如何在 CentOS / RHEL 上设置 SSH 免密码登录

作为系统管理员，你计划在 Linux 上使用 OpenSSH，完成日常工作的自动化，比如文件传输、备份数据库转储文件到另一台服务器等。为实现该目标，你需要从主机 A 能自动登录到主机 B。自动登录也就是说，要在 shell 脚本中使用ssh，而无需要输入任何密码。

本文会告诉你怎样在 CentOS/RHEL 上设置 SSH 免密码登录。自动登录配置好以后，你可以通过它使用 SSH （Secure Shell）和安全复制 （SCP）来移动文件。

SSH 是开源的，是用于远程登录的最为可靠的网络协议。系统管理员用它来执行命令，以及通过 SCP 协议在网络上向另一台电脑传输文件。

通过配置 SSH 免密码登录，你可以享受到如下的便利：

• 用脚本实现日常工作的自动化。
• 增强 Linux 服务器的安全性。这是防范虚拟专用服务器（VPS）遭受暴力破解攻击的一个推荐的方法，SSH 密钥单凭暴力破解是几乎不可攻破的。

什么是 ssh-keygen

ssh-keygen 是一个用来生成、创建和管理 SSH 认证用的公私钥的工具。通过 ssh-keygen 命令，用户可以创建支持SSH1 和 SSH2 两个协议的密钥。ssh-keygen 为 SSH1 协议创建 RSA 密钥，SSH2 则可以是 RSA 或 DSA。

什么是 ssh-copy-id

ssh-copy-id 是用来将本地公钥拷贝到远程的 authorizedkeys 文件的脚本命令，它还会将身份标识文件追加到远程机器的 ~/.ssh/authorizedkeys 文件中，并给远程主机的用户主目录适当的的权限。

SSH 密钥

SSH 密钥为登录 Linux 服务器提供了更好且安全的机制。运行 ssh-keygen 后，将会生成公私密钥对。你可以将公钥放置到任意服务器，从持有私钥的客户端连接到服务器的时，会用它来解锁。两者匹配时，系统无需密码就能解除锁定。

在 CentOS 和 RHEL 上设置免密码登录 SSH

以下步骤在 CentOS 5/6/7、RHEL 5/6/7 和 Oracle Linux 6/7 上测试通过。

节点1 : 192.168.0.9 节点2 : 192.168.l.10

步骤1 :

测试节点1到节点2的连接和访问：

1. <span class="pun">[</span><span class="pln">root@node1 </span><span class="pun">~]#</span><span class="kwd">ssh</span><span class="pln"> root@192</span><span class="pun">.</span><span class="lit">168.0</span><span class="pun">.</span><span class="lit">10</span>
2. <span class="typ">The</span><span class="pln"> authenticity of host </span><span class="str">'192.168.0.10 (192.168.0.10)'</span><span class="pln"> can</span><span class="str">'t be established.</span>
3. <span class="str">RSA key fingerprint is 6d:8f:63:9b:3b:63:e1:72:b3:06:a4:e4:f4:37:21:42.</span>
4. <span class="str">Are you sure you want to continue connecting (yes/no)? yes</span>
5. <span class="str">Warning: Permanently added '</span><span class="lit">192.168</span><span class="pun">.</span><span class="lit">0.10</span><span class="str">' (RSA) to the list of known hosts.</span>
6. <span class="str">root@192.168.0.10'</span><span class="pln">s password</span><span class="pun">:</span>
7. <span class="typ">Last</span><span class="kwd">login</span><span class="pun">:</span><span class="typ">Thu</span><span class="typ">Dec</span><span class="lit">10</span><span class="lit">22</span><span class="pun">:</span><span class="lit">04</span><span class="pun">:</span><span class="lit">55</span><span class="lit">2015</span><span class="kwd">from</span><span class="lit">192.168</span><span class="pun">.</span><span class="lit">0.1</span>
8. <span class="pun">[</span><span class="pln">root@node2 </span><span class="pun">~]#</span>

步骤二：

使用 ssh-key-gen 命令生成公钥和私钥，这里要注意的是可以对私钥进行加密保护以增强安全性。

1. <span class="pun">[</span><span class="pln">root@node1 </span><span class="pun">~]#</span><span class="kwd">ssh</span><span class="pun">-</span><span class="pln">keygen</span>
2. <span class="typ">Generating</span><span class="kwd">public</span><span class="pun">/</span><span class="kwd">private</span><span class="pln"> rsa key pair</span><span class="pun">.</span>
3. <span class="typ">Enter</span><span class="kwd">file</span><span class="kwd">in</span><span class="pln"> which to save the key </span><span class="pun">(</span><span class="str">/root/</span><span class="pun">.</span><span class="kwd">ssh</span><span class="pun">/</span><span class="pln">id_rsa</span><span class="pun">):</span>
4. <span class="typ">Enter</span><span class="pln"> passphrase </span><span class="pun">(</span><span class="kwd">empty</span><span class="kwd">for</span><span class="kwd">no</span><span class="pln"> passphrase</span><span class="pun">):</span>
5. <span class="typ">Enter</span><span class="pln"> same passphrase again</span><span class="pun">:</span>
6. <span class="typ">Your</span><span class="pln"> identification has been saved </span><span class="kwd">in</span><span class="pun">/</span><span class="pln">root</span><span class="pun">/.</span><span class="kwd">ssh</span><span class="pun">/</span><span class="pln">id_rsa</span><span class="pun">.</span>
7. <span class="typ">Your</span><span class="kwd">public</span><span class="pln"> key has been saved </span><span class="kwd">in</span><span class="pun">/</span><span class="pln">root</span><span class="pun">/.</span><span class="kwd">ssh</span><span class="pun">/</span><span class="pln">id_rsa</span><span class="pun">.</span><span class="pln">pub</span><span class="pun">.</span>
8. <span class="typ">The</span><span class="pln"> key fingerprint </span><span class="kwd">is</span><span class="pun">:</span>
9. <span class="pln">b4</span><span class="pun">:</span><span class="lit">51</span><span class="pun">:</span><span class="lit">7e</span><span class="pun">:</span><span class="lit">1e</span><span class="pun">:</span><span class="lit">52</span><span class="pun">:</span><span class="lit">61</span><span class="pun">:</span><span class="kwd">cd</span><span class="pun">:</span><span class="pln">fb</span><span class="pun">:</span><span class="pln">b2</span><span class="pun">:</span><span class="lit">98</span><span class="pun">:</span><span class="lit">4b</span><span class="pun">:</span><span class="pln">ad</span><span class="pun">:</span><span class="pln">a1</span><span class="pun">:</span><span class="lit">8b</span><span class="pun">:</span><span class="lit">31</span><span class="pun">:</span><span class="lit">6d</span><span class="pln"> root@node1</span><span class="pun">.</span><span class="pln">ehowstuff</span><span class="pun">.</span><span class="kwd">local</span>
10. <span class="typ">The</span><span class="pln"> key</span><span class="str">'s randomart image is:</span>
11. <span class="str">+--[ RSA 2048]----+</span>
12. <span class="str">| . ++ |</span>
13. <span class="str">| o o o |</span>
14. <span class="str">| o o o . |</span>
15. <span class="str">| . o + .. |</span>
16. <span class="str">| S . . |</span>
17. <span class="str">| . .. .|</span>
18. <span class="str">| o E oo.o |</span>
19. <span class="str">| = ooo. |</span>
20. <span class="str">| . o.o. |</span>
21. <span class="str">+-----------------+</span>

步骤三：

用 ssh-copy-id 命令将公钥复制或上传到远程主机，并将身份标识文件追加到节点2的 ~/.ssh/authorized_keys 中：

1. <span class="pun">[</span><span class="pln">root@node1 </span><span class="pun">~]#</span><span class="kwd">ssh</span><span class="pun">-</span><span class="pln">copy</span><span class="pun">-</span><span class="kwd">id</span><span class="pun">-</span><span class="pln">i </span><span class="pun">~</span><span class="str">/.ssh/</span><span class="pln">id_rsa</span><span class="pun">.</span><span class="pln">pub </span><span class="lit">192.168</span><span class="pun">.</span><span class="lit">0.10</span>
2. <span class="pln">root@192</span><span class="pun">.</span><span class="lit">168.0</span><span class="pun">.</span><span class="lit">10</span><span class="str">'s password:</span>
3. <span class="str">Now try logging into the machine, with "ssh '</span><span class="lit">192.168</span><span class="pun">.</span><span class="lit">0.10</span><span class="str">'", and check in:</span>
4. <span class="str">.ssh/authorized_keys</span>
5. <span class="str">to make sure we haven'</span><span class="pln">t added extra keys that you weren</span><span class="str">'t expecting.</span>

步骤四：

验证免密码 SSH 登录节点2：

1. <span class="pun">[</span><span class="pln">root@node1 </span><span class="pun">~]#</span><span class="kwd">ssh</span><span class="pln"> root@192</span><span class="pun">.</span><span class="lit">168.0</span><span class="pun">.</span><span class="lit">10</span>
2. <span class="typ">Last</span><span class="kwd">login</span><span class="pun">:</span><span class="typ">Sun</span><span class="typ">Dec</span><span class="lit">13</span><span class="lit">14</span><span class="pun">:</span><span class="lit">03</span><span class="pun">:</span><span class="lit">20</span><span class="lit">2015</span><span class="kwd">from</span><span class="pln"> www</span><span class="pun">.</span><span class="pln">ehowstuff</span><span class="pun">.</span><span class="kwd">local</span>

我希望这篇文章能帮助到你，为你提供 SSH 免密码登录 CentOS / RHEL 的基本认知和快速指南。

下面关于SSH相关的文章您也可能喜欢，不妨参考下：

原载: http://www.ehowstuff.com/ssh-login-without-password-centos/

作者：skytech 译者：fw8899 校对：wxy

本文由 LCTT 原创编译，Linux中国 荣誉推出