9.2.2 安全密钥验证

加密是对信息进行编码和解码的技术，它通过一定的算法（密钥）将原本可以直接阅读的明文信息转换成密文形式。密钥即是密文的钥匙，有私钥和公钥之分。在传输数据时，如果担心被他人监听或截获，就可以在传输前先使用公钥对数据加密处理，然后再行传送。这样，只有掌握私钥的用户才能解密这段数据，除此之外的其他人即便截获了数据，一般也很难将其破译为明文信息。

一言以蔽之，在生产环境中使用密码进行口令验证终归存在着被暴力破解或嗅探截获的风险。如果正确配置了密钥验证方式，那么sshd服务程序将更加安全。我们下面进行具体的配置，其步骤如下。

第1步：在客户端主机中生成“密钥对”。

    [root@linuxprobe ~]# ssh-keygen
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):按回车键或设置密钥的存储路径
    Created directory '/root/.ssh'.
    Enter passphrase (empty for no passphrase):直接按回车键或设置密钥的密码
    Enter same passphrase again:再次按回车键或设置密钥的密码
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    The key fingerprint is:
    40:32:48:18:e4:ac:c0:c3:c1:ba:7c:6c:3a:a8:b5:22 root@linuxprobe.com
    The key's randomart image is:
    +--[ RSA 2048]----+
    |+*..o .          |
    |*.o  +           |
    |o*    .          |
    |+ .    .         |
    |o..     S        |
    |.. +             |
    |. =              |
    |E+ .             |
    |+.o              |
    +-----------------+

    

第2步：把客户端主机中生成的公钥文件传送至远程主机：

    [root@linuxprobe ~]# ssh-copy-id 192.168.10.10
    The authenticity of host '192.168.10.20 (192.168.10.10)' can't be established.
    ECDSA key fingerprint is 4f:a7:91:9e:8d:6f:b9:48:02:32:61:95:48:ed:1e:3f.
    Are you sure you want to continue connecting (yes/no)? yes
    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
    /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
    root@192.168.10.10's password:此处输入远程服务器密码
    Number of key(s) added: 1
    Now try logging into the machine, with: "ssh '192.168.10.10'"
    and check to make sure that only the key(s) you wanted were added.

第3步：对服务器进行设置，使其只允许密钥验证，拒绝传统的口令验证方式。记得在修改配置文件后保存并重启sshd服务程序。

    [root@linuxprobe ~]# vim /etc/ssh/sshd_config 
     ………………省略部分输出信息………………
     74 
     75 # To disable tunneled clear text passwords, change to no here!
     76 #PasswordAuthentication yes
     77 #PermitEmptyPasswords no
     78 PasswordAuthentication no
     79 
     ………………省略部分输出信息………………
    [root@linuxprobe ~]# systemctl restart sshd

第4步：在客户端尝试登录到服务器，此时无须输入密码也可成功登录。

    [root@linuxprobe ~]# ssh 192.168.10.10
    Last login: Mon Apr 13 19:34:13 2017