(1)實驗環境

　　兩臺CentOS7：

　　　　youxi1　　192.168.1.6

　　　　youxi2　　192.168.1.7

　　這裏我將防火墻關閉進行實驗，如果防火墻開啟，請將端口加入到防火墻規則中。

(2).目標

　　在ssh端口不為22的情況下，進行單向免密登錄或雙向免密登錄（端口不一致）

(3).實驗

　　首先修改兩臺服務器的端口，vim /etc/ssh/sshd_config，找到如下部分

#Port 22

　　將#去除，22改為想要的端口號。這裏我將youxi1的ssh端口號改為2890，youxi2的ssh端口號改為2891。

　　接著使用命令systemctl restart sshd重啟服務。再使用netstat -tlunp | grep sshd查看端口號（如果沒有netstat請安裝net-tools）

[[email protected] Packages]# netstat -tlunp | grep sshd　　//youxi1
tcp        0      0 0.0.0.0:2890            0.0.0.0:*               LISTEN      9953/sshd           
tcp6       0      0 :::2890                 :::*                    LISTEN      9953/sshd
[[email protected] ~]# netstat -tlunp | grep sshd　　//youxi2
tcp        0      0 0.0.0.0:2891            0.0.0.0:*               LISTEN      17526/sshd          
tcp6       0      0 :::2891                 :::*                    LISTEN      17526/sshd

1）單向免密登錄

　　youxi1使用ssh遠程youxi2不需要密碼，但youxi2使用ssh遠程youxi1需要密碼

　　在yousi1上使用ssh-keygen生成公鑰和私鑰（這裏使用默認的rsa），一路默認即可

[[email protected] ~]# ssh-keygen -t rsa　　//默認指定的是rsa，所以可以沒有-t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 　　//選項沒有指定生成地址時，此處也可以指定
Created directory ‘/root/.ssh‘.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:ia+le9ZX3cAxztmIINJbWnEGrK9lq4lY4pYNevgqecM [email protected]
The key‘s randomart image is:
+---[RSA 2048]----+
|       . .ooo    |
|      . o =o  o  |
|       . B . = * |
|       .+.  . B .|
|      . S.     o.|
|    .  .  +   . o|
| o o.+. o= . .   |
|o E.++.=+.o .    |
| o.*+ =+o. .     |
+----[SHA256]-----+

　　在沒有指定生成地址時，會默認生成到家目錄下的.ssh/目錄下。使用rsa就會生成id_rsa和id_rsa.pub兩個文件，如果使用的是dsa則生成的是id_dsa和id_dsa.pub兩個文件。

[[email protected] ~]# ls /root/.ssh/
id_rsa  id_rsa.pub

　　接著使用命令ssh-copy-id命令將公鑰發到youxi2服務器上

[[email protected] ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2891 [email protected]　　//-p選項指定被遠程的服務器的端口號
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
The authenticity of host ‘[192.168.1.7]:2891 ([192.168.1.7]:2891)‘ can‘t be established.
ECDSA key fingerprint is SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.
ECDSA key fingerprint is MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.
Are you sure you want to continue connecting (yes/no)? yes　　//yes繼續
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]‘s password: 　　//輸入192.168.1.7服務器上的root用戶的密碼

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p ‘2891‘ ‘[email protected]‘"
and check to make sure that only the key(s) you wanted were added.

　　公鑰傳完後雖然會在本地生成.ssh/known_hosts文件，但並不生效。而在youxi2服務器的root用戶的家目錄下生成.ssh目錄，並含有authorized_keys文件。

[[email protected] ~]# ls .ssh/
authorized_keys

　　此時youxi1上的id_rsa.pub文件與youxi2是上的authorized_keys文件相同。

　　最後測試：在youxi1上ssh遠程youxi2，會發現並不需要輸入密碼

[[email protected] ~]# ssh -p 2891 [email protected]
Last login: Sun May 12 17:46:49 2019 from youxi1.cn
[[email protected] ~]# ls .ssh/
authorized_keys

　　註意：是本機生成的公鑰發給被遠程的服務器，在發送公鑰和遠程服務器時，都需要指定被遠程的服務器的端口號。

2）雙向免密登錄

　　雙向免密就是互換公鑰即可，這裏接著上面把youxi2的公鑰發送到youxi1上，並進行測試。

[[email protected] ~]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:9+woxNPvkE99zGUEZNcI+DJaUUIZXXMKb7k/Y6kPiJU [email protected]
The key‘s randomart image is:
+---[RSA 2048]----+
|         .+*++*.+|
|          +..+.B.|
|           o  = .|
|          + o. o |
|       .S+.E  . o|
|        =.++.. =o|
|       . ooo+..==|
|        .  *. +.o|
|         ...+... |
+----[SHA256]-----+
[[email protected] ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2890 [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
The authenticity of host ‘[192.168.1.6]:2890 ([192.168.1.6]:2890)‘ can‘t be established.
ECDSA key fingerprint is SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.
ECDSA key fingerprint is MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]‘s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p ‘2890‘ ‘[email protected]‘"
and check to make sure that only the key(s) you wanted were added.

[[email protected] ~]# ssh -p 2890 [email protected]
Last login: Sun May 12 17:24:54 2019 from youxi2.cn
[[email protected] ~]# 

CentOS7做ssh免密登錄