• 技术文章 >数据库 >mysql教程

    限制用户通过ssh密钥进行认证登陆

    2016-06-07 15:06:04原创966

    为了服务器和 用户 的安全，禁止 用户 密码的 认证 方式，而基于钥匙的方式。 Lastlogin:FriOct1214:14:012012from192.168.7.251 root@Cacti.Nagios:[/root] vi/etc/ssh/sshd_config #$OpenBSD:sshd_config,v1.802008/07/0202:24:18djmExp$ #Thisisthesshdse

    为了服务器和用户的安全，禁止用户密码的认证方式，而基于“钥匙”的方式。

    1. Last login: Fri Oct 12 14:14:01 2012 from 192.168.7.251 
    2. root@Cacti.Nagios:[/root]vi /etc/ssh/sshd_config  
    3. #       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ 
    4.  
    5. # This is the sshd server system-wide configuration file.  See 
    6. # sshd_config(5) for more information. 
    7.  
    8. # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin 
    9.  
    10. # The strategy used for options in the default sshd_config shipped with 
    11. # OpenSSH is to specify options with their default value where 
    12. # possible, but leave them commented.  Uncommented options change a 
    13. # default value. 
    14.  
    15. #Port 22 
    16. #AddressFamily any 
    17. #ListenAddress 0.0.0.0 
    18. #ListenAddress :: 
    19.  
    20. # Disable legacy (protocol version 1) support in the server for new 
    21. # installations. In future the default will change to require explicit 
    22. # activation of protocol 1 
    23. Protocol 2 ← 修改后变为此状态，仅使用SSH2
    24.  
    25. # HostKey for protocol version 1 
    26. #HostKey /etc/ssh/ssh_host_key 
    27. # HostKeys for protocol version 2 
    28. #HostKey /etc/ssh/ssh_host_rsa_key 
    29. #HostKey /etc/ssh/ssh_host_dsa_key 
    30.  
    31. # Lifetime and size of ephemeral version 1 server key 
    32. #KeyRegenerationInterval 1h 
    33. #ServerKeyBits 1024 
    34.  
    35. # Logging 
    36. # obsoletes QuietMode and FascistLogging 
    37. #SyslogFacility AUTH 
    38. SyslogFacility AUTHPRIV 
    39. #LogLevel INFO 
    40.  
    41. # Authentication: 
    42.  
    43. #LoginGraceTime 2m 
    44. #PermitRootLogin yes 
    45. PermitRootLogin no ← 修改后变为此状态，不允许用root进行登录
    46. #StrictModes yes 
    47. #MaxAuthTries 6 
    48. #MaxSessions 10 
    49.  
    50. #RSAAuthentication yes 
    51. #PubkeyAuthentication yes 
    52. #AuthorizedKeysFile     .ssh/authorized_keys 
    53. #AuthorizedKeysCommand none 
    54. #AuthorizedKeysCommandRunAs nobody 
    55.  
    56. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts 
    57. #RhostsRSAAuthentication no 
    58. # similar for protocol version 2 
    59. #HostbasedAuthentication no 
    60. # Change to yes if you don't trust ~/.ssh/known_hosts for 
    61. # RhostsRSAAuthentication and HostbasedAuthentication 
    62. #IgnoreUserKnownHosts no 
    63. # Don't read the user's ~/.rhosts and ~/.shosts files 
    64. #IgnoreRhosts yes 
    65.  
    66. # To disable tunneled clear text passwords, change to no here! 
    67. #PasswordAuthentication yes 
    68. PasswordAuthentication no ← 修改后变为此状态，不允许密码方式的登录
    69. #PermitEmptyPasswords no 
    70. PermitEmptyPasswords no ← 修改后变为此状态，禁止空密码进行登录
    71. "/etc/ssh/sshd_config" 141L, 3941C written                             
    72. root@Cacti.Nagios:[/root]vi /etc/hosts.deny    ← 修改屏蔽规则，在文尾添加相应行
    73. # 
    74. # hosts.deny    This file contains access rules which are used to 
    75. #               deny connections to network services that either use 
    76. #               the tcp_wrappers library or that have been 
    77. #               started through a tcp_wrappers-enabled xinetd. 
    78. # 
    79. #               The rules in this file can also be set up in 
    80. #               /etc/hosts.allow with a 'deny' option instead. 
    81. # 
    82. #               See 'man 5 hosts_options' and 'man 5 hosts_access' 
    83. #               for information on rule syntax. 
    84. #               See 'man tcpd' for information on tcp_wrappers 
    85. # 
    86. sshd:ALL   ← 添加这一行，屏蔽来自所有的SSH连接请求
    87. "/etc/hosts.deny" 14L, 469C written 
    88. You have new mail in /var/spool/mail/root 
    89. root@Cacti.Nagios:[/root]vi /etc/hosts.allow   ← 修改允许规则，在文尾添加相应行
    90. # 
    91. # hosts.allow   This file contains access rules which are used to 
    92. #               allow or deny connections to network services that 
    93. #               either use the tcp_wrappers library or that have been 
    94. #               started through a tcp_wrappers-enabled xinetd. 
    95. # 
    96. #               See 'man 5 hosts_options' and 'man 5 hosts_access' 
    97. #               for information on rule syntax. 
    98. #               See 'man tcpd' for information on tcp_wrappers 
    99. # 
    100. sshd:192.168.7. 只允许192.168.7。网段的机器ssh登陆
    101. ~                                                                                        
    102. ~                                                                                        
    103. ~                                                                                        
    104. "/etc/hosts.allow" 11L, 386C written                                   
    105.  
    106. root@Cacti.Nagios:[/root]su - admin 
    107. admin@Cacti.Nagios:[/data]ssh-keygen -t rsa 
    108. Generating public/private rsa key pair. 
    109. Enter file in which to save the key (/data/.ssh/id_rsa):  
    110. Created directory '/data/.ssh'. 
    111. Enter passphrase (empty for no passphrase):  
    112. Enter same passphrase again:  
    113. Your identification has been saved in /data/.ssh/id_rsa. 
    114. Your public key has been saved in /data/.ssh/id_rsa.pub. 
    115. The key fingerprint is: 
    116. e5:15:ba:be:59:ef:2e:74:df:b6:ee:e1:6a:24:be:da admin@Cacti.Nagios 
    117. The key's randomart image is: 
    118. +--[ RSA 2048]----+ 
    119. |            .    | 
    120. |           . .   | 
    121. |          o .    | 
    122. |         o o     | 
    123. |        S o      | 
    124. |         . ....  | 
    125. |          o.+. o.| 
    126. |          .=.o. =| 
    127. |         .+Eo=B*.| 
    128. +-----------------+ 
    129. admin@Cacti.Nagios:[/data]ls -a 
    130. .  ..  .bash_history  .bash_logout  .bash_profile  .bashrc  lost+found  .ssh  .viminfo 
    131. admin@Cacti.Nagios:[/data]cd .ssh/ 
    132. admin@Cacti.Nagios:[/data/.ssh]ll 
    133. total 8 
    134. -rw------- 1 admin admin 1751 Oct 12 17:19 id_rsa 
    135. -rw-r--r-- 1 admin admin  401 Oct 12 17:19 id_rsa.pub 
    136. admin@Cacti.Nagios:[/data/.ssh]cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys 
    137. admin@Cacti.Nagios:[/data/.ssh]ls -a 
    138. .  ..  authorized_keys  id_rsa  id_rsa.pub 
    139. admin@Cacti.Nagios:[/data/.ssh]chmod 400 authorized_keys  
    140. admin@Cacti.Nagios:[/data/.ssh]ll -a 
    141. total 20 
    142. drwx------ 2 admin admin 4096 Oct 12 17:20 . 
    143. drwxr-xr-x 4 admin admin 4096 Oct 12 17:19 .. 
    144. -r-------- 1 admin admin  401 Oct 12 17:20 authorized_keys 
    145. -rw------- 1 admin admin 1751 Oct 12 17:19 id_rsa 
    146. -rw-r--r-- 1 admin admin  401 Oct 12 17:19 id_rsa.pub 
    147.  
    148. 至此，将私钥id_rsa导出到windows客户端上。然后删除生成的公钥id_rsa.pub。
    149. 重启sshd服务，使得刚才所做的配置修改生效。
    150. root@Cacti.Nagios:[/root]/etc/rc.d/init.d/sshd restart  Stopping sshd:                                             [  OK  ]  Starting sshd:                                             [  OK  ]

    虫子的博客

    声明：本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系admin@php.cn核实处理。
    专题推荐：限制 用户 通过 ssh 密钥 进行 认证 登陆 为了 服务
    上一篇：CISCO路由器连接ADSL之PPPoE配置 下一篇：用ROUTER做DHCP服务器
    VIP课程（WEB全栈开发）

    相关文章推荐

    • 【腾讯云】年中优惠,「专享618元」优惠券！• 怎么解决启动mysql的1069错误• 怎么修改mysql服务路径• oracle怎么转移表的表空间• 怎么判断mysql数据库是否存在• mysql中有嵌套查询语句吗
    1/1

    PHP中文网

    首页 首页课程 课程文章文章问答 问答博客博客词典 词典手册 手册资源 资源搜索 搜索APP下载 APP下载