一、免密码登录可以避免中间有人冒充服务器，比手动输入密码更安全。
二、环境
客户机：
ip：10.14.2.60
用户:yorks
ssh服务器：
ip:10.14.2.37
用户:york
三、开始工作
3.1 创建rsa的密匙和公匙
[yorks@localhost ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/yorks/.ssh/id_rsa):
Created directory '/home/yorks/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/yorks/.ssh/id_rsa.
Your public key has been saved in /home/yorks/.ssh/id_rsa.pub.
The key fingerprint is:
4c:57:e2:b3:eb:8f:e3:0f:a7:9a:05:2f:69:7b:5b:93 yorks@localhost.localdomain
|
产生两个文件：
~/.ssh/id_rsa(ssh2 的rsa加密后的密匙)
~/.ssh/id_rsa.pub(ssh2 公匙)
3.2 修改id_rsa的权限为600(为了安全至少为600)
[yorks@localhost .ssh]$ chmod 600 id_rsa
[yorks@localhost .ssh]$ ls -l
总计 3
-rw------- 1 yorks yorks 1675 03-26 14:00 id_rsa
-rw-r--r-- 1 yorks yorks 409 03-26 14:00 id_rsa.pub
|
3.3 传公匙给ssh服务器
[yorks@localhost .ssh]$ scp id_rsa.pub york@10.14.2.37:~
The authenticity of host '10.14.2.37 (10.14.2.37)' can't be established.
RSA key fingerprint is a5:8a:2a:39:e2:7d:55:32:79:52:0e:5f:e9:37:93:41.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.14.2.37' (RSA) to the list of known hosts.
york@10.14.2.37's password:
id_rsa.pub 100% 409 0.4KB/s 00:00
|
3.4 先用手动输入密码登录服务器去配置一下。
[yorks@localhost .ssh]$ ssh york@10.14.2.37
york@10.14.2.37 password：
Last login: Fri Mar 26 22:04:13 2010 from 10.14.2.60
|
3.5 将公匙追加到~/.ssh/authorized_keys
[york@localhost ~]$ cat .ssh/id_rsa.pub >> .ssh/authorized_keys
|
3.6 改变~/.ssh/authorized_keys的权限(至少为600)
[york@localhost ~]$ chmod 600 .ssh/authorized_keys
[york@localhost ~]$ ls -l .ssh/authorized_keys
-rw------- 1 york york 409 03-26 14:23 .ssh/authorized_keys
|
3.7 修改服务器的ssh配置
[york@localhost ~]$ vi /etc/ssh/sshd_config
[york@localhost ~]$ su
密码：
[root@localhost york]# vi /etc/ssh/sshd_config
将以下字段去掉解析
....
RSAAuthentication yes
#PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
...
|
3.8 重启服务ssh
[root@localhost york]# /etc/init.d/sshd restart
|
3.9 测试
[yorks@localhost ~]$ ssh york@10.14.2.37
Last login: Fri Mar 26 22:17:59 2010 from 10.14.2.60
[york@localhost ~]$
|
阅读(1584) | 评论(0) | 转发(0) |
