第九單元總結

#############第九單元##############

1.ssh的key認證

#######生成key###########

[test@foundation0 ~]$ ssh-keygen                                       ###生成公鑰和私鑰的工具

Generating public/private rsa key pair.

Enter file in which to save the key (/home/test/.ssh/id_rsa):『enter』 ###指定加密字符保存文件，使用默認

Created directory '/home/test/.ssh'.

Enter passphrase (empty for no passphrase):                            ###密碼，必須大于4位

Enter same passphrase again:

Your identification has been saved in /home/test/.ssh/id_rsa.

Your public key has been saved in /home/test/.ssh/id_rsa.pub.

The key fingerprint is:                                                ###確認密碼

a5:4f:02:51:68:59:f4:e8:e3:c5:91:1f:6f:86:99:06 test@foundation0.ilt.example.com

The key's randomart p_w_picpath is:

+--[ RSA 2048]----+

|      .*+        |

|      +. o .     |

|     .. . E .    |

|       o + + *   |

|        S + * +  |

|       . * . o   |

|        . .      |

|                 |

|                 |

+-----------------+

[test@foundation0 .ssh]$ pwd

/home/test/.ssh                            ###生成密鑰存放位置

[test@foundation0 .ssh]$ ls

id_rsa  id_rsa.pub                    ####id_rsa位私鑰，id_rsa.pub位公鑰

#####################使用key加密目標主機的目標用戶############

[test@foundation0 ~]$  ssh-copy-id -i /home/test/.ssh/id_rsa.pub westos@172.25.254.100

The authenticity of host '172.25.254.100 (172.25.254.100)' can't be established.

ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.

Are you sure you want to continue connecting (yes/no)? yes

/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

westos@172.25.254.100's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'westos@172.25.254.100'"

and check to make sure that only the key(s) you wanted were added.

ssh-copy-id                      ####上傳key的工具

-i                               ####指定使用的公鑰

/home/test/.ssh/id_rsa.pub       #####使用公鑰的名稱

westos                           ####被管理的目標用戶

172.25.254.100                   ####被管理用戶所在主機的ip

authorized_keys###此文件在目標用戶加目錄的.ssh中，這個文件就是目標用戶被加密的標識，文件內容位公鑰內容。

2.sshd服務的簡單配置

vim /etc/ssh/sshd_config             ###sshd服務的配置文件

48 PermitRootLogin yes|no            ###是否允許root用戶通過sshd的認證

78 PasswordAuthentication yes|no     ###開啟或關閉用戶密碼認證

AllowUsers student westos             ###用戶白名單，只允許在名單中出現的用戶使用sshd服務

systemctl restart sshd                ###從新加載配置

3.系統服務的控制

1）systemd

系統初始化程序，系統開始的第一個進程，pid為1

2）systemctl 命令

systemctl list-units          ##列出當前系統服務的狀態

systemctl list-unit-files     ##列出服務的開機狀態

systemctl status sshd         ##查看指定服務的狀態

systemctl stop sshd           ##關閉指定服務

systemctl start sshd          ##開啟指定服務

systemctl enable sshd         ##設定指定服務開機開啟

systemctl disable sshd        ##設定指定服務開機關閉

systemctl reload sshd         ##是制定服務從新加載配置

systemctl list-dependencies sshd  ##查看指定服務的依賴關系

systemctl mask sshd           ##凍結指定服務

sustemctl unmask sshd         ##啟用服務

3）服務狀態

systemctl     status          服務名稱

loaded                       ##系統服務已經初始化完成，加載過配置

active（running）            ##服務正在被系統利用

active（exited）             ##服務已經加載配置，等待被系統利用

active（waiting）            ##服務等待被系統處理

inactive                     ##服務關閉

enabled                      ##服務開機啟動

disabled                     ##服務開機不自啟

static                       ##服務開機啟動項不可被管理

failed                       ##系統配置錯誤

4.openssh-server