RHCE-5

1.使用client的xiaoming用户基于秘钥认证方式通过端口2000使用ssh登录server端的xiaoming用户和xiaohei用户，server端的其他用户都不可被远程登录。

 首先，现更改配置文件：/etc/ssh/sshd_config

Port 2000            #修改端口为2000

allowusers xiaoming xiaohei     #允许登录的用户xiaoming xioahei

添加防火墙允许策略，并定义端口到服务

[root@server-1 ~]# firewall-cmd --permanent  --add-port=2000/tcp
success
[root@server-1 ~]# firewall-cmd --reload
success
[root@server-1 ~]# semanage port -a -t ssh_port_t -p tcp 2000
ValueError: Port tcp/2000 already defined

出现提示表明端口port=2000已被定义使用，换个端口port=2223，重复以上操作把端口换成2223

在client端增加用户xiaoming 密码设为123

[root@client_1 ~]# useradd xiaoming
[root@client_1 ~]# echo 123 |passwd --stdin xiaoming
Changing password for user xiaoming.
passwd: all authentication tokens updated successfully.

在server端增加用户xiaoming xiaohei 密码设为123

[root@server-1 ~]# useradd xiaoming
[root@server-1 ~]# echo 123 |passwd --stdin xiaoming
Changing password for user xiaoming.
passwd: all authentication tokens updated successfully.
[root@server-1 ~]# useradd xiaohei
[root@server-1 ~]# echo 123 |passwd --stdin xiaohei
Changing password for user xiaohei.
passwd: all authentication tokens updated successfully.

在client的xiaoming用户的家目录下创建.ssh目录，并进入到该目录，在该目录下生成公私钥

[root@client_1 ~]# su - xiaoming
[xiaoming@client_1 ~]$ ls
[xiaoming@client_1 ~]$ mkdir .ssh
[xiaoming@client_1 ~]$ cd .ssh
[xiaoming@client_1 .ssh]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/xiaoming/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/xiaoming/.ssh/id_rsa.
Your public key has been saved in /home/xiaoming/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Uk0rMHZEB3SwPzAf5lZAPDT+Ol1vZ2NT8L8i0LCQkhE xiaoming@client_1
The key's randomart image is:
+---[RSA 3072]----+
|     E=+B*O      |
|     o + Bo+     |
|      o B *.. .  |
|     o + X +   o |
|      o S X . . o|
|       . + = . .o|
|          + .  +*|
|           o ..o=|
|            . .. |
+----[SHA256]-----+
[xiaoming@client_1 .ssh]$ ls
id_rsa  id_rsa.pub

在服务端的xiaoming和xiaohei用户的家目录下创建.ssh目录

[root@server-1 ~]# su - xiaoming
[xiaoming@server-1 ~]$ mkdir .ssh
[xiaoming@server-1 ~]$ su - xiaohei
Password:
[xiaohei@server-1 ~]$ mkdir .ssh

将公钥使用scp分别传送给服务端的xiaoming和xiaohei用户的家目录下的.ssh目录下，并修改名称为authorized_key

[xiaohei@server-1 ~]$ cd .ssh
[xiaohei@server-1 .ssh]$ scp xiaoming@172.24.8.133:/home/xiaoming/.ssh/id_rsa.pub ./authorized_keys
The authenticity of host '172.24.8.133 (172.24.8.133)' can't be established.
ECDSA key fingerprint is SHA256:yuMDJywUWGfCpbavqyM698DcGQmEK9L9sphTN9UEbk0.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '172.24.8.133' (ECDSA) to the list of known hosts.
xiaoming@172.24.8.133's password:
id_rsa.pub                                                             100%  571   384.1KB/s   00:00
[xiaohei@server-1 .ssh]$ ls
authorized_key  known_hosts
[xiaohei@server-1 .ssh]$ su - xiaoming
Password:
Last login: Tue Dec 21 18:17:46 CST 2021 on pts/1
[xiaoming@server-1 ~]$ cd .ssh
[xiaoming@server-1 .ssh]$  scp xiaoming@172.24.8.133:/home/xiaoming/.ssh/id_rsa.pub ./authorized_keys
The authenticity of host '172.24.8.133 (172.24.8.133)' can't be established.
ECDSA key fingerprint is SHA256:yuMDJywUWGfCpbavqyM698DcGQmEK9L9sphTN9UEbk0.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '172.24.8.133' (ECDSA) to the list of known hosts.
xiaoming@172.24.8.133's password:
id_rsa.pub                                                             100%  571   544.1KB/s   00:00
[xiaoming@server-1 .ssh]$ ls
authorized_key  known_hosts

服务器端重启ssh服务

[root@server-1 ~]# systemctl restart sshd

验证：客户端的xiaoming用户登录到服务器端的xiaoming和xiaohei用户
 

[xiaoming@client_1 ~]$ ssh xiaoming@172.24.8.130 -p 2223
xiaoming@172.24.8.130's password:

尝试登录后发现仍需要密码登录，此时需要修改服务器端的xiaoming和xiaohei用户家目录下的.ssh文件的权限为755，authorized_keys权限为默认值644
xiaoming用户：

[xiaoming@server-1 ~]$ chmod g-w .ssh

xiaohei用户：

[xiaohei@server-1 ~]$ chmod g-w .ssh

登录：

[xiaoming@client_1 ~]$ ssh xiaoming@172.24.8.130 -p 2223
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Tue Dec 21 19:11:30 2021
[xiaoming@server-1 ~]$
[xiaoming@server-1 ~]$ exit
logout
Connection to 172.24.8.130 closed.
[xiaoming@client_1 ~]$ ssh xiaohei@172.24.8.130 -p 2223
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Tue Dec 21 19:06:29 2021 from 172.24.8.133
[xiaohei@server-1 ~]$

不需要密码验证