|
|
发表于 2006-4-13 13:04:29
|
显示全部楼层
思路:通过数字签名算法(Digital Signature Algorithm,DSA),生成密钥对,并把它传到目的服务器上,再将其加到授权文件中.
目的:实现从服务器server1,无密码登陆server2.
步骤如下:
1.生成密钥.
[server1]$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/accountname/.ssh/id_dsa):
Enter passphrase (empty for no passphrase): (enter passphrase)
Enter same passphrase again: (enter passphrase)
Your identification has been saved in /home/accountname/.ssh/id_dsa.
Your public key has been saved in /home/accountname/.ssh/id_dsa.pub.
The key fingerprint is:
7e:5e:b2:f2:d4:54:58:6a:fa:6b:52:9c:da:a8:53:1b accountname@offsite
2. 将公钥传递到远程服务器上
[server1]$ scp .ssh/id_dsa.pub accountname@server2.com
accountname@server2.com's password: (enter password, not new
passphrase!)
id_dsa.pub 100% |*****************************| 614 00:00
[offsite]$ scp .ssh/id_dsa.pub accountname@server2.com
accountname@server2.com's password: (enter password, not new
passphrase!)
id_dsa.pub 100% |*****************************| 614 00:00
3.将 offsite.pub 添加到已授权密钥列表
[server1]$ ssh accountname@server1.com
accountname@server2.com's password: (enter password, not new
passphrase!)
[server2]$ cat offsite.pub >> ./ssh/authorized_keys
4. 将先前上传的 offsite.pub 密钥文件删除,因为再也不需要它了
[server2]$ rm offsite.pub
使用 ssh-agent 自动化机器访问
ssh-agent 程序如同一个看门人,它根据需要安全地提供对安全密钥的访问。ssh-agent 启动后,它就会在后台运行,并且可以由 ssh 和 scp 程序等其他 OpenSSH 应用程序所使用。这就使得 ssh 程序可以请求一个已经解密了的密钥,而不是在每次需要时向您询问私钥的安全口令。
[server1]$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-XX1O24LS/agent.14179; export SSH_AUTH_SOCK;
SSH_AGENT_PID=14180; export SSH_AGENT_PID;
echo Agent pid 14180;
我们可以使用 shell 的 eval 命令来让 shell 执行 ssh-agent 显示的输出命令:
[server1]$ eval `ssh-agent`
Agent pid 14198
现在我们就已经可以使用 ssh-agent 共享我们的口令
[server1$ ssh-add
Enter passphrase for /home/accountname/.ssh/id_dsa: (enter passphrase)
Identity added: /home/accountname/.ssh/id_dsa
(/home/accountname/.ssh/id_dsa)
现在,当我们访问 server2 时,不会再被提示输入口令:
[server1$ ssh accountname@server2.com
[server2]$ exit
粗略写了一下,兄弟自己实践吧! |
|