第12章：SSH遠端連線設定與原理介紹（二）

13th鐵人賽

peter279k

2021-10-01 21:08:01

2751 瀏覽

分享至

前言

本章節，延續上一章節有關於SSH連線的介紹，繼續介紹SSH之以金鑰為基礎的驗證與設定介紹。

產生SSH金鑰

可以使用ssh-keygen指令來完成產生金鑰，相關的執行指令方式與其結果如下：

[rockylinux@workstation ~]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/rockylinux/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/rockylinux/.ssh/id_rsa.
Your public key has been saved in /home/rockylinux/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:9BzR1YvPR5sGGLvOIf4bt9zHKYDdvxXgaC8ZtpELjr8 rockylinux@workstation
The key's randomart image is:
+---[RSA 3072]----+
|          .. ... |
|           o.   .|
|        . . +.. .|
|       . o ++o...|
|        S.=Bo.+oo|
|        oo+=B. *o|
|       ...+*ooo.+|
|        .. o=.oo+|
|         Eoo.o.oo|
+----[SHA256]-----+
[rockylinux@workstation ~]$

從上從上述的執行指令來看，ssh-keygen指令可以以互動模式來詢問，首先會先問私鑰鑰存放在哪，預設會存放到家目錄底下的.ssh底下，檔案名稱為：id_rsa，接著再問私鑰是否需要設定passphrase，當這個設定之後，每次做SSH遠端連線的時候，都需要輸入設定的密碼，通常來說，這邊都不會建議設定密碼，原因是因為這樣在SSH連線的時候都需要先輸入密碼，會顯得較麻煩，所設定passphrase這邊的步驟可以按下「enter」鍵跳過，接著再按一次之後，公私鑰就分別建立起來了。

若要使用金鑰交換之驗證方式連線的話，則可以先使用ssh-copy-id之指令將本地端的公鑰傳到遠端要進行SSH遠端連線的server，相關的指令執行的方式與其輸出如下：

[rockylinux@workstation ~]$ ssh-copy-id -i ~/.ssh/id_rsa.pub rockylinux@127.0.0.1
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/rockylinux/.ssh/id_rsa.pub"
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:jtNpnVUOQFBlVo5shPfHdnogsQq/LtxbFLmgaeJJDjI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
rockylinux@127.0.0.1's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'rockylinux@127.0.0.1'"
and check to make sure that only the key(s) you wanted were added.

[rockylinux@workstation ~]$

從上從上述的執行指令來看，若第一次連線，則會先詢問fingerprint之問題，接著再使用密碼驗證的方式確認對方SSH遠端連線的資訊是否正確，之後就會成功的將公鑰存放到遠端的server上了，之後再連線的時候，就會優先使用將鑰驗證而不用輸入密碼的方式來驗證了，相關的指令在匯入金鑰執行之輸出訊息如下：

[rockylinux@workstation ~]$ ssh rockylinux@127.0.0.1
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Sat Oct  2 22:42:11 2021 from 192.168.0.9

而公鑰則會存放在遠端連線的使用者家目錄之.ssh/authorized_keys中，可以使用cat指令將此輸出：

[rockylinux@workstation ~]$ cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDK97Z4zU65OF81G3ew5R72zKbBq7SpvY3GXaDy0anpATCZvyewugoSOeAQ4nNriJSCdV5eBZsWTSzFb56Gmcvo+jdV/nZ+N/JQJUfoecVMG/BUTTiVAbNDkGnC4zkzKLKK0Npvjj1hOzUngevq8n3QVRImmEBgGxmw66++CwELOQX/Q82Rc3yLjYEBFstBGmCohigFTd3rjY2m3KnNGvH4vfxIQ5vxTJisOLxa0D9arRtfe6pBor8IyZ065+ofBaWlmtL8/1SM/CbsHA0PhMvW8XEKY0dplQy/T+1WgTiXBOeSDiavXLCDHjt66N0IcFbFAi/GGSjKcH+jL9Ej5ZE7hacp1Szv16HnajQg0oKh0iTVu0o8htPTYXTh9AVyw+B9Szn1gv+IpxgT/DQQ2suQ30PUa5lWXU68DqfTztXSwXSDfWK3CSYO+w8QSFp8ckcImJoUOeJBvfYdjpSS/pG4UqF7zcPMy0+2mBQ4Kx5CTu8g9Q7OSMQiFfudX7kCU0c= rockylinux@workstation