快速配置Linux-ssh互信

fjzcau發表於2016-02-18
cd ~/.ssh
rm -f *
1、生成金鑰對 
/usr/bin/ssh-keygen -t dsa
id_dsa.pub 公鑰 =》鎖   =》服務端
id_dsa     私鑰 =》鑰匙 =》客戶端
例如:
在節點node1,去ssh連線節點node2,則節點node1必須有節點2的公鑰。
1)node1拿著node2的公鑰,去連線node2;
2)node2收到請求連線,會用自己的私鑰去驗證公鑰,若驗證成功,則允許node1連線。
2、所有節點的公鑰id_dsa.pub生成一個檔案authorized_keys。
[root@AWS-BigData-Spark04-172-31-14-221 .ssh]# ll
total 16
-rw------- 1 root root 2517 Feb 18 04:10 authorized_keys
-rw------- 1 root root  668 Feb 18 04:07 id_dsa
-rw-r--r-- 1 root root  628 Feb 18 04:07 id_dsa.pub
-rw-r--r-- 1 root root 1776 Feb 18 04:22 known_hosts
以下每行是一個公鑰id_dsa.pub的內容:
cat > ~/.ssh/authorized_keys <<!--
ssh-dss AAAAB3NzaC1kc3MAAACBAI+QGLhpd/8GirORS2QYPlYjKLGnNCX5/bIxZBaUkdwdn60Te/Gy52v2jd2uLmaKw/xqidKlp6gxxJzQgVGfQ6eaOdDXCDM9SVTvq+vMMm1Mi5HbRwJXZXrVDOEsVxX0smzt+Fz4mqgJXfr0HokdgTTKpxNq6vfrY5y79T99QN9fAAAAFQCcLl0YycvUuX9Y6uBiDGgfvGjFNwAAAIBEi8pBvhtrB1vt6RcRMWpU9a2TCzYSBlcJZSGRE/XMYEk5IqjF+knDwwiyyOntnEkQXMOhRiclZBMHkkGBniCKeaqJ4QOZNL52ko/US3owBvN5myNSGX7DMjEs8J/jqoBGoEmAWr0x/Tw5B9CgyVeFKSzigqXbPSU5I5+LO3FqiAAAAIEAj2VzSbjT9177A5HnN7+JKq+nd9DArWZIek5phuK45OleH78DtYIqqDiK5IhIe3Ke55SZhdoLa0mUVKP46GFXHXy584ma4vJaDtF2zfjH0imAhxfF7TOjAoaE4zPr55oaiPtEFhVa4qXo4MJoUQ9gpLA+9SAxUzP/Wn87ai9aYr4= root@spark02
ssh-dss AAAAB3NzaC1kc3MAAACBAINvbeQTau4waH0DvpGET5g5oyeOhJ5bhSZVhwPKHC9KA0Q9SuIvryAPgb2DcfiaBgNcGN5X9Xv+h/M3WytraTDHF6EtZCjd+PssX3jlAM83GIbGXD0Qv+NLbIGLdewR413ggG7ss/idjb5gE+d88WDn14oWClfZR830k+77ed+dAAAAFQCKhqjeAnPcX3iQs/8IDZKM/u/ohQAAAIA+IKxK/OsW/vLX9S2P8hFO4pn+rE/OxvEAJTmxxVoejPp0VE9KoVhaaFeNE0Jxz3gNZimtbzZMPe+eSZ36FUY7tEQRLaBV2m5taBz28g7cTVHnyhZ1ddfmojHkiDSpcoB4Z+1u5mJmdhLqE9L7jsmiLkBXERdRFopJYhC98ba14QAAAIBJC16EEBZ4DZUoVE6b+Elg5T+TLD+Sde1+WtW08ZcN0hC9RTvjIp6UxW029cgy4/ct+y00OsymMzJc+YA9sq3M8xVUpc65JJ5eW6GpS3ggdDM5f4pRUBZwhsAQLGJCOISYTs/Ikboz48MjFtvZvGtQYwSmHsARhfAng6k4VblUaQ== root@spark03
ssh-dss AAAAB3NzaC1kc3MAAACBAOroxRmuhJ9Lkp7CoumuFOQVpR**5y92vL2K1VbbXbtGZzm6k4Zwh0FlZJf/qNnHq8AUFfhCXbU+vbBARk0c6GyLxT4mRRJ9N6C4lt21sSaNmc3kE6wHCYzLdQy5VonRT6YgFB/MPogtIO9MLTQ+yhMgHsH/MmA1+6zeDJ5N3iNAAAAFQC+yHZuwMh28iry6qF9bQ7o/DvtBQAAAIEAwyJRzqsWagNokmKpB/qNkCbMDVWxTBUnS4weu+HeJwvgxay7nPxGrZ0yZRmbClm9VGCi5Oevz28lk0QqkkpZ45GXPWj+dEW+kMxVUqanYJ0M+li04flf4J7k/CVdl12uqnRU4Atjau7DOpmr0jtezigi91yLwGNsEMuPefSCfiEAAACADXj43AB8MsRnOsQ8hdPN9ff95Tg0Anvnzb16lH8O0MoMWX2G1m4kwSTcYrZCgOTh7wWKvf7xjZpykqPgbb17HZMdgcmXUgXAoEyM3B5GWt7EZUfM1rBq1vLGfRkEzs1W6oymo73L4RinIt7A9jHKEDL0njLz/aP/tuQ+F3lLLPs= root@spark04
!
3、目錄檔案許可權 
chmod 700 ~/.ssh 
chmod 744 ~/.ssh/id_dsa.pub
chmod 600 ~/.ssh/authorized_keys 
chmod 600 ~/.ssh/id_dsa 
4、測試ssh互信  
for i in 1 2 3 4; do ssh spark0$i "date;hostname" ; done
5、hosts地址解析 
cat >> /etc/hosts <<!--
10.31.14.222 spark01
10.31.14.223 spark02
10.31.14.220 spark03
10.31.14.221 spark04
!
6、若是root互信,注意ssh允許root登入。
ssh配置檔案:/etc/ssh/sshd_config 
PermitRootLogin yes
# Only allow root to run commands over ssh, no shell
#PermitRootLogin forced-commands-only
--平滑重啟ssh 
/etc/init.d/sshd reload

來自 “ ITPUB部落格 ” ,連結:http://blog.itpub.net/22661144/viewspace-1990505/,如需轉載,請註明出處,否則將追究法律責任。

相關文章