{"id":2423,"date":"2014-05-23T11:41:09","date_gmt":"2014-05-23T03:41:09","guid":{"rendered":"http:\/\/kuki.idv.tw\/?p=2423"},"modified":"2014-05-23T11:41:09","modified_gmt":"2014-05-23T03:41:09","slug":"%e8%bd%89ssh%e5%85%8d%e5%af%86%e7%a2%bc%e7%99%bb%e5%85%a5","status":"publish","type":"post","link":"https:\/\/www.kuki.idv.tw\/?p=2423","title":{"rendered":"[\u8f49]SSH\u514d\u5bc6\u78bc\u767b\u5165"},"content":{"rendered":"
\n
\n

\u4f86\u6e90:http:\/\/josephj.com\/article\/understand-ssh-key\/<\/strong><\/span><\/p>\n

\u95dc\u65bc SSH \u514d\u5bc6\u78bc\u767b\u5165\uff0c\u6211\u7684\u7b2c\u4e00\u7bc7\u5b78\u7fd2\u6587\u7ae0\u662f\u53c3\u8003 Tsung \u7684\u00a0ssh keygen \u514d\u8f38\u5165\u5bc6\u78bc<\/a>\u3002
\n\u4ed6\u7684\u6587\u7ae0\u5f88\u6dfa\u986f\u6613\u61c2\uff0c\u6211\u4f9d\u6a23\u756b\u846b\u8606\u5c31\u6210\u529f\u4e86\u3002
\n\u4f46\u554f\u984c\u662f\u516c\u53f8\u7684\u9650\u5236\u662f\u5fc5\u9700\u8981\u6709 passphrase\u3001Tsung \u7684\u6587\u7ae0\u4e26\u6c92\u6709\u89e3\u91cb\u6b64\u90e8\u4efd\u3001\u9020\u6210\u6211\u4e0d\u6253\u5bc6\u78bc\u4f46\u9084\u662f\u5f97\u6253 passphrase\u3002
\n\u6211\u6c7a\u5b9a\u82b1\u4e00\u4e9b\u6642\u9593\u628a\u9019\u500b\u539f\u7406\u5fb9\u5e95\u5f04\u61c2\uff0c\u4e26\u5beb\u6210\u4e00\u7bc7\u6587\u7ae0\u8ddf\u5927\u5bb6\u5206\u4eab\u3002<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n

\u4e00\u3001\u57fa\u672c\u6d41\u7a0b\u8aaa\u660e<\/h2>\n

1. \u79c1\u5bc6\u8207\u516c\u958b\u91d1\u9470<\/h3>\n

\u4ee5 SSH \u767b\u5165\u4efb\u4f55\u4e3b\u6a5f\u90fd\u5fc5\u9700\u8981\u6253\u5e33\u865f\u3001\u5bc6\u78bc\uff0c\u9664\u4e86\u4e0d\u65b9\u4fbf<\/span>\u3001\u53e6\u5916\u9084\u589e\u52a0\u4e86\u88ab\u7aca\u53d6\u7684\u98a8\u96aa<\/span>\uff08\u6709\u4e9b\u8edf\u9ad4\u5982 winscp \u662f\u53ef\u5132\u5b58\u7684\uff09\u3002
\n\u89e3\u6c7a\u7684\u65b9\u5f0f\u5c31\u662f\u4f7f\u7528\u91d1\u9470\u7522\u751f\u5668<\/span>\u4f86\u7522\u751f\u4e00\u7b46\u516c\u958b\u91d1\u9470<\/span>\uff08Public Key\uff09\u8207\u79c1\u5bc6\u91d1\u9470<\/span>\uff08Private Key\uff09\u5c0d\u61c9\u505a\u514d\u5bc6\u78bc\u7684\u767b\u5165\u3002
\n\u4f7f\u7528\u8005\u53ea\u9700\u5c07\u516c\u958b\u91d1\u9470\u7684\u5167\u5bb9\u9644\u52a0\u7cfb\u7d71\u4e0a\u7279\u5b9a\u7684\u6a94\u6848\u4e2d<\/span>\uff0c\u4ee5\u53ca\u5728\u81ea\u5df1\u7684\u74b0\u5883\u6307\u5b9a\u597d\u79c1\u5bc6\u91d1\u9470<\/span>\uff0c\u7cfb\u7d71\u5728\u767b\u5165\u6d41\u7a0b\u4e2d\u5373\u6703\u81ea\u52d5\u5c0d\u61c9\uff0c\u6b63\u78ba\u7121\u8aa4\u5373\u53ef\u767b\u5165\u3002
\n\u8b93\u6574\u500b\u767b\u5165\u6d41\u7a0b\u5feb\u901f\u4e14\u5b89\u5168\u3002<\/p>\n

2. \u91d1\u9470\u7a2e\u985e<\/h3>\n

\u4f46\u662f\u5c0d\u61c9\u4e26\u6c92\u6709\u60f3\u50cf\u4e2d\u9019\u9ebc\u7c21\u55ae\uff0c\u5c31\u50cf\u662f\u6728\u9580\u4e0a\u53ea\u80fd\u88dd\u5587\u5427\u9396\u800c\u7121\u6cd5\u88dd\u5927\u9396\uff0c\u4e0d\u540c\u7684\u4e3b\u6a5f\u6240\u80fd\u4f7f\u7528\u7684\u91d1\u9470\u6a5f\u5236\u4e5f\u6709\u6240\u4e0d\u540c<\/span>\uff1a
\nSSH \u6709 Protocol 1 \u53ca Protocol 2 \u5169\u7a2e\uff0c\u5e38\u898b\u91d1\u9470\u7de8\u78bc\u6a5f\u5236\u5247\u6709 RSA1\u3001RSA2\u3001\u4ee5\u53ca DSA \u7b49\u4e09\u7a2e\u3002<\/p>\n

3. \u4fdd\u8b77\u91d1\u9470\u7684\u63aa\u65bd<\/h3>\n

\u800c\u53e6\u5916\u4e00\u500b\u554f\u984c\uff0c\u5982\u679c\u6709\u4eba\u62ff\u5230\u4e86\u4f60\u7684\u79c1\u5bc6\u91d1\u9470\uff0c\u5c31\u76f8\u7576\u65bc\u4ed6\u53ef\u4ee5\u5728\u4f60\u7684\u4e3b\u6a5f\u70ba\u6240\u6b32\u70ba\u3002
\n\u4fdd\u8b77\u7684\u63aa\u65bd\u5c31\u662f\u4f7f\u7528\u00a0Passphrase<\/span>\uff08\u4e5f\u53ef\u4ee5\u4e0d\u8a2d\uff09\u3001\u79c1\u5bc6\u91d1\u9470\u7684\u5bc6\u78bc\uff0c\u6bcf\u6b21\u8981\u7528\u6642\u5c31\u5f97\u8f38\u5165\u3002<\/p>\n

4. Agent \u6a5f\u5236<\/h3>\n

\u6709 Passphrase \u4fdd\u8b77\u7576\u7136\u662f\u5b89\u5168\u591a\u4e86\uff0c\u4f46\u539f\u672c\u60f3\u7528\u91d1\u9470\u7684\u597d\u8655\u5c31\u662f\u53ef\u4ee5\u7701\u53bb\u6bcf\u6b21\u6253\u5bc6\u78bc\u7684\u6b65\u9a5f\uff0c
\n\u73fe\u5728\u82e5\u6bcf\u6b21\u53c8\u5f97\u6253 Passphrase\uff0c\u9019\u6a23\u7684\u597d\u8655\u5c31\u6c92\u6709\u4e86\uff0c\u53ef\u80fd\u9084\u5f97\u591a\u8a18\u4e00\u5957\u5bc6\u78bc\u3001\u589e\u52a0\u6253\u932f\u7684\u53ef\u80fd\u6027\u3002
\n\u9084\u597d\u6709 Agent \u6a5f\u5236\uff0c\u4ed6\u76f8\u7576\u662f\u4f60\u7684\u7ba1\u5bb6<\/span>\u3001\u6211\u5011\u53ea\u8981\u628a\u9470\u5319\u53ca Passphrase \u8acb\u4ed6\u4fdd\u7ba1<\/span>\uff0c\u5728\u767b\u5165\u4e3b\u6a5f\u6642\u4ed6\u5c31\u6703\u5e6b\u4f60\u89e3\u6c7a\u8f38\u5165 Passphrase \u7684\u554f\u984c<\/span>\u3002<\/p>\n

 <\/p>\n<\/div>\n

\n

\u4e8c\u3001\u4e00\u6b65\u4e00\u6b65\u6559\u5230\u6703<\/h2>\n

\u4ee5\u4e0b\u5c31\u53ea\u91dd\u5c0d Mac OSX \u53ca *nix \u7cfb\u7d71\u505a\u4ecb\u7d39\uff08\u82e5\u4f60\u662f\u4f7f\u7528 Windows \u4e2d\u7684 PuTTY\uff0c\u8acb\u5148\u505a\u5b8c\u6b65\u9a5f\u4e00\u8207\u4e8c\uff0c\u518d\u770b\u9019\u88e1<\/a>\uff09\uff1a<\/p>\n

<\/a>\u6b65\u9a5f 1. \u7522\u751f\u91d1\u9470<\/h3>\n

\u5728 Command Line \u4e2d\u4f60\u53ef\u4ee5\u4f7f\u7528 ssh-keygen \u4f86\u7522\u751f\u5404\u7a2e\u985e\u7684\u91d1\u9470\uff0c\u800c\u6211\u4e5f\u6703\u9f13\u52f5\u5927\u5bb6\u4e00\u6b21\u628a\u4e09\u7a2e\u91d1\u9470\u7522\u751f\u597d<\/span>\uff0c\u7701\u5f97\u78b0\u5230\u4e0d\u540c\u7cfb\u7d71\u9ebb\u7169\u3002<\/p>\n

a. \u7522\u751f RSA 1 \u91d1\u9470<\/h4>\n

\u9019\u7a2e\u91d1\u9470\u662f\u7d66\u6bd4\u8f03\u820a\u7684\u7cfb\u7d71\uff0c\u4f8b\u5982 FreeBSD 4 \u53ca\u4ee5\u524d\u7684\u7248\u672c\u3001\u662f\u8d70 SSH Protocol 1 \u7684\uff0c\u6700\u597d\u5c31\u4f7f\u7528 RSA 1 \u9019\u7a2e\u91d1\u9470<\/p>\n

$ ssh-keygen -t rsa1<\/span>
\nGenerating RSA keys: Key generation complete.
\nEnter file in which to save the key ($HOME\/.ssh\/identity): [\u6309 Enter \u4f7f\u7528\u9810\u8a2d\u503c\uff08\u5efa\u8b70\uff09]
\nEnter passphrase: \u8f38\u5165\u4f60\u7684 Passphrase<\/span> [\u5efa\u8b70\u8981\u4f7f\u7528 passphrase\uff0c\u6700\u5c11 9 \u78bc]
\nEnter same passphrase again: \u518d\u4e00\u6b21\u8f38\u5165\u4f60\u7684 Passphrase<\/span>
\nYour identification has been saved in \/home\/username\/.ssh\/identity.
\nYour public key has been saved in \/home\/username\/.ssh\/identity.pub.
\nThe key fingerprint is: 6c:96:8c:a8:86:1b:3b:eb:1b:48:8d:3d:8d:c1:4f:dc username@abc.com
\n<\/code><\/p>\n

b. \u7522\u751f RSA 2 \u91d1\u9470<\/h4>\n

\u6bd4\u8f03\u65b0\u7684\u7cfb\u7d71\uff0c\u5982 FreeBSD 5 \u53ca\u4e4b\u5f8c\u7248\u672c\u6216 Linux\uff0c\u7528 RSA 2 \u6216 DSA \u9019\u5169\u7a2e\u91d1\u9470<\/p>\n

$ ssh-keygen -t rsa<\/span>
\nGenerating public\/private rsa key pair.
\nEnter file in which to save the key (\/home\/username\/.ssh\/id_rsa): [\u6309 Enter \u4f7f\u7528\u9810\u8a2d\u503c\uff08\u5efa\u8b70\uff09]
\nEnter passphrase: \u8f38\u5165\u4f60\u7684 Passphrase<\/span>
\nEnter same passphrase again: \u518d\u4e00\u6b21\u8f38\u5165\u4f60\u7684 Passphrase<\/span>
\nYour identification has been saved in \/home\/username\/.ssh\/id_rsa.
\nYour public key has been saved in \/home\/username\/.ssh\/id_rsa.pub.
\nThe key fingerprint is: cc:e8:a9:da:a3:41:c6:a9:97:52:59:ef:0c:cf:45:b6 username@abc.com <\/code><\/p>\n

c. \u7522\u751f DSA \u91d1\u9470<\/h4>\n

$ ssh-keygen -t dsa<\/span>
\nGenerating public\/private dsa key pair.
\nEnter file in which to save the key (\/home\/username\/.ssh\/id_dsa): [\u6309 Enter \u4f7f\u7528\u9810\u8a2d\u503c\uff08\u5efa\u8b70\uff09]
\nEnter passphrase: \u8f38\u5165\u4f60\u7684 Passphrase<\/span>
\nEnter same passphrase again: \u518d\u4e00\u6b21\u8f38\u5165\u4f60\u7684 Passphrase<\/span>
\nYour identification has been saved in \/home\/username\/.ssh\/id_dsa.
\nYour public key has been saved in \/home\/username\/.ssh\/id_dsa.pub.
\nThe key fingerprint is: cc:e8:a9:da:a3:41:c6:a9:97:52:59:ef:0c:cf:45:b6 username@abc.com <\/code>\u7d93\u904e\u9019\u6a23\u7684\u7a0b\u5e8f\uff0c\u6211\u5011\u7e3d\u5171\u6703\u6709\u516c\u79c1\u9470\u5171\u4e09\u5c0d\uff1aRSA1 ( identity.pub \/ identity )\u3001RSA2 ( id_rsa.pub \/ id_rsa )\u3001\u53ca ( id_dsa.pub \/ id_rsa )\u3002<\/p>\n

\u6211\u904e\u53bb\u6709\u4e00\u500b\u932f\u8aa4\u7684\u89c0\u5ff5\uff0c\u4ee5\u70ba\u91d1\u9470\u662f\u5c0d\u61c9\u7cfb\u7d71\u7684\uff0c\u6240\u4ee5\u5728\u5c0d\u6bcf\u4e00\u53f0\u4e3b\u6a5f\u5f97\u53e6\u5916\u7522\u751f\u4e00\u6b21\u3002
\n\u4e8b\u5be6\u4e0a\u5982\u679c\u6c92\u6709\u7279\u6b8a\u9700\u6c42\uff0c\u4f60\u53ef\u4ee5\u53ea\u7528\u4e00\u4efd\u3001\u7528\u4efb\u4e00\u7cfb\u7d71\u7522\u751f\u3001\u4e26\u628a\u9019\u4e00\u4efd\u7d66\u4fdd\u5b58\u597d\u5373\u53ef<\/span>\u3002\u5e0c\u671b\u5927\u5bb6\u4e0d\u8981\u8ddf\u6211\u6709\u4e00\u6a23\u7684\u932f\u8aa4\u56c9\uff01<\/p>\n

\u6b65\u9a5f 2. \u5c07\u516c\u958b\u91d1\u9470\u653e\u5230\u4e3b\u6a5f<\/h3>\n

\u4f60\u73fe\u5728\u5728\u81ea\u5df1\u7684\u6a5f\u5668\u4e0a\u5df2\u7d93\u6709\u4e86\u4e09\u5c0d\u91d1\u9470\uff0c\u63a5\u4e0b\u4f86\u6211\u5011\u8981\u628a\u516c\u958b\u7684\u4e09\u96bb (*.pub) \u653e\u5230\u6211\u5011\u8981\u767b\u5165\u7684\u4e3b\u6a5f\u4e0a\u3002<\/p>\n

$ scp ~\/.ssh\/*.pub \u4f60\u6b32\u767b\u5165\u7684\u4e3b\u6a5f<\/span>:~\/.ssh\/. <\/code>\u63a5\u8457\u767b\u5165\u8a72\u7cfb\u7d71\uff0c\u5728\u6c92\u8a2d\u5b9a\u597d\u4e4b\u524d\u7576\u7136\u9084\u662f\u5f97\u4e56\u4e56\u6253\u5bc6\u78bc<\/p>\n

$ ssh \u4f60\u6b32\u767b\u5165\u7684\u4e3b\u6a5f<\/span> <\/code>\u7cfb\u7d71\u9810\u8a2d\u8655\u7406\u653e\u7f6e\u516c\u9470\u7684\u6a94\u6848\u53eb\u505a\u00a0authorized_keys<\/span>\uff0c\u6240\u4ee5\u6211\u5011\u8981\u628a\u525b\u525b\u6240\u50b3\u7684\u516c\u9470\u9644\u52a0\u5230\u9019\u500b\u6a94\u6848\u4e2d\uff1a<\/p>\n

$ cat ~\/.ssh\/identity.pub >> ~\/.ssh\/authorized_keys
\n$ cat ~\/.ssh\/id_rsa.pub >> ~\/.ssh\/authorized_keys
\n$ cat ~\/.ssh\/id_dsa.pub >> ~\/.ssh\/authorized_keys
\n$ chmod 711 ~\/.ssh
\n$ chmod 644 ~\/.ssh\/authorized_keys <\/code>\u5982\u679c\u6c92\u6709\u610f\u5916\uff0c\u4f60\u767b\u51fa\u518d\u767b\u5165\u4e3b\u6a5f\uff0c\u5c31\u6703\u770b\u5230\u5b83\u8acb\u4f60\u8f38\u5165 Passphrase \u7684\u8a0a\u606f\u3002<\/p>\n

\u6b65\u9a5f 3. \u8a2d\u5b9a ssh-agent<\/h3>\n

\u524d\u9762\u6240\u63d0\u5230\uff0c\u6bcf\u6b21\u90fd\u8981\u6253 Passphrase \u5c31\u592a\u9ebb\u7169\u4e86\uff0c\u6240\u4ee5\u9019\u88e1\u8981\u8a2d\u5b9a\u7ba1\u5bb6\u00a0ssh-agent<\/span>\u3001\u4ee5\u4fdd\u7ba1\u79c1\u9470\u53ca Passphrase\u3002
\n\u5728\u4f60\u6bcf\u6b21\u555f\u52d5 shell \u5f8c\uff0c\u8acb\u7167\u9019\u6a23\u7684\u65b9\u5f0f\u4f86\u505a\uff1a<\/p>\n

a. \u555f\u52d5 ssh-agent<\/h4>\n

$ eval `ssh-agent -s` <\/code><\/p>\n

b. \u5c07\u79c1\u5bc6\u91d1\u9470\u4ea4\u7d66 ssh-agent \u4fdd\u7ba1\uff1assh-add<\/h4>\n

\u6211\u5011\u5c07\u8981\u7528\u00a0ssh-add<\/span>\u00a0\u4f86\u6307\u5b9a\u91d1\u9470\uff0c\u5982\u679c\u4f60\u90fd\u7167\u4e0a\u9762\u653e\u9810\u8a2d\u7684\u4f4d\u7f6e\u53ca\u76f8\u540c\u7684\u6a94\u540d\uff0c\u90a3\u5c31\u4e0d\u7528\u6709\u4efb\u4f55\u7684\u53c3\u6578\u3002<\/p>\n

$ ssh-add <\/code>\u63a5\u8457\u6703\u8981\u6c42\u4f60\u8a2d\u5b9a\u8f38\u5165 passphrase\uff0c\u5982\u679c\u4e09\u500b\u90fd\u4e00\u6a23\uff0c\u5c31\u53ea\u8981\u6253\u4e00\u6b21\u3002<\/p>\n

Enter passphrase for \/home\/username\/.ssh\/id_rsa:\u4f60\u7684 Passphrase<\/span>
\nIdentity added: \/home\/username\/.ssh\/id_rsa (\/home\/username\/.ssh\/id_rsa)
\nIdentity added: \/home\/username\/.ssh\/id_dsa (\/home\/username\/.ssh\/id_dsa)
\nIdentity added: \/home\/username\/.ssh\/identity (username@username.com) <\/code>\u63a5\u8457\u518d\u8a66\u770b\u770b\u767b\u5165\u5df2\u7d93\u653e\u597d\u516c\u9470\u7684\u4e3b\u6a5f\uff0c\u61c9\u8a72\u5c31\u53ef\u4ee5\u4e0d\u7528\u5bc6\u78bc\u767b\u5165\u4e86\uff01<\/p>\n

c. \u81ea\u52d5\u5316\u6d41\u7a0b<\/h4>\n

\u5982\u679c\u6bcf\u6b21\u9032 Shell \u90fd\u8981\u505a a\u3001b \u52d5\u4f5c\uff0c\u53ef\u80fd\u9084\u662f\u592a\u9ebb\u7169\u4e14\u5fd8\u8a18\uff0c\u4e5f\u56e0\u6b64\u6211\u53bb\u627e\u4e86\u53ef\u4ee5\u653e\u5728 .bash_profile \u7684 script (\u00a0Joseph M. Reagle Jr<\/a><\/cite>\u00a0)\uff0c
\n\u4e00\u9032\u5165 Shell \u5c31\u6703\u628a\u8a72\u505a\u7684\u52d5\u4f5c\u505a\u597d\uff0c\u4e14\u8a62\u554f\u4f60 Passphrase\uff1a SH_ENV=\"$HOME\/.ssh\/environment\"<\/p>\n

function start_agent {
\necho \"Initialising new SSH agent...\"
\n\/usr\/bin\/ssh-agent | sed 's\/^echo\/#echo\/' > \"${SSH_ENV}\"
\necho succeeded
\nchmod 600 \"${SSH_ENV}\"
\n. \"${SSH_ENV}\" > \/dev\/lull
\n\/usr\/bin\/ssh-add;
\n}<\/p>\n

# Source SSH settings, if applicable<\/p>\n

if [ -f \"${SSH_ENV}\" ]; then
\n. \"${SSH_ENV}\" > \/dev\/null
\n#ps ${SSH_AGENT_PID} doesn\u2019t work under cywgin
\nps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > \/dev\/null || {
\nstart_agent;
\n}
\nelse
\nstart_agent;
\nfi
\n<\/code><\/p>\n<\/div>\n

\n

\u4e09\u3001\u516c\u79c1\u9470\u6240\u9700\u653e\u7684\u6a5f\u5668<\/h2>\n

\u6211\u7684\u6b78\u7d0d\u662f\uff0c\u5728\u672c\u6a5f<\/span>\u4e0a\u4f60\u5fc5\u9700\u4e00\u76f4\u4fdd\u6709\u9019\u5169\u4efd\u4ee5\u4fbf\u5f8c\u7e8c\u7684\u518d\u88fd<\/span>\u3002\u800c\u516c\u9470\u6574\u7406\u6210 authorized_keys\uff0c\u4ee5\u5f8c\u6709\u65b0\u6a5f\u5668\u9700\u8981\u767b\u5165\u6642\u4e00\u5f8b\u50b3\u6b64\u6a94\u6848\u4e0a\u53bb\u505a\u9644\u52a0<\/span>\u3002<\/p>\n

\u800c\u9664\u4e86\u672c\u6a5f\u5916\uff0c\u90a3\u4e9b\u6a5f\u5668\u9700\u8981\u653e\u79c1\u9470\u5462\uff1f\u6211\u7684\u60c5\u6cc1\u662f\u6700\u5e38\u7528\u7684\u90a3\u53f0\u958b\u767c\u6a5f<\/span>\uff0c\u56e0\u70ba\u4f60\u53ef\u80fd\u6703\u5229\u7528\u4ed6\u53bb SSH \u5176\u5b83\u53f0\u6a5f\u5668\u3002\u4e0d\u7136\u7684\u8a71\uff0c\u61c9\u8a72\u6e1b\u5c11\u79c1\u9470\u7684\u5b58\u653e\u5730\u9ede\uff0c\u4ee5\u6c42\u5b89\u5168<\/span>\u3002<\/p>\n<\/div>\n

\n

\u56db\u3001\u5ef6\u4f38\u95b1\u8b80<\/h2>\n