腾讯云CVM之间配置免密钥登录

背景：

1客户A和B俩台主机之间需要实现免密钥登录，已绑定腾讯云申请的密钥对

系统：centos7.3

A:192.168.0.100

B:192.168.0.84

A主机的私钥文件：aaa

B主机的私钥文件：bbb

公钥文件：authorized_keys

/etc/ssh/sshd.conf文件修改参数，前面有“#”注释符的需要去掉

HostKey /etc/ssh/ssh_host_rsa_key

RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile      .ssh/authorized_keys

PasswordAuthentication no

参考sshd_config配置文件，注意系统版本，不适用centos6.x版本，修改配置文件前做好备份

 #    $OpenBSD: sshd_config,v 1.93 // :: djm Exp $

 # This is the sshd server system-wide configuration file.  See
 # sshd_config() for more information.

 # This sshd was compiled with PATH=/usr/local/bin:/usr/bin

 # The strategy used for options in the default sshd_config shipped with
 # OpenSSH is to specify options with their default value where
 # possible, but leave them commented.  Uncommented options override the
 # default value.

 # If you want to change the port on a SELinux system, you have to tell
 # SELinux about this change.
 # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
 #
 #Port
 #AddressFamily any
 #ListenAddress 192.168.0.100
 #ListenAddress 192.168.0.100

 # The default requires explicit activation of protocol
 #Protocol 

 # HostKey for protocol version
 #HostKey /etc/ssh/ssh_host_key
 # HostKeys for protocol version
 HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_dsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key

 # Lifetime and size of ephemeral version  server key
 #KeyRegenerationInterval 1h
 #ServerKeyBits 

 # Ciphers and keying
 #RekeyLimit default none

 # Logging
 # obsoletes QuietMode and FascistLogging
 #SyslogFacility AUTH
 SyslogFacility AUTHPRIV
 #LogLevel INFO

 # Authentication:

 #LoginGraceTime 2m
 #PermitRootLogin yes
 #StrictModes yes
 #MaxAuthTries
 #MaxSessions 

 RSAAuthentication yes
 PubkeyAuthentication yes

 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
 # but this is overridden so installations will only check .ssh/authorized_keys
 AuthorizedKeysFile    .ssh/authorized_keys

 #AuthorizedPrincipalsFile none

 #AuthorizedKeysCommand none
 #AuthorizedKeysCommandUser nobody

 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 #RhostsRSAAuthentication no
 # similar for protocol version
 #HostbasedAuthentication no
 # Change to yes if you don't trust ~/.ssh/known_hosts for
 # RhostsRSAAuthentication and HostbasedAuthentication
 #IgnoreUserKnownHosts no
 # Don't read the user's ~/.rhosts and ~/.shosts files
 #IgnoreRhosts yes

 # To disable tunneled clear text passwords, change to no here!
 #PasswordAuthentication no
 #PermitEmptyPasswords no
 PasswordAuthentication no

 # Change to no to disable s/key passwords
 #ChallengeResponseAuthentication yes
 ChallengeResponseAuthentication no

 # Kerberos options
 #KerberosAuthentication no
 #KerberosOrLocalPasswd yes
 #KerberosTicketCleanup yes
 #KerberosGetAFSToken no
 #KerberosUseKuserok yes

 # GSSAPI options
 GSSAPIAuthentication yes
 GSSAPICleanupCredentials no
 #GSSAPIStrictAcceptorCheck yes
 #GSSAPIKeyExchange no
 #GSSAPIEnablek5users no

 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will
 # be allowed through the ChallengeResponseAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via ChallengeResponseAuthentication may bypass
 # the setting of "PermitRootLogin without-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and ChallengeResponseAuthentication to 'no'.
 # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
 # problems.
 UsePAM yes

 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
 #GatewayPorts no
 X11Forwarding yes
 #X11DisplayOffset
 #X11UseLocalhost yes
 #PermitTTY yes
 #PrintMotd yes
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
 UsePrivilegeSeparation sandbox        # Default for new installations.
 #PermitUserEnvironment no
 #Compression delayed
 #ClientAliveInterval
 #ClientAliveCountMax
 #ShowPatchLevel no
 UseDNS no
 #PidFile /var/run/sshd.pid
 #MaxStartups ::
 #PermitTunnel no
 #ChrootDirectory none
 #VersionAddendum none

 # no default banner path
 #Banner none

 # Accept locale-related environment variables
 AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
 AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
 AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
 AcceptEnv XMODIFIERS

 # override default of no subsystems
 Subsystem    sftp    /usr/libexec/openssh/sftp-server

 # Example of overriding settings on a per-user basis
 #Match User anoncvs
 #    X11Forwarding no
 #    AllowTcpForwarding no
 #    PermitTTY no
 #    ForceCommand cvs server

操作步骤

1.首先把aaa和bbb私钥文件分别上传到A主机和B主机上的/root/.ssh/目录中（上传可以安装lrzsz工具，直接拖文件到服务器即可）

A主机：

B：主机

2.将A主机中的authorized_keys中的公钥拷贝到B主机的authorized_keys文件中

将B主机中的authorized_keys中的公钥保存的A主机的authorized_keys文件中

A主机的authorized_keys文件

B主机的authorized_keys文件

3.将A主机和B主机的私钥文件分别修改为id_rsa

A主机.ssh/目录下的内容

mv /root/.ssh/aaa /root/.ssh/id_rsa

B主机.ssh/目录下的内容

mv /root/.ssh/aaa /root/.ssh/id_rsa

4.分别在A主机和B主机上执行下面授权操作

chmod 700 ~/.ssh/
chmod 600 ~/.ssh/authorized_keys

chmod 600 ~/.ssh/id_rsa

最后来验证

A主机远程B主机：

B主机远程A主机