SSH免密码登录

Step 1: 在本地机器上使用ssh-keygen产生公钥私钥对

[root@hk1601 ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
c9:81:9f:3b:3c:f2:dd:f6:c9:c4:10:32:9e:32:24:d1 root@hk1601
The key's randomart image is:
+--[ RSA 2048]----+
|      ..         |
|       oE        |
|      o o o .    |
|       = = + .   |
|        S o .    |
|       . +   o   |
|      . =     o  |
|       o + ..o . |
|        . ....+  |
+-----------------+

Step 2: 将公钥复制到远程机器

[root@hk1601 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p 10022 jilili@125.76.225.126
The authenticity of host '[125.76.225.126]:10022 ([125.76.225.126]:10022)' can't be established.
ECDSA key fingerprint is cb:91:c5:2a:f1:fd:aa:7e:34:9c:d6:8c:e0:30:5f:e1.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
jilili@125.76.225.126's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '10022' 'jilili@125.76.225.126'"
and check to make sure that only the key(s) you wanted were added.

如果没有ssh-copy-id命令可以使用cat，如下：

cat ~/.ssh/id_rsa.pub | ssh root@hk1.ideais.net "cat - >> ~/.ssh/authorized_keys"

Step 3: 登录不要密码了

[root@hk1601 ~]# ssh -p '10022' 'jilili@125.76.225.126'
Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.13.0-63-generic x86_64)

 * Documentation:  https://help.ubuntu.com/

  System information as of Mon Jun 20 14:55:44 CST 2016

  System load:  0.0                Processes:              165
  Usage of /:   26.5% of 28.18GB   Users logged in:        1
  Memory usage: 54%                IP address for eth0:    192.168.106.60
  Swap usage:   55%                IP address for docker0: 172.17.42.1

  Graph this data and manage this system at:
    https://landscape.canonical.com/

169 packages can be updated.
99 updates are security updates.

Last login: Mon Jun 20 14:55:45 2016 from 118.193.151.205
jilili@web:~$

限制root仅使用公钥登录

如果想让root用户使用公钥登录，而不能使用密码登录，可以使用以下步骤：

先允许root登录，通过修改sshd_config文件

# vi /etc/ssh/sshd_config
...
PermitRootLogin yes
...

将公钥发送到服务器端

cat ~/.ssh/id_rsa.pub | ssh root@hk1.ideais.net "cat - >> ~/.ssh/authorized_keys"

关闭root密码登录，后面将只能使用公钥登录

# vi /etc/ssh/sshd_config
...
PermitRootLogin without-password
...

首页 » SSH免密码登录

限制root仅使用公钥登录

相关内容