配置ssh秘钥登陆

环境2台linux服务器：node1 192.168.X.234 

                             node2 192.168.X.242

演示用node1无密码登陆node2，秘钥登陆是单向的，如果要双向登陆再反过来配置一下就可以

在node1上面创建密钥对

#在/root/.ssh/目录下执行ssh-keygen  一直回车就行,如果有需要也可以给密码设置密码
[root@192-168-X-234 .ssh]# ssh-keygen  
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
ec:80:8d:a2:2e:a4:74:f2:b4:99:4c:70:59:78:58:69 root@192-168-3-234.baicheng.com
The key's randomart image is:
+--[ RSA 2048]----+
|    +..          |
|   o E           |
|    =            |
| . o + .         |
|  + o o S        |
| = =   o         |
|= B +   .        |
|+  *             |
|..               |
+-----------------+

ls查看 目录下面多了2个文件就是 公钥和私钥，公钥内容需要添加到给你想登陆的那台机器的任何用户下的.ssh/authorized_keys，添加到哪个用户下面就用那个用户登陆就可以，这里我们添加到node2

[root@192-168-X-234 .ssh]# ls
id_rsa id_rsa.pub

用ssh-copy-id 可以直接把id_rsa.pub里面的内容追加到对方的.ssh/authorized_keys里面

[root@192-168-X-234 .ssh]# ssh-copy-id "-p62387 xiewenming@192.168.X.242"
Address 192.168.X.242 maps to localhost, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Now try logging into the machine, with "ssh '-p62387 xiewenming@192.168.X.242'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

[root@192-168-3-234 .ssh]# 

注意：如果默认端口不是22，那么ssh-copy-id "-p62387 xiewenming@192.168.X.242" 这里需要加引号，否则会报下面的错误

[root@192-168-X-234 .ssh]# ssh-copy-id -p62387 xiewenming@192.168.X.242
Pseudo-terminal will not be allocated because stdin is not a terminal.
ssh: Could not resolve hostname umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys; test -x /sbin/restorecon && /sb: Name or service not known

在node2的节点上查看，authorized_keys权限是600，如果是自己创建的文件得注意这个权限问题，.ssh目录文件夹权限为700

[root@192-168-X-242 .ssh]# pwd
/home/xiewenming/.ssh
[root@192-168-X-242 .ssh]# cat authorized_keys 
AAAAB3NzaC1yc2EAAAABIwAAAQEA15QNqu6N0kkNv+e4qXD+Gz8TqWo7LJKeumuFAMD2ZDH0/MfKPKCfxOGv8k/cMB1XRKYFTuxR/ZW7HqmNK1wpppCqccxjKj/vOeWjuk16x2rMqqjkWBIedw7a/fGP87GC0DmOAe3bzWbqDY0rGA5jWR+YBItGES2GmW3889jJRhgcmQO2qsCnxfQ8g1D6XfpKSXCe7qvYtsqRn7Jcw35I39vx6kxpxgjtNobEo2Xw7tfx9n64poNzi72e/UF7mZSB5EZgKLM8uxw4wgBljB2yX9Cnsc5y4Qs+VzUaI7TyzR4RFTWiukOKCPEjxJPJ71E9/HL44Qi8LOTTBp/20T7JLw== root@192-168-3-234.xxx.com

 到这里就已经配置完成可以在node1上面不用密码登陆到node2上面

[root@192-168-X-234 .ssh]# ssh xiewenming@192.168.X.242
Address 192.168.X.242 maps to localhost, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Last login: Tue Aug 29 15:22:39 2017 from 192.168.X.234
[xiewenming@192-168-3-242 ~]$ ifconfig |grep 192.168
          inet addr:192.168.3.242  Bcast:192.168.X.255  Mask:255.255.255.0

ps：ssh-copy-id 是一个很好用的命令，如果没有这个命令有的运维人员经常拷贝公钥内容放到authorized_keys，那么拷贝经常出现的问题是原来公钥内容是一行，拷贝就会成了多行，需要手动调格式，降低了工作效率，有了上面的ssh-copy-id 基础完全可以写脚本批量完成对其它服务器的操作