サーバを外部公開する際はセキュリティ対策を怠ってはいけませんよね。
割と王道なのが、パスワードログインを禁止し、サーバ側で許可したユーザのみ認証させる秘密鍵認証ですね。
サーバ上での鍵生成
ssh-keygenコマンドで鍵生成
[yuta@localhost ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/yuta/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/yuta/.ssh/id_rsa.
Your public key has been saved in /home/yuta/.ssh/id_rsa.pub.
The key fingerprint is:
d6:39:9a:22:05:6a:8e:27:4a:47:bd:1e:ec:61:81:63 yuta@localhost.localdomain
The key’s randomart image is:
+–[ RSA 2048]—-+
+—————–+
[yuta@localhost ~]$
[yuta@localhost ~]$
Generating public/private rsa key pair.
Enter file in which to save the key (/home/yuta/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/yuta/.ssh/id_rsa.
Your public key has been saved in /home/yuta/.ssh/id_rsa.pub.
The key fingerprint is:
d6:39:9a:22:05:6a:8e:27:4a:47:bd:1e:ec:61:81:63 yuta@localhost.localdomain
The key’s randomart image is:
+–[ RSA 2048]—-+
+—————–+
[yuta@localhost ~]$
[yuta@localhost ~]$
ホームディレクトリの配下に.sshが作成され、中に鍵ファイルが生成される
[yuta@localhost ~]$ cd .ssh/
[yuta@localhost .ssh]$ ls
id_rsa id_rsa.pub
[yuta@localhost .ssh]$
[yuta@localhost .ssh]$ ls
id_rsa id_rsa.pub
[yuta@localhost .ssh]$
authorized_keysに鍵を登録
[yuta@localhost .ssh]$ mv ~/.ssh/id_rsa.pub ~/.ssh/authorized_keys
[yuta@localhost .ssh]$ chmod 600 ~/.ssh/authorized_keys
[yuta@localhost .ssh]$ ls -l authorized_keys
-rw——-. 1 yuta yuta 408 Jul 16 05:30 authorized_keys
[yuta@localhost .ssh]$
[yuta@localhost .ssh]$ chmod 600 ~/.ssh/authorized_keys
[yuta@localhost .ssh]$ ls -l authorized_keys
-rw——-. 1 yuta yuta 408 Jul 16 05:30 authorized_keys
[yuta@localhost .ssh]$
WinSCPでid_rsaをクライアント端末へ回収
パスワード認証の禁止、鍵認証の有効化
rootユーザでsshd_configを編集する。
[root@localhost ~]# su –
Last login: Sat Jul 16 05:36:44 PDT 2016 on pts/2
[root@localhost ~]#
[root@localhost ~]# vi /etc/ssh/sshd_config
Last login: Sat Jul 16 05:36:44 PDT 2016 on pts/2
[root@localhost ~]#
[root@localhost ~]# vi /etc/ssh/sshd_config
編集箇所
PubkeyAuthentication yes
PermitEmptyPasswords no
PasswordAuthentication no
PermitEmptyPasswords no
PasswordAuthentication no
TeraTermから秘密鍵でのログイン
ダウンロードしたid_rsaを指定する
無事ログインできた
