如何为 Linux 中的特定用户添加 ssh 密钥？

Question 1

生成 ssh 密钥：

ssh-keygen -t rsa -b 4096 -C "comment"

将其复制到您的远程服务器：

ssh-copy-id user@ip

或者您可以手动将其附加~/.ssh/id_rsa.pub到~/.ssh/authorized_keys：

ssh user@ip 'mkdir ~/.ssh'
ssh user@ip 'cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_rsa.pub

Answer

生成 ssh 密钥：

ssh-keygen -t rsa -b 4096 -C "comment"

将其复制到您的远程服务器：

ssh-copy-id user@ip

或者您可以手动将其附加~/.ssh/id_rsa.pub到~/.ssh/authorized_keys：

ssh user@ip 'mkdir ~/.ssh'
ssh user@ip 'cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_rsa.pub

Question 2

该文件是在您运行时创建的ssh-copy-id <user>@<server>，例如：

sylvester@host3:~> ssh-copy-id arnold@host4
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/sylvester/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'arnold@host4'"
and check to make sure that only the key(s) you wanted were added.

该文件尚不存在，因为没有人为该用户添加任何内容。

Answer

该文件是在您运行时创建的ssh-copy-id <user>@<server>，例如：

sylvester@host3:~> ssh-copy-id arnold@host4
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/sylvester/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'arnold@host4'"
and check to make sure that only the key(s) you wanted were added.

该文件尚不存在，因为没有人为该用户添加任何内容。

Question 3

您不需要任何特定的工具来创建授权密钥文件，或告诉任何特定的程序它存在。sshd每次用户尝试登录时都会查找它。

非常简单，如果它不存在，您可以像为不同用户编辑现有文件一样创建它。

你什么做需要做的是确保权限被充分锁定，否则sshd将拒绝信任该文件。因此，为用户创建一个完全空的主目录的步骤joebloggs如下所示：

# Create the .ssh directory, and set its permissions
mkdir ~joebloggs/.ssh
chown joebloggs ~joebloggs/.ssh
chmod 0700 ~joebloggs/.ssh

# Create the authorized keys file, and set its permissions
touch ~joebloggs/.ssh/authorized_keys
chown joebloggs ~joebloggs/.ssh/authorized_keys
chmod 0600 ~joebloggs/.ssh/authorized_keys

这将创建一个完全空的.ssh/authorized_keys文件，该文件只能joebloggs访问、读取和写入。

这是最低限度需要许可，遵循最小权限原则。如果需要，您可以允许特定组 ( chgrp -R some-group ~joebloggs/.ssh; chmod 750 ~joebloggs/.ssh; chmod 640 ~joebloggs/.ssh/authorized_keys) 或系统上的所有用户 ( )进行只读访问chmod 755 ~joebloggs/.ssh; chmod 644 ~joebloggs/.ssh/authorized_keys。重要的是他们不能写否则 SSH 守护进程将不信任其内容。

Answer