centos7下安全访问远程服务器

1. 添加普通账号

众所周知，linux下的root拥有最高权限，可以执行任何命令。在使用root身份操作时，有时的一个不注意就可能将非常重要的删除（最可怕的是 rm -rf /）。而linux不像windows有可以撤销的回收箱，。所以建议建立普通用户账号，在平时的时候以普通用户身份登录，只在需要root权限时才通过sudo 临时提高普通用户的权限或是通过su - 切换到root用户，执行完任务后立刻exit。

新建普通用户，用户名以example_user 为例

useradd example_user && passwd example_user
# 将对应的用户加入wheel组，wheel组用于sudo权限
usermod -aG wheel example_user

2. 创建ssh登录时进行身份验证的密钥对

假设有以下情景，有3台主机:

• node3    ip: 192.168.35.120
• node4    ip:  192.168.35.130
• node5    ip: 192.168.35.140

node3上的用户root 想通过私钥 有密码登录node4,无密码登录node5

# 配置密码登录 node4
# 产生4096位的rsa密钥对
[root@node3 .ssh]# ssh-keygen -b
Generating public/private rsa key pair.
# 指定存储路径
Enter file in which to save the key (/root/.ssh/id_rsa): /root/.ssh/node4_id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/node4_id_rsa.
Your public key has been saved in /root/.ssh/node4_id_rsa.pub.

# 将公钥发给node4主机，追加在 root用户的~/.ssh/authorized_keys文件末尾
[root@node3 .ssh]# ssh-copy-id -i /root/.ssh/node4_id_rsa.pub root@node4
The authenticity of host 'node4 (192.168.35.130)' can't be established.
ECDSA key fingerprint is a7::be::f5:b5::1f:ce::ea:6d:df:e2:1a:.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO:  key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@node4's password: 

Number of key(s) added: 

Now try logging into the machine, with:   "ssh 'root@node4'"
and check to make sure that only the key(s) you wanted were added.

# 远程登录
[root@node3 .ssh]# ssh -i ~/.ssh/node4_id_rsa root@node4
Enter passphrase for key '/root/.ssh/node4_id_rsa':
Last login: Fri Sep  ::  from 192.168.35.1

# 配置无密码登录node5
[root@node3 .ssh]# ssh-keygen -b
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): /root/.ssh/node5_id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/node5_id_rsa.
Your public key has been saved in /root/.ssh/node5_id_rsa.pub.
The key fingerprint is:
:ef::a2::f1:::af:bf:::a7:7d:ed:2b root@node3

[root@node3 .ssh]# ssh-copy-id -i ~/.ssh/node5_id_rsa.pub root@node5
The authenticity of host 'node5 (192.168.35.140)' can't be established.
ECDSA key fingerprint is a7::be::f5:b5::1f:ce::ea:6d:df:e2:1a:.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO:  key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@node5's password: 

Number of key(s) added: 

Now try logging into the machine, with:   "ssh 'root@node5'"
and check to make sure that only the key(s) you wanted were added.

[root@node3 .ssh]# ssh -i ~/.ssh/node5_id_rsa root@node5
Last login: Fri Sep  ::  from 192.168.35.1

除了ssh-copy-id,还可以通过下面的方法进行公钥的上传

Step1: 通过ssh远程登录

ssh 用户名@ip地址远程登录

Step 2:  通过文件上传工具如filezilla，或是直接通过命令rz(通过yum install lrzsz安装)上传公钥 xxx.pub

Step 3:  将公钥以追加的形式写入authorized_keys文件中（该文件可以记录多个公钥信息）

cat xxx.pub >> ~/.ssh/authorized_keys

Step4 : 文件权设置

# chmod  ~/.ssh
# chdmo  ~/.ssh/authorized_keys 

注意，此时仍能通过密码进行登录

[root@node3 .ssh]# ssh root@node4
root@node4's password:
Last login: Fri Sep  ::  from node3
[root@node4 ~]# 

3. 修改配置文件，禁止密码登录

修改配置文件 /etc/ssh/sshd_config

# 禁止使用root身份进行远程登录,建议使用普通用户身份登录[可根据实际情况]
PermitRootLogin no
# 取消密码验证登录
PasswordAuthentication no

然后重启服务即可

sudo service sshd restart

测试效果如下:

# 普通用户可以通过私钥登录
[alex@node3 ~]$ ssh alex@node4
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[alex@node3 ~]$ ssh -i ~/.ssh/node4_id_rsa alex@node4
Last login: Sat Sep  ::
[alex@node4 ~]$ exit
logout
Connection to node4 closed.

[alex@node3 ~]$ su -
Password:
Last login: Sat Sep  :: CST  on pts/
# root无法登录
[root@node3 ~]# ssh root@node4
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[root@node3 ~]# ssh -i ~/.ssh/node4_id_rsa root@node4
Enter passphrase for key '/root/.ssh/node4_id_rsa':
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

参考:

• https://www.linode.com/docs/security/securing-your-server/