telnet:远程登录协议，23端口，tcp协议，C/S模式（C：telnet客户端；S:telnet服务器）
ssh:Secure SHell,应用层协议，22端口，tcp协议，通信过程及认证过程是加密，主机认证
Linux: openSSH
C/S模式：
服务器端：sshd,配置文件/etc/ssh/sshd_config
客户端：ssh,配置文件/etc/ssh/ssh_config
工具：ssh-keygen(密钥生成器)，ssh-copy-id(将公钥传输至远程服务器)，scp（跨主机安全复制工具）
ssh:
客户端用法：
ssh HOST #默认以root身份远程登录#
例：[root@localhost ~]# ssh 192.168.101.125
root@192.168.101.125's password:
ssh USERNAME@HOST
例：[root@localhost ~]# ssh hadoop@192.168.101.125
hadoop@192.168.101.125's password:
ssh -l USERNAME HOST
例：[root@localhost ~]# ssh -l hadoop 192.168.101.125
hadoop@192.168.101.125's password:
ssh USERNAME@HOST 'COMMAND'
例：[root@localhost ~]# ssh hadoop@192.168.101.125 'ls -a'
hadoop@192.168.101.125's password:
.
..
.bash_logout
.bash_profile
.bashrc
.kde
.mozilla
scp:
scp SRC DEST
-r：递归复制
-a:
scp USERNAME@HOST:/path/to/somefile /path/to/somefile
例：[root@localhost ~]# scp hadoop@192.168.101.125:/etc/fstab ./
hadoop@192.168.101.125's password:
fstab 100% 532 0.5KB/s 00:00
[root@localhost ~]# ls
fstab
scp /path/to/somefile USERNAME@HOST:/path/to/somefile
例：[root@localhost ~]# scp linux-2.6.28.9.tar.bz2 hadoop@192.168.101.125:~ #~表示hadoop家目录#
hadoop@192.168.101.125's password:
linux-2.6.28.9.tar.bz2 100% 50MB 3.9MB/s 00:13
[root@localhost ~]#
ssh-keygen:基于密钥的认证，远程登录主机不需登录密码
-t rsa #使用rsa加密#
~/.ssh/id_rsa :私钥存放在当前家目录下/.ssh/id_rsa中
~/.ssh/id_rsa.pub :公钥存放在当前家目录下/.ssh/id_rsa.pub中，公钥生成后需要追加保存到远程主机访问的用户的家目录
家目录下的.ssh/authorized_keys文件下或.ssh/authorized_keys2文件中
-f /path/to/KEY_FILE ：指定密钥文件
-P '':指定加密私钥的密码，''代表空密码。
例：[root@localhost ~]# ssh-keygen -t rsa -f .ssh/id_rsa -P ''
例：[root@localhost ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
9b:69:c2:84:5a:87:19:93:cb:8a:a8:bd:df:d0:93:33 root@localhost.localdomain
[root@localhost ~]# ls .ssh
id_rsa id_rsa.pub known_hosts
[root@localhost ~]# scp .ssh/id_rsa.pub root@192.168.101.125:/root
root@192.168.101.125's password:
Permission denied, please try again.
root@192.168.101.125's password:
id_rsa.pub 100% 408 0.4KB/s 00:00
[root@localhost ~]# ssh root@192.168.101.125
root@192.168.101.125's password:
Last login: Wed Jan 3 22:51:56 2018 from 192.168.101.122
#
#若远程主机家目录下没有.ssh目录，需要新建.ssh目录且权限为700#
[root@www ~]# mkdir .ssh
[root@www ~]# chmod 700 .ssh
#
[root@www ~]# cat id_rsa.pub >> .ssh/authorized_keys
[root@www ~]# cat .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0VkP2Ypebxr4Hqfprr+tVWyHK0l0PDDLwNLIBblU+YICMs3DfxoRLYteZ1qcffqhJoXSC6OeWEHRq69/j2stmfhJ/BrOhiFxPO61ijq+QymGhXigE2w5kLDCX/YnJqSKH4sBdFPzcMWGmWtwjMnlpd7LYsgA2OIN0sGTZyFEESy3IKnHS5iyFnWh5ycJG+ppq3phwfzPO8vhKcEPN6IwPboBmLLD1lfxBcbHENNDY7aw7cIpCUu6cGHbbqY99jZ4nKxAK1x6hJvVj+DuKeiNXacNeNhi3SJyQpRWOMfNwxCqUtz1De+w6ifa6ytlHmOo7HFZ57PeBkKaC333cnYDew== root@localhost.localdomain
[root@localhost ~]# ssh root@192.168.101.125
Last login: Thu Jan 4 11:37:36 2018 from 192.168.101.122
[root@www ~]#
ssh-copy-id:将公钥传输至远程服务器
-i ~/.ssh/id_rsa.pub
ssh-copy-id -i ~/.ssh/id_rsa.pub USERNAME@HOST
例：[root@localhost ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
9b:69:c2:84:5a:87:19:93:cb:8a:a8:bd:df:d0:93:33 root@localhost.localdomain
[root@localhost ~]# ls .ssh
id_rsa id_rsa.pub known_hosts
[root@localhost ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.101.125 #自动创建.ssh/authorized_keys #
15
root@192.168.101.125's password:
Now try logging into the machine, with "ssh 'root@192.168.101.125'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
[root@localhost ~]# ssh root@192.168.101.125
Last login: Thu Jan 4 13:34:15 2018 from 192.168.101.122
[root@www ~]#
[root@www ~]# ls .ssh/
authorized_keys known_hosts
例：[root@localhost ~]# ssh-keygen -t rsa -f .ssh/id_rsa -P '' ##
[root@www ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.101.122
21
root@192.168.101.122's password:
Now try logging into the machine, with "ssh 'root@192.168.101.122'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
#在busybox小系统上实现SSH功能#
dropbear:嵌入式系统专用的ssh服务器端和客户端工具
服务器端：dropbear
dropbearkey:生成主机密钥
客户端：dbclient
dropbear默认使用nsswitch实现名称解析，配置文件：/etc/nsswitch.conf, /lib/libnss_files*, /usr/lib/libnss3.so, /usr/lib/libnss_files*
例；[root@localhost ~]# tar xf dropbear-2017.75.tar.bz2
[root@localhost ~]# cd dropbear-2017.75
[root@localhost dropbear-2017.75]# ./configure #编译#
[root@localhost dropbear-2017.75]# make
[root@localhost dropbear-2017.75]# make install
[root@localhost ~]# ./bincopy.sh
Your command: dropbear
/usr/local/sbin/dropbear
copy lib /lib/libutil.so.1 finished.
copy lib /lib/libz.so.1 finished.
copy lib /lib/libcrypt.so.1 finished.
copy /usr/local/sbin/dropbear finished.
Continue: dropbearkey
/usr/local/bin/dropbearkey
copy /usr/local/bin/dropbearkey finished.
Continue: dbclient
/usr/local/bin/dbclient
copy /usr/local/bin/dbclient finished.
Continue: q
[root@localhost ~]# sync
[root@localhost ~]# cd /mnt/sysroot/
[root@localhost sysroot]# vim etc/shells #创建shell文件#
/bin/sh
/bin/bash
/bin/ash
/bin/hush
[root@localhost sysroot]# vim etc/fstab #创建伪文件系统#
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
devpts /dev/pts devpts mode=620 0 0 #添加devpts文件系统#
/dev/hda1 /boot ext3 defaults 0 0
/dev/hda2 / ext3 defaults 1 1
[root@localhost sysroot]# mkdir dev/pts #创建pts目录#
#主机密钥默认位置#：
/etc/dropbear/
密钥格式：
RSA:文件名：dropbear_rsa_host_key
长度可变，只要是8的整数倍，默认1024
DSS:文件名：dropbear_dss_host_key
长度固定，默认为1024
dropbearkey:
-t rsa|dss
-f /path/to/KEY_FILE
-s SIZE #指定密钥长度#
[root@localhost sysroot]# mkdir etc/dropbear
[root@localhost sysroot]# dropbearkey -t rsa -f /mnt/sysroot/etc/dropbear/dropbear_rsa_host_key -s 2048
[root@localhost sysroot]# dropbearkey -t dss -f /mnt/sysroot/etc/dropbear/dropbear_dss_host_key
[root@localhost sysroot]# ls etc/dropbear/
dropbear_dss_host_key dropbear_rsa_host_key
[root@localhost sysroot]# ls usr/
bin local sbin
[root@localhost sysroot]# mkdir usr/lib
[root@localhost sysroot]# cd
[root@localhost ~]# cp -d /lib/libnss_files* /mnt/sysroot/lib/
[root@localhost ~]# cp -d /usr/lib/libnss3.so /usr/lib/libnss_files.so /mnt/sysroot/usr/lib/
[root@localhost ~]# cp /etc/nsswitch.conf /mnt/sysroot/etc/
[root@localhost ~]# vim /mnt/sysroot/etc/nsswitch.conf #修改nsswitch.conf文件，删除不需要的内容#
passwd: files
shadow: files
group: files
hosts: files dns
[root@localhost ~]# sync
[root@localhost ~]# sync
#进入小系统#
#为小系统配置IP地址#
#为小系统添加/usr/local/bin 和/usr/local/sbin# 或使用绝对路径启动dropbear
-bash-3.2#/usr/local/sbin/dropbear -E -F
-bash-3.2#export PATH=$PATH:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin #添加默认环境变量#
阅读(1548) | 评论(0) | 转发(0) |
