Openstack中用鏡像文件生成的image來創建虛機(VM或Instance)時, 通常不支持用戶名加密碼的ssh方式登錄訪問該VM,而是key file方式.

這裏以Centos的鏡像為例, 介紹用keypair生成和訪問虛機的方法.

1) 查看系統中的keypair：
root@cic-1:~# openstack keypair list
+----------+-------------------------------------------------+
| Name | Fingerprint |
+----------+-------------------------------------------------+

2) 生成自己的keypair, 名字隨意取, 本例中是key0510t:

該指令的輸出即為密鑰:
root@cic-1:~# openstack keypair create key0510t
-----BEGIN RSA PRIVATE KEY-----

3) 把密鑰保持在一個文件中, 也就是key file (名字任意選取, 為方便這裏和keypair的名字一樣):
root@cic-1:~# vi key0510t.pem

把上面所有的內容（含第一行和最後一行的標簽和符號）復制到該文件，保存退出。
再用more或cat指令檢查一遍該文件：
root@cic-1:~# more key0510t.pem

4) 確認keypair:
root@cic-1:~# openstack keypair list
+----------+-------------------------------------------------+
| Name | Fingerprint |
+----------+-------------------------------------------------+
| my_key | 51:47:92:7d:a1:ec:75:aa:07:3a:a8:7c:17:63:4d:6f |
| pub_key | 91:4b:da:c4:9d:6e:2e:7e:75:60:25:2a:d5:d1:5b:99 |
| key0510t | 4b:79:61:3f:5d:30:97:66:e5:6f:2a:73:0e:64:11:e0 |
+----------+-------------------------------------------------+

5) 用nova boot創建VM，帶上關鍵參數--key-name，其值就是上面的keypair：
root@cic-1:~# nova boot --flavor m1.small --image centos --key-name key0510t --availability-zone nova --nic net-name=testnet test_vm_t

檢查生成的VM，獲取IP地址：
root@cic-1:~# nova show test_vm_t
+--------------------------------------+----------------------------------------------------------+
| Property | Value |
+--------------------------------------+----------------------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | nova |
| OS-EXT-SRV-ATTR:host | compute-1 |
| OS-EXT-SRV-ATTR:hostname | test-vm-t |
| OS-EXT-SRV-ATTR:hypervisor_hostname | compute-1 |
| OS-EXT-SRV-ATTR:instance_name | instance-00000407 |
| OS-EXT-SRV-ATTR:kernel_id | |
| OS-EXT-SRV-ATTR:launch_index | 0 |
| OS-EXT-SRV-ATTR:ramdisk_id | |
| OS-EXT-SRV-ATTR:reservation_id | r-mc44804o |
| OS-EXT-SRV-ATTR:root_device_name | /dev/vda |
| OS-EXT-SRV-ATTR:user_data | - |
| OS-EXT-STS:power_state | 1 |
| OS-EXT-STS:task_state | - |
| OS-EXT-STS:vm_state | active |
| OS-SRV-USG:launched_at | 2018-05-10T02:49:20.000000 |
| OS-SRV-USG:terminated_at | - |
| accessIPv4 | |
| accessIPv6 | |
| config_drive | True |
| created | 2018-05-10T02:49:14Z |
| description | - |
| flavor | m1.small (2) |
| hostId | 9743f1e7873f1fbc8d1a5da39df25f4a8374605f523d17a0eed53c8b |
| host_status | UP |
| id | 804053fe-d5e5-4349-8b8c-33e2e8f8e8ff |
| image | centos (ad9e09fe-7359-4ce6-9b39-75b33fff0374) |
| key_name | key0510t |
| locked | False |
| metadata | {} |
| name | test_vm_t |
| os-extended-volumes:volumes_attached | [] |
| progress | 0 |
| scheduler_hints | {} |
| security_groups | default |
| status | ACTIVE |
| tenant_id | bfb1b84d2d994b36985cfd306e4f8860 |
| testnet network | 10.10.10.246 |
| updated | 2018-05-10T02:49:21Z |
| user_id | c099eaacab0f452e806b59d8b89f0c74 |
+--------------------------------------+----------------------------------------------------------+

6） 很重要的一步： 修改key file的讀寫屬性為只讀（這裏已經是root用戶，如果不是就加sudo）：
root@cic-1:~# chmod 600 key0510t.pem

7） 用ssh -i的方式登錄VM，-i所帶的參數就是key file的名字：
root@cic-1:~# ssh -i key0510t.pem [email protected]
The authenticity of host ‘10.10.10.246 (10.10.10.246)‘ can‘t be established.
ECDSA key fingerprint is 59:f9:c9:c1:4b:69:8b:3d:53:31:98:24:73:17:c6:e1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘10.10.10.246‘ (ECDSA) to the list of known hosts.
[centos@test-vm-t ~]$ ls

如果忽略了第6）步就會得到如下錯誤信息：

root@cic-1:~# ssh -i key0510t.pem [email protected]
The authenticity of host ‘10.10.10.246 (10.10.10.246)‘ can‘t be established.
ECDSA key fingerprint is 59:f9:c9:c1:4b:69:8b:3d:53:31:98:24:73:17:c6:e1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘10.10.10.246‘ (ECDSA) to the list of known hosts.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for ‘key0510t.pem‘ are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: key0510t.pem
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

註：接下來如果想用用戶名加密碼的方式，就修改該VM的/etc/ssh/sshd_config文件：

PasswordAuthentication yes

然後保存退出，再service sshd restart即可。這樣下次就能用用戶名和密碼登錄了。

Openstack中用keypair生成和訪問虛機的方法