ssh免密登录及踢除

主机A使用ssh登录到主机B

• 1、主机A操作如下

[[email protected] .ssh]# ssh-keygen  #生成秘钥
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):   #直接回车，默认存放路径
Enter passphrase (empty for no passphrase):   #设置秘钥密码，直接回车代表无
Enter same passphrase again:   #再次设置秘钥密码，直接回车代表无
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:l5zUtKOC1v7BAeG2O7m64ZVGBnye4gZTdVLzvovRpA8 [email protected]
The key's randomart image is:
+---[RSA ]----+
|        +.+ .    |
|     . o + = .   |
|      + = . =    |
|     . B * = .   |
|    o + S B o    |
|     = = B = .   |
|      + O E o    |
|     o + + * .   |
|      +o. o o    |
+----[SHA256]-----+
[[email protected] .ssh]# ssh-copy-id [email protected]  #将秘钥传输到主机B（root为主机B上的用户，192.168.10.158为主机B的地址）
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO:  key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 

Number of key(s) added: 

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

[[email protected] .ssh]# ssh [email protected]  #使用ssh进行登录主机B
Enter passphrase for key '/root/.ssh/id_rsa':   #因为我设置了秘钥密码，所以此处需要输入秘钥密码，否则会直接进入系统
Last login: Sun Sep   ::  from 
[[email protected] ~]# 
           

• 2、主机B上进行查看（/root/.ssh目录下的authorized_keys文件）

[[email protected] ~]# cd /root/
[[email protected] ~]# ll -a
总用量 40
dr-xr-x---.  6 root root  253 9月   1 19:29 .
dr-xr-xr-x. 17 root root  224 5月  14 12:45 ..
-rw-------.  1 root root 1783 5月  14 12:46 anaconda-ks.cfg
-rw-------.  1 root root  305 9月   1 19:59 .bash_history
-rw-r--r--.  1 root root   18 12月 29 2013 .bash_logout
-rw-r--r--.  1 root root  176 12月 29 2013 .bash_profile
-rw-r--r--.  1 root root  176 12月 29 2013 .bashrc
drwx------.  4 root root   31 5月  14 13:02 .cache
drwx------.  4 root root   30 5月  14 13:02 .config
-rw-r--r--.  1 root root  100 12月 29 2013 .cshrc
drwx------.  3 root root   25 5月  14 12:52 .dbus
-rw-r--r--.  1 root root 1831 5月  14 12:53 initial-setup-ks.cfg
drwx------.  2 root root   29 9月   2 14:29 .ssh
-rw-r--r--.  1 root root  129 12月 29 2013 .tcshrc
-rw-------.  1 root root  595 9月   1 19:16 .viminfo
-rw-------.  1 root root  108 5月  14 13:02 .xauthBwvZib
[[email protected] ~]# cd .ssh
[[email protected] .ssh]# ll -a
总用量 4
drwx------. 2 root root  29 9月   2 14:29 .
dr-xr-x---. 6 root root 253 9月   1 19:29 ..
-rw-------. 1 root root 402 9月   2 14:29 authorized_keys
           

• 扩展

1、只许秘钥验证，拒绝传统密码验证

[root@B .ssh]# vi /etc/ssh/ssh_config  #修改主机B的ssh配置文件
PasswordAuthentication yes  #将yes修改为no
           

2、在主机B上将主机A登陆的会话踢除

[root@B ~]# w
 :: up  day, :,   users,  load average: , , 
USER     TTY      FROM             [email protected]   IDLE   JCPU   PCPU WHAT
guest    :       :               May18 ?xdm?  :   s /usr/libexec/g
guest    pts/0    :0               14May18 111days  0.60s  4.02s /usr/libexec/g
root     pts/        Sat11    s  s  s w
root     pts/       :    s  s  s -bash
[root@B ~]# pkill -kill -t pts/2  #将ssh登陆的用户踢除
[root@B ~]# w
 :: up  day, :,   users,  load average: , , 
USER     TTY      FROM             [email protected]   IDLE   JCPU   PCPU WHAT
guest    :       :               May18 ?xdm?  :   s /usr/libexec/g
guest    pts/0    :0               14May18 111days  0.60s  4.02s /usr/libexec/g
root     pts/        Sat11    s  s  s w
[root@B ~]#