Различия

Показаны различия между двумя версиями страницы.

--- ssh-gen [2016/02/16 08:51] – mirocow
+++ ssh-gen [2018/01/04 19:29] (текущий) – [Генерация ключа / ssh-gen] mirocow
@@ Строка 1: / Строка 1: @@
-{{tag>ssh shell generate authorized_keys authorized_keys id_rsa id_dsa}}
+{{tag>ssh shell generate authorized_keys authorized_keys id_rsa id_dsa unix linux}}
 ====== Генерация ключа / ssh-gen ======
-  ssh-keygen -t rsa -C "admin@d7.debian.loc"
+<code bash>ssh-keygen -t rsa -c "admin@d7.debian.loc"
-  ssh-keygen -t dsa -C "admin@d7.debian.loc"
+ssh-keygen -t dsa -c "admin@d7.debian.loc"
-  $ cat ~/.ssh/id_rsa.pub | ssh user@hostname "cat >> ~/.ssh/authorized_keys"
-  $ ssh user@hostname
+$ cat ~/.ssh/id_rsa.pub | ssh user@hostname "cat >> ~/.ssh/authorized_keys"
-  $ sudo sed -i "s/^\#RSAAuthentication.*$/RSAAuthentication yes/g" /etc/ssh/sshd_config
-  $ sudo sed -i "s/^\#PubkeyAuthentication.*$/PubkeyAuthentication yes/g" /etc/ssh/sshd_config
+$ ssh user@hostname
-  $ sudo /etc/init.d/sshd restart
+$ sudo sed -i "s/^\#RSAAuthentication.*$/RSAAuthentication yes/g" /etc/ssh/sshd_config
+$ sudo sed -i "s/^\#PubkeyAuthentication.*$/PubkeyAuthentication yes/g" /etc/ssh/sshd_config
+$ sudo /etc/init.d/sshd restart
+</code>
+  * **-b** - устанавливает количество бит в ключе/длина ключа 2048, 4096
+  * **-t** - Тип сгенерированного ключа (доступно: rsa, dsa etc)
+  * **-c** - Комментарий к кдючу
 ===== Генерация ключа локально =====
@@ Строка 113: / Строка 117: @@
+===== Копирование ключа на удаленный хост ssh-copy-id =====
+<code bash>$ ssh-copy-id -i ~/.ssh/id_rsa.pub root@remote-host</code>
+  * remote-host - IP или DNS
+  * -i указываем тип передаваемого ключа на удаленный хост (~/.ssh/id_rsa.pub или ~/.ssh/id_dsa.pub)
 ===== Альтернатива – скрипт ssh-copy-id =====
-  #!/bin/sh
+<code bash>
+#!/bin/sh
-  KEY="$HOME/.ssh/id_dsa.pub"
+KEY="$HOME/.ssh/id_dsa.pub"
-  if [ ! -f ~/.ssh/id_dsa.pub ];then
+if [ ! -f ~/.ssh/id_dsa.pub ];then
-      echo "private key not found at $KEY"
+  echo "private key not found at $KEY"
-      echo "* please create it with "ssh-keygen -t dsa" *"
+  echo "* please create it with "ssh-keygen -t dsa" *"
-      echo "* to login to the remote host without a password, don't give the key you create with ssh-keygen a password! *"
+  echo "* to login to the remote host without a password, don't give the key you create with ssh-keygen a password! *"
-      exit
+  exit
-  fi
+fi
-  if [ -z $1 ];then
+if [ -z $1 ];then
-      echo "Please specify user@host.tld as the first switch to this script"
+  echo "Please specify user@host.tld as the first switch to this script"
-      exit
+  exit
-  fi
+fi
-  echo "Putting your key on $1... "
+echo "Putting your key on $1... "
-  KEYCODE=`cat $KEY`
+KEYCODE=`cat $KEY`
-  ssh -q $1 "mkdir ~/.ssh 2>/dev/null; chmod 700 ~/.ssh; echo "$KEYCODE" >> ~/.ssh/authorized_keys; chmod 644 ~/.ssh/authorized_keys"
+ssh -q $1 "mkdir ~/.ssh 2>/dev/null; chmod 700 ~/.ssh; echo "$KEYCODE" >> ~/.ssh/authorized_keys; chmod 644 ~/.ssh/authorized_keys"
-  echo "done!"
+echo "done!"
+</code>
 ====== FAQ ======
@@ Строка 143: / Строка 155: @@
   ChallengeResponseAuthentication no
+Не принимаются dsa ключи
+<note tip>В свете недавно выявленных угроз, новая версия openssh-7.0p1 прекращает использование ключей ssh-dss , также известных как DSA. Детали см. в новостях проекта [[http://lists.mindrot.org/pipermail/openssh-unix-announce/2015-August/000122.html|openssh]].</note>
 ==== Отладка подключения ====