在日常使用中,除了密码登录更多的是使用密钥方式登录SSH。密钥对分成公钥和私钥,将公钥添加到需要登录的服务器用户的家目录下.ssh/authorized_keys文件中,在ssh登录时使用’-i’参数指定私钥 或 将私钥天骄到Xshell用户密钥中。
使用密钥登录通常需要经过以下步骤:
生成登录密钥对
- 方法一:使用ssh-keygen命令生成密钥对
ssh-keygen -t 加密方式 -C 备注
mars@company:~$ ssh-keygen -t rsa #加密方式为rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mars/.ssh/id_rsa): /home/mars/.ssh/id_rsa_mars #置空使用默认路径和命名
Enter passphrase (empty for no passphrase): #置空表示不为密钥设置密码
Enter same passphrase again:
Your identification has been saved in /home/mars/.ssh/id_rsa_mars
Your public key has been saved in /home/mars/.ssh/id_rsa_mars.pub
The key fingerprint is:
SHA256:Y11r6HcjCAK35/6N0ry1e7aEeQoIdhfws1F02YmpNl4 mars@company
The key's randomart image is:
+---[RSA 3072]----+
| . .o +o.|
| o . +...|
| . . = o |
| o . . @ E |
| = S B = |
| . B * + o |
| oo+ * = |
| .. o* Bo. |
| .o+.=+.. |
+----[SHA256]-----+
mars@company:~$ cd .ssh/ && ll
total 8.0K
-rw------- 1 mars mars 2.6K Oct 26 15:22 id_rsa_mars #私钥的权限必须为0600
-rw-r--r-- 1 mars mars 566 Oct 26 15:22 id_rsa_mars.pub
- 方法二:使用Xshell客户端生成密钥对
点击Xshell菜单栏上的"工具"->“新建用户密钥生成向导”,按下图操作生成和保存密钥对。
密钥类型默认RSA,长度2048位,名称随意,密码可选,最后把用户密钥也导出来(非必要步骤,保存以备复用)。
两种方法都可以显式地看到生成文件:
文件 | 作用 |
id_rsa_mars.pub | 公钥(主机密钥),保存到服务器上,来验证请求登录用户的私钥 |
id_rsa_mars | 私钥(用户密钥),SSH登录时指定,提供给服务器进行登录验证 |
服务器注册公钥
需要把公钥添加到要登录的用户家目录下的.ssh路径下的authorized_keys文件中,一个便捷的方式是使用 ssh-copy-id 命令上传公钥,这一步需要登录用户的密码。
ssh-copy-id -i 公钥路径 登录用户名@登录主机名或ip -p 端口
mars@company:~/.ssh$ ssh-copy-id -i id_rsa_mars.pub pi@192.168.0.125 -p 22
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa_mars.pub"
The authenticity of host '[192.168.0.125]:22 ([192.168.0.125]:22)' can't be established.
ECDSA key fingerprint is SHA256:YG43kzBF5jzsbL2yo9Uw/negmUvVMyiGACksK5/ppUc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
pi@192.168.0.125's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh -p '22' 'pi@192.168.0.125'"
and check to make sure that only the key(s) you wanted were added.
# 检查是否上传完成
pi@raspberrypi:~ $ cat .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1BzYNq7RB5/OCXVbPIs6EGj2OjS9ug0mHpdFgWngLFAaC3/msX9kvgLvM90mklExljtCXu3mNXiPDJpItWiQJcdKn90leciEtgJQiAa/hNbIeurGrN6D9+uCYbNFjzwezTTEghXzeHCC/aP+M3M+TbyLSTAdadcSSFQJ8jgYh/wYvgeR03tSZrfwoFvkKeiep0z4P1hKz7weMPGpr+GIW3egutx/8gXfJ80ZE8ErPUsdasmsyHSNO3SjkDpXXarMkeb8bc6LLrZaxtp4uPw9M7YLcyuiLvUjyHvqM7D4Kh4bDJTXOL5mpVdAXrB3C8a32hMzwzn6REW1o6Yqh8Tl6qw==
客户端登录时指定私钥
- 方法一:使用ssh命令指定私钥
ssh -i 私钥路径 登录用户名@登录主机名或ip -p 端口
mars@company:~/.ssh$ ssh -i id_rsa_mars pi@192.168.0.125 -p 21414
Linux raspberrypi 4.19.97-v7l+ #1294 SMP Thu Jan 30 13:21:14 GMT 2020 armv7l
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Oct 26 16:17:34 2020 from 192.168.137.1
pi@raspberrypi:~ $
- 方法二:使用Xshell指定用户密钥
可能出现的错误
1.权限问题,改为0600即可解决
mars@company:~/.ssh$ ssh -i id_rsa_mars -p 21414 'pi@103.46.128.21'
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for 'id_rsa_mars' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa_mars": bad permissions
pi@103.46.128.21's password:
mars@company:~/.ssh$ chmod 0600 id_rsa_mars #修改私钥权限为0600
2.ssh -i指定密钥登录仍需要输入密码,Xshell提示所选的用户密钥未在远程主机上注册
原因是公钥(主机密钥)没有添加成功,重新添加后即可解决
ssh命令备忘
- 从某主机的80端口开启到本地主机2001端口的隧道
ssh -N -L2001:localhost:80 somemachine
现在你可以直接在浏览器中输入http://localhost:2001访问这个网站。
- 直接连接到只能通过主机B连接的主机A
ssh -t hostA ssh hostB
当然,你要能访问主机A才行。