第六章 SSH遠程服務介紹

1、相關介紹

1.簡介
SSH是一個安全協議，在進行數據傳輸時，會對數據包進行加密處理，加密後在進行數據傳輸。確保了數據傳輸安全。那SSH服務主要功能有哪些呢？
1)提供遠程鏈接的服務
linux遠程鏈接： ssh telnet
windows的遠程鏈接： RDP (remote desktop)、向日葵、teamviewer
2)對傳輸數據進行加密

2.ssh和telnet
1）使用telnet鏈接服務器
#安裝telnet服務
[root@NFS ~]# yum install -y telnet-server

#啓動
[root@NFS ~]# systemctl start telnet.socket

#telnet只支持普通用戶登陸，建立用戶
[root@NFS ~]# useradd lhd
[root@NFS ~]# echo 123 | passwd --stdin lhd
Changing password for user lhd.
passwd: all authentication tokens updated successfully.

#鏈接測試
[c:\~]$ telnet 10.0.0.31 23
Connecting to 10.0.0.31:23...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.

Kernel 3.10.0-957.el7.x86_64 on an x86_64
NFS login: lhd
Password: 123
[lhd@NFS ~]$ su -

#篩選去重命令
[root@NFS ~]# echo "vviimm //eettcc//ssyyssccoonnffiigg//nneettwwoorrkk--ssccrriippttss//iiffccffgg--eetthh00" | sed -nr 's#(.)(.)#\1#gp'
vim /etc/sysconfig/network-scripts/ifcfg-eth0

2）ssh和telnet二者區別
#telnet:
不能使用root用戶登陸，只能使用普通用戶
數據包沒有進行加密，傳輸都是明文的

#ssh:
可使用任意用戶登陸
數據傳輸都是加密的

2、ssh相關命令

1.ssh客戶端和服務端
SSH有客戶端與服務端，咱們將這種模式稱爲C/S架構，ssh客戶端支持Windows、Linux、Mac等平臺。
在ssh客戶端中包含 ssh|slogin遠程登錄、scp遠程拷貝、sftp文件傳輸、ssh-copy-id祕鑰分發等應用程序。
​
2.ssh命令
[root@web01 ~]# ssh root@172.16.1.31 -p 22
​
#命令拆分
ssh    #命令
root   #系統用戶（若是不寫，就使用當前服務器的當前用戶）
@    #分隔符
172.16.1.31  #遠程主機的IP
-p     #指定端口（終端不支持）
22    #端口（默認22）
​
-o StrictHostKeyChecking=no  #首次訪問時不驗證身份
​
3.xshell鏈接不上虛擬機怎麼辦？
1)查網絡
ping ip
tcping ip port
​
2)查端口
telnet
tcping ip port
​
3)檢查網卡是否啓動
ip a
​
4)虛擬網絡編輯器
查看子網IP和網關
​
5)查看windows虛擬網卡
vmnat8
​
6)防火牆

3、scp命令

1.簡介
scp客戶端命令：遠程拷貝
相似於rsync，scp全量，rsync增量
scp支持推和拉
​
2.scp推
#把當前目錄下的hostname_ip.sh文件推送到172.16.1.31機器的/tmp目錄下
[root@web01 ~]# scp hostname_ip.sh 172.16.1.31:/tmp
​
#注意：
 與rsync不一樣，推送時不管是加 / 仍是不加 / ，推送的都是目錄
 若是想推送目錄下的文件，則使用 *
 
3.scp拉
[root@web01 ~]# scp 172.16.1.31:/tmp/1.txt ./
​
#注意：
 與rsync不一樣，拉取時不管是加 / 仍是不加 / ，拉取的都是目錄
 若是想拉取目錄下的文件，則使用 *
 
4.經常使用參數
-P 指定端口，默認22端口可不寫
-r 表示遞歸拷貝目錄
-p 表示在拷貝文件先後保持文件或目錄屬性不變
-l 限制傳輸使用帶寬(默認kb)
​
[root@web01 /tmp]# scp -l 8096 1.txt 172.16.1.31:/tmp/
root@172.16.1.31's password: 
1.txt    12%   64MB   1.0MB/s   07:19 ETA
​
5.總結
1)scp經過ssh協議加密方式進行文件或目錄拷貝。
2)scp鏈接時的用戶做爲爲拷貝文件或目錄的權限。
3)scp支持數據推送和拉取，每次都是全量拷貝，效率較低。

4、sftp命令

1.終端鏈接

#文件傳輸命令

sftp:/root> 

​

#下載文件

sftp:/root> get hostname_ip.sh

Fetching /root/hostname_ip.sh to hostname_ip.sh

sftp: received 497 ؖ½ؠin 0.01 seconds

​

#上傳文件

sftp:/root> put

​

2.服務器之間鏈接

#鏈接

[root@web01 ~]# sftp root@172.16.1.31

root@172.16.1.31's password: 

Connected to 172.16.1.31.

​

#操做遠程鏈接過去的機器

sftp> pwd

Remote working directory: /root

sftp> ls -l

-rw-------    1 root     root         1429 Jul  6 02:17 anaconda-ks.cfg

-rw-r--r--    1 root     root          497 Aug  5 20:15 hostname_ip.sh

-rw-r--r--    1 root     root       727290 Aug 15 01:15 sersync2.5.4_64bit_binary_stable_final.tar.gz

​

#若是想操做本機，則在命令前加一個 l

sftp> lls -l

total 8

-rw-r--r--  1 root root    0 Aug 18 00:25 1.txt

-rw-------. 1 root root 1429 Jul  6 02:17 anaconda-ks.cfg

-rw-r--r--. 1 root root  497 Aug  5 20:15 hostname_ip.sh

​

#拉取命令

sftp> get 1.txt ./

#當使用拉取命令的時候，前面的是遠程服務器，後面的是本地服務器

​

#推送命令

sftp> put 1.txt ./

#當使用put的時候，前面的是本地服務器，後面的是遠程服務器

​

3.文件傳輸工具

#圖形化工具

1)xftp

2)filezilla

3)flashfxp

​

4.命令對比

#rz/sz:

 1)不能上傳4G以上的文件

 2)不能斷點續傳

 3)不能上傳文件夾

​

#sftp:

 1)能上傳大於4G的文件

 2)能斷點續傳

 3)能夠上傳文件夾

5、ssh驗證方式

1.方式一：基於用戶名密碼遠程鏈接
#須要知道服務器的IP，端口，系統用戶，用戶密碼才能連接遠程主機
[root@NFS ~]# ssh root@172.16.1.7 -p 2222
root@172.16.1.7's password: 
Last login: Tue Aug 18 00:44:33 2020 from 10.0.0.1
[root@web01 ~]#
​
#設置密碼
1）複雜的密碼（容易忘記）
2）簡單的密碼（容易被破解）
3）每臺機器密碼都不同
4）密碼是動態的
5）密碼三個月一變
6）密碼錯誤三次，鎖定用戶
7）密碼確定是沒有規律的
​
2.基於密鑰的方式
默認狀況下，經過ssh客戶端命令登錄遠程服務器，須要提供遠程系統上的賬號與密碼，但爲了下降密碼泄露的機率和提升登錄的方便性，建議使用密鑰驗證方式。
​
1）生成密鑰對
[root@web01 ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:n618dqJXK1Z1mvHcv31VadZTBwni3gXEghWSp9+HTj4 root@web01
The key's randomart image is:
+---[RSA 2048]----+
|       .++++..o |
|       ooo.... o|
|         o.. . =|
|       .. . ..==|
|       S.....oB=|
|         ..o+ * =|
|         o+.+ .o|
|         . .E o +|
|          +* = .+|
+----[SHA256]-----+
​
2）將公鑰發送至免密登陸的服務器
#方式一：手動複製
​
[root@web01 ~]# cat .ssh/id_rsa.pub   #查看公鑰
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbOLFAuHJy6xtGOBFIWALpyWNyR3ixgULtv9uVMELre1iVv6S/fBT3YqKR6naX1y1oyhWBD6njMhXDANuG9OQ/ABTHrgOJrF5JMY1AS9jI5DrMaIdfoBXcmck6RuID5yddlLiA6VdeHI8ndtth7bu6Ed50otviNbzF7NG7chX9oGbju6uGMY12pb0BKCtJaJ9qycGJOZCi8OyrIycJBexsiC+DYOwvXjmtdRtf7KNBnHSDDEIsywQNku1/WXUE0l4CMoZ/zjgO19fdxfdbCT4qAWTz0r9CDUzhEFIVZgz73KLahy+IXIhNupHXf0VcrS3h11rWDUrOeIw2oIZHEPz3 root@web01
​
#將公鑰寫到要鏈接的機器
[root@NFS ~]# vim .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbOLFAuHJy6xtGOBFIWALpyWNyR3ixgULtv9uVMELre1iVv6S/fBT3YqKR6naX1y1oyhWBD6njMhXDANuG9OQ/ABTHrgOJrF5JMY1AS9jI5DrMaIdfoBXcmck6RuID5yddlLiA6VdeHI8ndtth7bu6Ed50otviNbzF7NG7chX9oGbju6uGMY12pb0BKCtJaJ9qycGJOZCi8OyrIycJBexsiC+DYOwvXjmtdRtf7KNBnHSDDEIsywQNku1/WXUE0l4CMoZ/zjgO19fdxfdbCT4qAWTz0r9CDUzhEFIVZgz73KLahy+IXIhNupHXf0VcrS3h11rWDUrOeIw2oIZHEPz3 root@web01
​
#受權
[root@NFS ~]# chmod 600 .ssh/authorized_keys
​
#鏈接測試
[root@web01 ~]# ssh 172.16.1.31
Last failed login: Tue Aug 18 00:51:38 CST 2020 from 10.0.0.1 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Mon Aug 17 23:39:28 2020 from 172.16.1.7
​
#方式二：命令推送公鑰
​
[root@web01 ~]# ssh-copy-id -i .ssh/id_rsa.pub root@172.16.1.41   #命令推送公鑰
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
The authenticity of host '172.16.1.41 (172.16.1.41)' can't be established.
ECDSA key fingerprint is SHA256:mOtCaBS+53EDW9mKoXVj4v5Q1E1fYB0DexMHr/WzTc4.
ECDSA key fingerprint is MD5:75:12:f6:05:4c:5d:66:6f:21:0d:8e:0f:fc:bb:36:d6.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.16.1.41's password: 
​
Number of key(s) added: 1
​
Now try logging into the machine, with:   "ssh 'root@172.16.1.41'"
and check to make sure that only the key(s) you wanted were added.
​
[root@web01 ~]#
​
#鏈接測試
[root@web01 ~]# ssh 172.16.1.41
Last login: Mon Aug 17 23:32:44 2020 from 10.0.0.1

6、做業

1.需求

1.恢復快照
2.m01鏈接web01,backup,NFS作免密登陸
3.鏈接的用戶是名字的縮寫

2.環境準備

主機	角色	IP
m01	免密登陸	10.0.0.61
backup	備份服務器	10.0.0.41
NFS	NFS服務器	10.0.0.31
web01	web服務器	10.0.0.7

 

 

 

 

3.建立統一用戶

[root@m01 ~]# useradd jh
[root@m01 ~]# passwd jh
Changing password for user jh.
New password: 
BAD PASSWORD: The password is a palindrome
Retype new password: 
passwd: all authentication tokens updated successfully.
​
[root@web01 ~]# useradd jh
[root@文web01 ~]# passwd jh
Changing password for user jh.
New password: 
BAD PASSWORD: The password is a palindrome
Retype new password: 
passwd: all authentication tokens updated successfully.
​
[root@NFS ~]# useradd jh
[root@NFS ~]# passwd jh
Changing password for user jh.
New password: 
BAD PASSWORD: The password is a palindrome
Retype new password: 
passwd: all authentication tokens updated successfully.
​
[root@backup ~]# useradd jh
[root@backup ~]# passwd jh
Changing password for user jh.
New password: 
BAD PASSWORD: The password is a palindrome
Retype new password: 
passwd: all authentication tokens updated successfully.

4.m01配置backup免密登陸

1.切換用戶
[root@m01 ~]# su - jh
​
2.生成驗證樹
[jh@m01 ~]$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jh/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/jh/.ssh/id_rsa.
Your public key has been saved in /home/jh/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Km6/mnGgGEZs5tc1sU9Qf6mzTyMZo5LCPRduDgEQIXw jh@m01
The key's randomart image is:
+---[RSA 2048]----+
|.. +o o..       |
|...E.   + .   . |
| =. . + . . o   |
|=   . o +   o   |
|.o ... .So =     |
|.o......+ o *   |
|. . ooo* = + o   |
|   ..=. B   + . |
|   .+oo. .   .   |
+----[SHA256]-----+
​
3.命令推送密鑰
[jh@m01 ~]$ ssh-copy-id  -i .ssh/id_rsa.pub jh@10.0.0.41
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
jh@10.0.0.41's password: 
​
Number of key(s) added: 1
​
Now try logging into the machine, with:   "ssh 'jh@10.0.0.41'"
and check to make sure that only the key(s) you wanted were added.

5.m01配置NFS免密登陸

1.命令推送密鑰
[jh@m01 ~]$ ssh-copy-id  -i .ssh/id_rsa.pub jh@10.0.0.31
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
The authenticity of host '10.0.0.31 (10.0.0.31)' can't be established.
ECDSA key fingerprint is SHA256:g6buQ4QMSFl+5MMAh8dTCmLtkIfdT8sgRFYc6uCzV3c.
ECDSA key fingerprint is MD5:5f:d7:ad:07:e8:fe:d2:49:ec:79:2f:d4:91:59:c5:03.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
jh@10.0.0.31's password: 
​
Number of key(s) added: 1
​
Now try logging into the machine, with:   "ssh 'jh@10.0.0.31'"
and check to make sure that only the key(s) you wanted were added.

5m01配置web01免密登陸

1.命令推送密鑰
[jh@m01 ~]$ ssh-copy-id  -i .ssh/id_rsa.pub jh@10.0.0.7
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
The authenticity of host '10.0.0.7 (10.0.0.7)' can't be established.
ECDSA key fingerprint is SHA256:g6buQ4QMSFl+5MMAh8dTCmLtkIfdT8sgRFYc6uCzV3c.
ECDSA key fingerprint is MD5:5f:d7:ad:07:e8:fe:d2:49:ec:79:2f:d4:91:59:c5:03.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
jh@10.0.0.7's password: 
​
Number of key(s) added: 1
​
Now try logging into the machine, with:   "ssh 'jh@10.0.0.7'"
and check to make sure that only the key(s) you wanted were added.

6.測試

1.m01免密登陸web01測試鏈接
[jh@m01 ~]$ ssh jh@10.0.0.7
Last login: Mon Aug 17 19:28:43 2020 from 10.0.0.61
[jh@web01 ~]$ logout
Connection to 10.0.0.7 closed.

2.m01免密登陸NFS測試鏈接
[jh@m01 ~]$ ssh jh@10.0.0.31
Last login: Mon Aug 17 19:25:58 2020 from 10.0.0.61
[jh@NFS ~]$ logout
Connection to 10.0.0.31 closed.

3.m01免密登陸backup測試鏈接
[jh@m01 ~]$ ssh jh@10.0.0.41
Last login: Mon Aug 17 19:24:11 2020 from 10.0.0.61
[jh@backup ~]$ logout
Connection to 10.0.0.41 closed.

4.退出登陸
[jh@m01 ~]$