cat /proc/version
Linux version 3.10.0-327.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Nov 19 22:10:57 UTC 2015
Linux version 2.6.32-642.6.2.el6.x86_64 (mockbuild@worker1.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) ) #1 SMP Wed Oct 26 06:52:09 UTC 2016
authorized_keys 是执行ssh host1后程序在目的地host创建的文件，而出发地的kownhosts的文件会被追加。
【学习路径】
1-看执行过程中的窗口输出语句；
2-比较执行前后的出发地、目的地的文件新增情况、文件内容的新增情况；
[root@bigdata-server-01 ~]# cat /etc/ssh/sshd_config # $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/bin:/usr/bin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. # If you want to change the port on a SELinux system, you have to tell # SELinux about this change. # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER # #Port 22 #ListenAddress 0.0.0.0 #ListenAddress :: # The default requires explicit activation of protocol 1 #Protocol 2 # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 1024 # Ciphers and keying #RekeyLimit default none # Logging # obsoletes QuietMode and FascistLogging #LogLevel INFO # Authentication: #LoginGraceTime 2m #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #RSAAuthentication yes #PubkeyAuthentication yes # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no #KerberosUseKuserok yes # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials no #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no #GSSAPIEnablek5users no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PAM authentication via ChallengeResponseAuthentication may bypass # If you just want the PAM account and session checks to run without # and ChallengeResponseAuthentication to 'no'. # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several # problems. UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no UsePrivilegeSeparation sandbox # Default for new installations. #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #ShowPatchLevel no #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Accept locale-related environment variables AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS # override default of no subsystems Subsystem sftp /usr/libexec/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server UseDNS no AddressFamily inet PermitRootLogin yes SyslogFacility AUTHPRIV PasswordAuthentication yes [root@bigdata-server-01 ~]#
[m] $ssh-keygen -t rsa $cd ~/.ssh $cp id_rsa.pub authorized_keys_hadoop1 [s] $ssh-keygen -t rsa $cd ~/.ssh $cp id_rsa.pub authorized_keys_hadoop2 $scp authorized_keys_hadoop2 root@hadoop1:~/.ssh [m] cat authorized_keys_hadoop1 authorized_keys_hadoop2 >> authorized_keys chmod 400 authorized_keys scp authorized_keys root@hadoop2:~/.ssh [m s] $chmod 400 authorized_keys [check] ssh hadoop1 ssh hadoop2
[hadoop@bigdata-server-01 ~]$ ssh-keygen -t rsa -b 2048; Generating public/private rsa key pair. Enter file in which to save the key (/usr/hadoop/.ssh/id_rsa): Created directory '/usr/hadoop/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /usr/hadoop/.ssh/id_rsa. Your public key has been saved in /usr/hadoop/.ssh/id_rsa.pub. The key fingerprint is: SHA256:FOplMhXfwr9kCXqymSA0jKO1honV9K+lSh4PIuaoEwQ hadoop@bigdata-server-01 The key's randomart image is: +---[RSA 2048]----+ | . +. | |E = . o + . | |. = = = + = . | |.B + o B . + . | |* o . o S . = | |.. . = * o . | |.o. + o + . | |=. + = | |+o o . | +----[SHA256]-----+ [hadoop@bigdata-server-01 ~]$ ssh-copy-id localhost; /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/usr/hadoop/.ssh/id_rsa.pub" The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:+xC9Wc2SSvYj9LLM2PjPrUw9PhRoa7zoLzXeE0AqG7g. ECDSA key fingerprint is MD5:cd:50:71:e7:f1:ee:78:1f:ba:cb:11:d9:c7:85:1f:f8. Are you sure you want to continue connecting (yes/no)? /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:+xC9Wc2SSvYj9LLM2PjPrUw9PhRoa7zoLzXeE0AqG7g. ECDSA key fingerprint is MD5:cd:50:71:e7:f1:ee:78:1f:ba:cb:11:d9:c7:85:1f:f8. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys hadoop@localhost's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'localhost'" and check to make sure that only the key(s) you wanted were added. [hadoop@bigdata-server-01 ~]$ ssh localhost Last login: Thu Nov 23 23:25:44 2017 from 127.0.0.1 Welcome to Alibaba Cloud Elastic Compute Service ! [hadoop@bigdata-server-01 ~]$ ssh-copy-id bigdata-server-02; /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/usr/hadoop/.ssh/id_rsa.pub" The authenticity of host 'bigdata-server-02 (120.78.187.241)' can't be established. ECDSA key fingerprint is SHA256:hsqZ6Utb+5QRXxE98U5E88MoOBwCj+oTbPjkgyO5WQo. ECDSA key fingerprint is MD5:96:bb:cb:09:77:fe:8c:dd:10:e0:a6:94:11:e6:5e:e4. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys hadoop@bigdata-server-02's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'bigdata-server-02'" and check to make sure that only the key(s) you wanted were added. [hadoop@bigdata-server-01 ~]$ ssh bigdata-server-02 Last login: Thu Nov 23 23:26:06 2017 from 120.78.187.72 Welcome to Alibaba Cloud Elastic Compute Service ! [hadoop@bigdata-server-02 ~]$ exit logout Connection to bigdata-server-02 closed. [hadoop@bigdata-server-01 ~]$ ssh-copy-id bigdata-server-03; /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/usr/hadoop/.ssh/id_rsa.pub" The authenticity of host 'bigdata-server-03 (120.78.188.28)' can't be established. ECDSA key fingerprint is SHA256:i2u/BSXoUqwlTXtsWpDdWzZMZtjRRY2LCvBLXHFAzHQ. ECDSA key fingerprint is MD5:21:2e:67:d7:71:12:83:1e:89:dc:a6:b3:64:1d:6a:7a. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys hadoop@bigdata-server-03's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'bigdata-server-03'" and check to make sure that only the key(s) you wanted were added. [hadoop@bigdata-server-01 ~]$ ssh bigdata-server-03 Last login: Thu Nov 23 23:26:21 2017 from 120.78.187.72 Welcome to Alibaba Cloud Elastic Compute Service ! [hadoop@bigdata-server-03 ~]$
[root@bigdata-server-01 .ssh]# rm -rf /usr/hadoop/.ssh; [root@bigdata-server-01 .ssh]# ll -as /usr/hadoop/.ssh; ls: cannot access /usr/hadoop/.ssh: No such file or directory [root@bigdata-server-01 .ssh]# ll -as /usr/hadoop/.ssh; total 16 4 drwx------ 2 hadoop hadoop 4096 Nov 23 23:42 . 4 drwxr-xr-x 17 hadoop hadoop 4096 Nov 23 23:42 .. 4 -rw------- 1 hadoop hadoop 1679 Nov 23 23:42 id_rsa 4 -rw-r--r-- 1 hadoop hadoop 406 Nov 23 23:42 id_rsa.pub [root@bigdata-server-01 .ssh]# ll -as /usr/hadoop/.ssh; total 24 4 drwx------ 2 hadoop hadoop 4096 Nov 23 23:48 . 4 drwxr-xr-x 17 hadoop hadoop 4096 Nov 23 23:42 .. 4 -rw------- 1 hadoop hadoop 406 Nov 23 23:47 authorized_keys 4 -rw------- 1 hadoop hadoop 1679 Nov 23 23:42 id_rsa 4 -rw-r--r-- 1 hadoop hadoop 406 Nov 23 23:42 id_rsa.pub 4 -rw-r--r-- 1 hadoop hadoop 365 Nov 23 23:48 known_hosts [root@bigdata-server-01 .ssh]# cat /usr/hadoop/.ssh/known_hosts; localhost ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKVJATfy765ZoMvOxe7/wIA2Y5OCLMoFVaFRPUHoLmZbLO+Drj9rj8yqKenWv5wylrJKZnSVOQvS3tb7Cb2IqIY= bigdata-server-02,120.78.187.241 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLAP1ETeJ+6aYu6KyIzlREQJVBmyHGinZR+FLKONCUIYxzJ1HmNo0mSgWskRjwNbXySKbYianmSIbwwamHeH+80= [root@bigdata-server-01 .ssh]# cat /usr/hadoop/.ssh/known_hosts; localhost ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKVJATfy765ZoMvOxe7/wIA2Y5OCLMoFVaFRPUHoLmZbLO+Drj9rj8yqKenWv5wylrJKZnSVOQvS3tb7Cb2IqIY= bigdata-server-02,120.78.187.241 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLAP1ETeJ+6aYu6KyIzlREQJVBmyHGinZR+FLKONCUIYxzJ1HmNo0mSgWskRjwNbXySKbYianmSIbwwamHeH+80= bigdata-server-03,120.78.188.28 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBVJUFAiA4PH0oLZEqySzvqYENGl2lGhQdZqRI5EFUOMZz0pbBxEcvInTBL/DS76gh/48xJzX+t4ngFzd6sKNDg= [root@bigdata-server-01 .ssh]#
[root@bigdata-server-02 ~]# rm -f /usr/hadoop/.ssh/*; [root@bigdata-server-02 ~]# ll -as /usr/hadoop/.ssh; total 8 4 drwx------ 2 hadoop hadoop 4096 Nov 23 23:40 . 4 drwxr-xr-x 15 hadoop hadoop 4096 Nov 23 22:13 .. [root@bigdata-server-02 ~]# ll -as /usr/hadoop/.ssh; total 12 4 drwx------ 2 hadoop hadoop 4096 Nov 23 23:48 . 4 drwxr-xr-x 15 hadoop hadoop 4096 Nov 23 22:13 .. 4 -rw------- 1 hadoop hadoop 406 Nov 23 23:48 authorized_keys [root@bigdata-server-02 ~]#
【试验】
host0无密登录host1，是由于之前已经正确输入host1的密码了，结果写入了自己的known_hosts和1、2的authorized_keys；
那么，推测当host2的密码修改后，原host0进入host1的无密登录失效，即known_hosts、authorized_keys的文本内容是密码的函数。
vim /etc/hosts
ipa a
ipb b
scp
4节点a b c d 免密登录快捷配置
各个节点分别执行下2行命令；
ssh-keygen -t rsa -b 2048; ssh-copy-id localhost;
ssh-copy-id a;ssh-copy-id b;ssh-copy-id c;ssh-copy-id d;
输入yes 和各个节点的密码；
#!/bin/bash
hostset=('hadoop-name' 'hadoop-data-a' 'hadoop-data-b')
for i in ${hostset[@]}; do
cmd=`ssh $i "mkdir -p ~/test/hadoop/;ls;"`;
echo $i $cmd;
done