一.sshd简介

ssh [email protected] 远程登陆虚拟机
server +200 desktop+100
ssh后跟的用户就是登陆的用户

sshd= secure shell
可以通过网络在主机中开机shell的服务

客户端软件
        sshd
连接方式：
       ssh [email protected] ##文本模式的链接
       ssh [email protected] -X ##可以在连接成功后开启图形
      注意：
          第一次链接陌生主机是要建立认证文件
      所以加会询问是否建立，需要输入yes
      再次链接此台主机时，因为已经生成～/.ssh/know_hosts 文件所以不需要再次输入yes

Linux sshd服务

从主机连入虚拟机客户端

Linux sshd服务

从主机连入虚拟机服务端

远程复制：(不用登陆上去)
scp file [email protected]:dir（绝对路径） ##上传 ip为要上传的ip
scp [email protected]:file(要下载的文件的绝对路径) dir(要拷贝的地方） ##下载

Linux sshd服务

从client上传文件test到server

Linux sshd服务

从server下载文件到client

二.sshd的key认证

1.生成认证key ssh-**** ##生成的命令

[[email protected] Desktop]# ssh-******
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): ##指定保存加密字符的文件(使用默认）
Enter passphrase (empty for no passphrase):               ##设定密码（使用空密码）
Enter same passphrase again:                              ##确认密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
73:b8:c8:a6:fa:ee:47:55:b4:33:97:ac:d7:99:65:f2 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
|         ..      |
|          .o .   |
|         .+ + . o|
|        .. = . B |
|       .S o . + E|
|     ... + .     |
|     .+ .        |
|     o.          |
| .==.           |
+-----------------+

Linux sshd服务

生成钥匙

2.加密服务

[[email protected] ~]# cd /root/.ssh/
[[email protected] .ssh]# ls
id_rsa id_rsa.pub
[[email protected] .ssh]# ssh-copy-id -i id_rsa.pub [email protected]
The authenticity of host '172.25.254.224 (172.25.254.224)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

[[email protected] .ssh]# ls
authorized_keys id_rsa id_rsa.pub known_hosts
^z这个代表成功

Linux sshd服务

加密服务

3.分发钥匙

[[email protected] .ssh]# scp /root/.ssh/id_rsa [email protected]:/root/.ssh/##分发钥匙命令

The authenticity of host '172.25.254.124 (172.25.254.124)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.124' (ECDSA) to the list of known hosts.
[email protected]'s password:
id_rsa 100% 1679 1.6KB/s

Linux sshd服务

给client分发钥匙

4.测试

在客户主机中(172.25.254.124)
ssh [email protected] ##连接时发现直接登陆不需要root登陆系统的密码认证

Linux sshd服务

不需要密码就可以登陆

三.sshd的安全设定

78 PasswordAuthentication yes/no ##是否允许用户通过登录系统的密码作sshd的认证(不用输密码)
48 PermitRootLogin yes|no ##是否允许root用户通过sshd服务的认证
Allowusers student westos ##设定用户白名单，白名单出现默认不再名单中的用户不能使用sshd
Denyusers westos ##设定用户黑名单，黑名单出现默认不再名单中的用户可以使用sshd

Linux sshd服务