三、远程连接服务器
1、SSH
ssh（Secure Shell Protocol），安全的壳程序协议。
它可以通过数据包加密技术将等待传输的数据包加 密后再传输到网络上。ssh协议本身提供两个服务器功能：一个是类似telnet的远程连接使用shell的服务 器；另一个就是类似ftp服务的sftp-server，提供更安全的ftp服务。
安装
yum install openssh-server -y
2、服务配置
修改配置文件
[root@server ~]# vim /etc/ssh/sshd_config
#文件内容：
# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22 //监听端口，默认22端口
#AddressFamily any //使用哪一个协议家族（IPV4 or IPV6）
#ListenAddress 0.0.0.0 //指明监控的地址，0.0.0.0表示本机的所有地址
#ListenAddress :: //指明监听的IPV6的所有地址格式#HostKey /etc/ssh/ssh_host_rsa_key //rsa私钥认证
#HostKey /etc/ssh/ssh_host_ecdsa_key //ecdsa私钥认证
#HostKey /etc/ssh/ssh_host_ed25519_key //ed25519私钥认证# Ciphers and keying
#RekeyLimit default none# Logging
#SyslogFacility AUTH //当有人使用ssh登录系统的时候，SSH会记录信息，信息保存在/var/log/secure里面
#LogLevel INFO# Authentication:#LoginGraceTime 2m //登录的宽限时间，默认2分钟没有输入密码，则自动断开连接
#PermitRootLogin prohibit-password 是否允许root用户使用密码登陆，'yes'表示允许
#StrictModes yes
#MaxAuthTries 6 //最大认证尝试次数，最多可以尝试6次输入密码。之后需要等待某段时间后才能再次输入密码
#MaxSessions 10 //允许的最大会话数#PubkeyAuthentication yes# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys #选择基于密钥验证时，客户端生成一对公私钥之后，会将公钥放到.ssh/authorizd_keys里面#AuthorizedPrincipalsFile none#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes //是否允许支持基于口令的认证
#PermitEmptyPasswords no# Change to no to disable s/key passwords
#KbdInteractiveAuthentication yes# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in RHEL and may cause several
# problems.
#UsePAM no#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none# no default banner path
#Banner none# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server允许特定账户登陆
#在配置文件最后写入：AllowUsers USERNAME（用户名）
#补充：如果是多个用户，中间用空格隔开
#写入后需要重启ssh服务
[root@server ~]# systemctl restart sshd
3、免密登录
生成密钥对 — 客户端配置
#交互式命令：ssh-keygen
#也可以使用可选项，直接告诉主机想要生成什么加密方式，储存在哪，是否设置密码加密密钥等信息
-b：指定密钥长度；
-e：读取openssh的私钥或者公钥文件；
-C：添加注释；
-f：指定用来保存密钥的文件名；
-i：读取未加密的ssh-v2兼容的私钥/公钥文件，然后在标准输出设备上显示openssh兼容的私钥/公钥；
-l：显示公钥文件的指纹数据；
-N：提供一个新密语；
-P：提供（旧）密语；
-q：静默模式；
-t：指定要创建的密钥类型。
#不使用可选项将会有一个简单的交互，从而生成想要的密钥
#默认存储密钥的路径：
/root/.ssh/id_rsa #私钥文件
/root/.ssh/id_rsa.pub #公钥文件
复制公钥文件到服务端
#命令：ssh-copy-id 用户名@主机地址
#该过程需要输入服务端对应用户的密码
#注意：客户端什么用户生成的密钥将用于服务端相同用户的登陆
例如：
#这是一个客户端传送给服务端的密钥：
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDR8/fYzi8mFlnr4roSP5VxgNoclh8GQcOpZGK68XnMNu1GMqS9JOHEUIcC3COPZCPWdqUvmFs5QCWzXKC1ZPvJa0UfWvk4M7Y8q01jjTTOsPkqYEkov1IFvbOqVL69Omc/zI2CsqaUuq1CYbpXDk6KTdoNkRSTx/iOsiGrfkP9zYx2UDj431Dg+YdCmzHybVh9V6+G3MdGTPjUpRbh8gAcaOxJRRC0UkiNLj31CwFKrnXiVCQaed7Fg5RZNrgTslcTQkD90U/eXd8vRgHtrCem4l5PEBAFdY6G1O/qGEf66KVwvMm9THA8tcDB4G97eVCzxgwESIluvx/jCYxv2RIxTH7vbsU49sChrDYllSGW3QS1x7WweRZXaDgsMU3NlRk0yuLaGm1rOtOjdQtno7+xFejZ9WnIqNhKkuc3+28D8uFCfiPC96K/XKRYKOyHHAGoe+TIAWecuuJDlBbI408Bs9ZJhsM/2sJNS2z+GE9vnIyP5DuBpt60iHhPij1oVfE= root@client
#后面会有一个“= root@client”，说明该密钥将只能用于root用户登陆。
#当然，删除“= root@client”信息后，该密钥将可以用于其他用户的登陆
登陆
#客户端将密钥送给服务端后可以进行登录：
[root@client ~]# ssh root@192.168.5.100
Activate the web console with: systemctl enable --now cockpit.socketRegister this system with Red Hat Insights: insights-client --register
Create an account or view all your systems at https://red.ht/insights-dashboard
Last login: Sat Oct 26 06:06:29 2024 from 192.168.5.1
#该过程不用输入密码
