![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
|
Fedora13 ssh |
$ sudo /sbin/iptables -L [sudo] password for kagyuu: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:xdmcp ACCEPT udp -- anywhere anywhere state NEW udp dpt:xdmcp REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination
$ sudo chkconfig --level 35 sshd on
$ sudo /etc/init.d/sshd start
$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/home/kagyuu/.ssh/id_rsa): Created directory '/home/kagyuu/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/kagyuu/.ssh/id_rsa. Your public key has been saved in /home/kagyuu/.ssh/id_rsa.pub. The key fingerprint is: 31:85:c8:81:f1:63:41:82:db:f1:56:44:48:ca:70:84 kagyuu@orange.homelan The key's randomart image is: +--[ RSA 2048]----+ | .+=*=*o.. | | E+o++.o. | | ooo+.o | | . ..o. o | | . S | | | | | | | | | +-----------------+
$ cd .ssh/ $ ls id_rsa id_rsa.pub $ cat id_rsa.pub >> authorized_keys $ cd .. $ chmod -R 755 .ssh認証キーは複数登録できるので ">>" で追記している
$ ssh kagyuu@192.168.1.2 The authenticity of host '192.168.1.2 (192.168.1.2)' can't be established. RSA key fingerprint is 32:9d:9c:a2:fd:50:f5:e3:ba:78:64:36:12:86:de:0f. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.2' (RSA) to the list of known hosts. kagyuu@192.168.1.2's password: [kagyuu@orange ~]$
PasswordAuthentication no PermitRootLogin no
$ sudo /etc/rc.d/init.d/sshd restart;exit;exit sshd を停止中: [ OK ] sshd を起動中: [ OK ]
$ ssh kagyuu@192.168.1.2 Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[~/]$ scp kagyuu@192.168.1.2:/home/kagyuu/.ssh/id_rsa . [~/]$ mv id_rsa .ssh/kagyuu_id_rsa [~/]$ cd .ssh [~/.ssh]$ chmod 600 ~/.ssh/kagyuu_id_rsa [~/.ssh]$ ssh-add ~/.ssh/kagyuu_id_rsa Enter passphrase for /Users/Atsushi/.ssh/kagyuu_id_rsa:
[~/.ssh]$ uname -a Darwin hondou-atsushi-no-MacBook.local 10.8.0 Darwin Kernel Version 10.8.0: Tue Jun 7 16:33:36 PDT 2011; root:xnu-1504.15.3~1/RELEASE_I386 i386 i386 [~/.ssh]$ ssh kagyuu@192.168.1.2 Last login: Mon Jul 18 22:16:56 2011 from 192.168.1.132 [kagyuu@orange ~]$ uname -a Linux orange.homelan 2.6.34.9-69.fc13.i686.PAE #1 SMP Tue May 3 09:13:56 UTC 2011 i686 i686 i386 GNU/Linux [kagyuu@orange ~]$
[~/.ssh]$ ssh-add -h ssh-add: illegal option -- h usage: ssh-add [options] [file ...] Options: -l List fingerprints of all identities. -L List public key parameters of all identities. -k Load only keys and not certificates. -c Require confirmation to sign using identities -t life Set lifetime (in seconds) when adding identities. -d Delete identity. -D Delete all identities. -x Lock agent. -X Unlock agent. -s pkcs11 Add keys from PKCS#11 provider. -e pkcs11 Remove keys provided by PKCS#11 provider.
/.ssh/id_dsa
/.ssh/id_ecdsa
/.ssh/id_rsa
/.ssh/id_rsa.${HOST名} とかで、複数の鍵を使いたい。何もしないと
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).といわれて接続できない。(接続先からの鍵が一致しないのでアクセス権限が無いというメッセージ。クライアント側の鍵のアクセス権に問題があるわけでは無い事に注意。←この勘違いで ~/ をめちゃくちゃにしてしまいバックアップから普及する羽目に・・・
![[sad]](image/face/sad.png)
)/.ssh/config に鍵ファイルを登録すれば良い
[~/.ssh]$ ls
config id_rsa.hondou.homedns.org
id_rsa.app.example.com known_hosts
[~/.ssh]$ cat config
Host app.example.com
HostName app.example.com
IdentityFile ~/.ssh/id_rsa.app.example.com
Host hondou.homedns.org
HostName hondou.homedns.org
IdentityFile ~/.ssh/id_rsa.hondou.homedns.org
Host github
HostName github.com
IdentityFile ~/.ssh/id_rsa.github/.ssh/config の設定項目
sshX11.png