ssh公钥登录禁root和密码登录并配置新用户

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

[root@localhost learn_redis]# useradd
Usage: useradd [options] LOGIN
       useradd -D
       useradd -D [options]

Options:
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping

1

useradd tignioj

1

passwd tignioj

1

mkdir /home/tignioj

1

chown -R tignioj:tignioj /home/tignioj

1
2

su tignioj
chsh -s /bin/bash

1
2
3
4
5
6
7
8
9

[root@localhost:~]# useradd -m tignioj -s /bin/bash -p "my_password"
[root@localhost:~]# ls -la /home/tignioj/
total 12
drwx------. 2 tignioj tignioj  62 Dec 12 22:46 .
drwxr-xr-x. 4 root  root   34 Dec 12 22:46 ..
-rw-r--r--. 1 tignioj tignioj  18 Nov 24  2021 .bash_logout
-rw-r--r--. 1 tignioj tignioj 193 Nov 24  2021 .bash_profile
-rw-r--r--. 1 tignioj tignioj 231 Nov 24  2021 .bashrc
[root@localhost:~]#

1

visudo

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

root@localhost:~# update-alternatives --config editor  
There are 4 choices for the alternative editor (providing /usr/bin/editor).  
  
Selection Path Priority Status  
------------------------------------------------------------  
0 /bin/nano 40 auto mode  
1 /bin/ed -100 manual mode  
2 /bin/nano 40 manual mode  
* 3 /usr/bin/vim.basic 30 manual mode  
4 /usr/bin/vim.tiny 15 manual mode  
  
Press <enter> to keep the current choice[*], or type selection number: 3  
root@localhost:~#

1
2
3

# User privilege specification  
root ALL=(ALL:ALL) ALL  
tignioj ALL=(ALL:ALL) ALL

1

vim /etc/ssh/sshd_config

1
2

PermitRootLogin no  
PasswordAuthentication no

1
2

PubkeyAuthentication yes  
RSAAuthentication yes

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

➜ ~ ✗ ssh-keygen  
Generating public/private rsa key pair.  
Enter file in which to save the key (C:\Users\lili/.ssh/id_rsa):  
Enter passphrase (empty for no passphrase):  
Enter same passphrase again:  
Your identification has been saved in C:\Users\lili/.ssh/id_rsa.  
Your public key has been saved in C:\Users\lili/.ssh/id_rsa.pub.  
The key fingerprint is:  
SHA256:OYxuMybC8nztn9ShSyhew9ybczOeB9fEH6wudvlAM3Y lili@DESKTOP-9IJNN32  
The key's randomart image is:  
+---[RSA 3072]----+  
| |  
| |  
| .. |  
| o . oo |  
| . S . B.E.|  
| . + o +..+.= .|  
|. o o.% = .o... |  
| + o.*.*.=++.+. |  
| o.....*+++o .. |  
+----[SHA256]----

1
2
3

su tignioj
mkdir .ssh
cd .ssh

1

chmod 700 .ssh

1

vim authorized_keys

1

chmod 0600 authorized_keys

1
2
3
4
5
6
7
8

tignioj@localhost:~/.ssh$ ls -la  
total 20  
drwxrwxr-x 2 tignioj tignioj 4096 Dec 13 11:37 .  
drwxr-xr-x 5 tignioj tignioj 4096 Dec 13 11:38 ..  
-rw------- 1 tignioj tignioj 742 Dec 13 11:37 authorized_keys  
-rw------- 1 tignioj tignioj 2622 Dec 13 11:37 id_rsa  
-rw-r--r-- 1 tignioj tignioj 585 Dec 13 11:37 id_rsa.pub  
tignioj@localhost:~/.ssh$

1

systemctl restart sshd

1

ssh tignioj@ip:port 

1

Permission denied (publickey,gssapi-keyex,gssapi-with-mic

1

 sshd[13132]: Authentication refused: bad ownership or modes for directory /home/tignioj/.ssh

1
2

chmod 700 /home/tignioj/.ssh
chmod 600 /home/tignioj/.ssh/authorized_keys

1

drwxrwxr-x  2 tignioj tignioj 4096 Dec 31 04:34 .ssh

1

drwx------  2 tignioj tignioj 4096 Dec 31 04:34 .ssh