily any
    #   ConnectTimeout 0
    #   StrictHostKeyChecking ask
    #   IdentityFile ~/.ssh/identity
    #   IdentityFile ~/.ssh/id_rsa
    #   IdentityFile ~/.ssh/id_dsa
    #   IdentityFile ~/.ssh/id_ecdsa
    #   IdentityFile ~/.ssh/id_ed25519
    #   Port 22
    #   Protocol 2
    #   Cipher 3des
    #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
    #   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
    #   EscapeChar ~
    #   Tunnel no
    #   TunnelDevice any:any
    #   PermitLocalCommand no
    #   VisualHostKey no
    #   ProxyCommand ssh -q -W %h:%p gateway.example.com
    #   RekeyLimit 1G 1h
    #
    # Uncomment this if you want to use .local domain
    # Host *.local
    #   CheckHostIP no

    Host *
        GSSAPIAuthentication yes
    # If this option is set to yes then remote X11 clients will have full access
    # to the original X11 display. As virtually no X11 client supports the untrusted
    # mode correctly we set this to yes.
        ForwardX11Trusted yes
    # Send locale-related environment variables
        SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
        SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
        SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
        SendEnv XMODIFIERS

sshd支持两种连接方式

  • 密码连接
    对服务器中本地系统用户的登录名称、密码进行验证。简便，但可能会被暴力破解

  • 密钥对连接
    要求提供相匹配的密钥信息才能通过验证。通常先在客户端中创建一对密钥文件（公钥、私钥），然后将公钥文件放到服务器中的指定位置。远程登录时，系统将使用公钥、私钥进行加密/解密关联验证。能增强安全性，且可以免交互登录。

密钥

生成密钥对

  • 在客户端使用ssh-keygen命令 生成密钥对 默认存放在~/.ssh/中 { ~ 指的是系统用户目录}

  • 命令选项

    • -b：指定密钥长度；
    • -e：读取openssh的私钥或者公钥文件；
    • -C：添加注释；
    • -f：指定用来保存密钥的文件名；
    • -i：读取未加密的ssh-v2兼容的私钥/公钥文件，然后在标准输出设备上显示openssh兼容的私钥/公钥；
    • -l：显示公钥文件的指纹数据；
    • -N：提供一个新密语；
    • -P：提供（旧）密语；
    • -q：静默模式；
    • -t：指定要创建的密钥类型。

  • 生成密钥对命令 执行命令后会提示输入密码之类的信息 一路回车即可

      //会在 ~/.ssh/ 中生成名为 id_rsa 的4096位密钥对
  $ ssh-keygen -t rsa -b 4096 -C "your@email.com"

  //-f 自定义密钥名
  $ ssh-keygen -t rsa -C "your@email.com" -f ~/.ssh/filename

  • 生成好后会有2个文件

    • id_rsa 私钥
    • id_rsa.pub 公钥

配置服务器密钥

  • 将生成的公钥 拷贝到远程主机的 ~/.ssh/ 目录, 命名为 authorized_keys

  • 配置/etc/ssh/sshd_config

      //RSA认证 非必须 不存在不添加此项
  RSAAuthentication yes

  //公钥认证
  PubkeyAuthentication yes

  //禁止root登录
  PermitRootLogin yes

  //是否密码认证
  PasswordAuthentication no
  ChallengeResponseAuthentication no

  //指定密钥文件
  AuthorizedKeysFile  .ssh/authorized_keys

  • 修改后重启服务

      $ /bin/systemctl restart sshd.service

  • 文件权限

    • 1 .ssh目录的权限必须是700

        chmod 700 ~/.ssh

    • 2 .ssh/authorized_keys文件权限必须是600

        chmod 600 ~/.ssh/authorized_keys

Client SSH配置

客户端使用的程序

  • 客户端：Putty、Xshell、Xftp、CRT、Git、ssh

客户端远程登录命令

1
ssh [选项] root@192.168.1.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
选项 说明
-1 强制使用ssh协议版本1
-2 强制使用ssh协议版本2
-4 强制使用IPv4地址
-6 强制使用IPv6地址
-A 开启认证代理连接转发功能
-a 关闭认证代理连接转发功能
-b 使用本机指定的地址作为对位连接的源IP地址
-C 请求压缩所有数据
-F 指定ssh指令的配置文件，默认的配置文件为“/etc/ssh/ssh_config”
-f 后台执行ssh指令
-g 允许远程主机连接本机的转发端口
-i 指定身份文件（即私钥文件）
-l 指定连接远程服务器的登录用户名
-N 不执行远程指令
-o 指定配置选项
-p 指定远程服务器上的端口
-q 静默模式，所有的警告和诊断信息被禁止输出
-X 开启X11转发功能
-x 关闭X11转发功能
-y 开启信任X11转发功能

ssh登录服务器

  • 连接服务器

      $ ssh username@hostip

  • 自定义端口

      $ ssh -p 6666 username@hostip

  • 自定义密钥 ~/.ssh/key 自定义密钥名

      $ ssh -i ~/.ssh/key username@hostip

  • 客户端执行调试 会显示一些登录信息

      $ ssh -v user@host

scp拷贝文件到服务器

  • 使用scp命令

      scp -r ./down root@192.168.31.1:/tmp/

sftp

  • 由于使用了加密/解密技术，所以传输效率比普通的FTP要低，但安全性更高。
    1
    2
    3
    4
    5
    6
    7
    sftp root@192.168.1.1
    root@192.168.1.1's password:
    Connected to 192.168.1.1.
    sftp> ls
    sftp> get 文件名 #下载文件
    sftp> put 文件名 #上传文件
    sftp> exit #退出

问题错误

连接服务器时的错误信息 1

  • no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

  1. 方法1

    • 打开~/.ssh/config文件

    • 填入下面的内容

        Host *
  KexAlgorithms +diffie-hellman-group1-sha1

  2. 方法2

    • 打开/etc/ssh/ssh_config文件

    • 在尾部加入

         KexAlgorithms +diffie-hellman-group1-sha1

连接服务器时的错误信息 2

  • no matching host key type found. Their offer: ssh-rsa,ssh-dss

  • Git安装目录 打开/etc/ssh/ssh_config

  • 追加下面的内容

      //修改主机名为你的
  Host 123.123.123.123
  HostkeyAlgorithms +ssh-rsa
  PubkeyAcceptedAlgorithms +ssh-rsa

连接服务器时的错误信息 3

  • WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

  • 出现以下错误

      @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
  Someone could be eavesdropping on you right now (man-in-the-middle attack)!
  It is also possible that a host key has just been changed.
  The fingerprint for the RSA key sent by the remote host is
  SHA256:yC12kr+kWYA5g/g2Pfz37mEJ9Rg0GmqMSZd12FJYd5Q.
  Please contact your system administrator.
  Add correct host key in /c/Users/S/.ssh/known_hosts to get rid of this message.
  Offending RSA key in /c/Users/S/.ssh/known_hosts:12
  Host key for 192.168.8.8 has changed and you have requested strict checking.
  Host key verification failed.

  • 解决方法

  • 打开~/.ssh/known_hosts文件 删除你要连接的主机信息 如192.168.0.1,github.com

SSH

http://blog.pp6f.com/2022/03/03/Tools/ssh/

发布于

2022-03-03

更新于

2023-03-10

许可协议

#

喜欢这篇文章？打赏一下作者吧

评论

关注我

分类

最新文章

归档

标签

Article1
C#1
Dev1
Encrypt2
Github3
Github Actions2
Github Desktop1
Hexo4
Hexo Theme2
Icarus2
Linux1
MySql1
Net Core1
Nginx3
Node.js1
Openwrt1
Python1
SSH1
System3
Tools1
Ubuntu1
Windows1
git1
使用Acme申请SSL证书1

链接

×