前言

SSH 为 Secure Shell 的缩写，是常用的加密安全协议，在服务端配置相应的sshd Daemon，使用ssh客户端可以进行远程控制。ssh的验证方式一般为密码验证，当管理的机器变多时，登陆一次机器就输入一次秘钥是非常麻烦的事情，这里记录下设置免秘钥登陆的过程，以备不时之需。主要分为如下两步

1.生成密钥对

[root@m01 ~]$ ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa
Generating public/private dsa key pair.
Your identification has been saved in /home/joshua/.ssh/id_dsa.
Your public key has been saved in /home/joshua/.ssh/id_dsa.pub.
The key fingerprint is:
af:6c:13:4a:a9:f3:c9:86:e8:77:c1:32:cb:dc:17:11 root@m01
The key's randomart image is:
+--[ DSA 1024]----+
| |
| E |
| . |
| . |
| . .S. |
| o = o. |
| + O o o. |
| . O.=o+. |
| ... =+oo. |
+-----------------+

[root@m01 ~]$ ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa

Generating public/private dsa key pair.

Your identification has been saved in /home/joshua/.ssh/id_dsa.

Your public key has been saved in /home/joshua/.ssh/id_dsa.pub.

The key fingerprint is:

af:6c:13:4a:a9:f3:c9:86:e8:77:c1:32:cb:dc:17:11 root@m01

The key's randomart image is:

+--[ DSA 1024]----+

| |

| E |

| . |

| . .S. |

| o = o. |

| + O o o. |

| . O.=o+. |

| ... =+oo. |

+-----------------+

让我们来查看一下上一条命令指定的目录

[root@m01 ~]# ll .ssh/
total 16
-rw------- 1 root root  668 Dec 14 15:45 id_dsa
-rw-r--r-- 1 root root  598 Dec 14 15:45 id_dsa.pub
-rw-r--r-- 1 root root 5531 Feb 12 14:52 known_hosts

[root@m01 ~]# ll .ssh/

total 16

-rw------- 1 root root 668 Dec 14 15:45 id_dsa

-rw-r--r-- 1 root root 598 Dec 14 15:45 id_dsa.pub

-rw-r--r-- 1 root root 5531 Feb 12 14:52 known_hosts

2.分发秘钥

我们使用ssh-copy-id进行分发秘钥

ssh-copy-id -i .ssh/id_dsa.pub root@172.16.1.30

1	ssh-copy-id -i .ssh/id_dsa.pub root@172.16.1.30

当远端主机ssh端口为非22端口时则变为如下指定端口

ssh-copy-id -i .ssh/id_dsa.pub "-p 55331 oldboy@172.16.1.30"

1	ssh-copy-id -i .ssh/id_dsa.pub "-p 55331 oldboy@172.16.1.30"

由括号可以发现，显然ssh-copy-id是调用ssh实现传送公钥的。

之后登陆就无需输入密码了由括号可以发现，显然ssh-copy-id是调用ssh实现传送公钥的。

另，关于利用expect进行批量分发秘钥

expect脚本：

#!/usr/bin/expect
if { $argc != 3 } {
send_user "usage: expect ssh-expect.exp file host port\n set the password before use\n"
exit
}
#define var
set file [lindex $argv 0]
set host [lindex $argv 1]
set port [lindex $argv 2]
set password "123456"
#spawn scp /etc/hosts steven@172.16.1.31:/etc/hosts
#spawn scp -P52113 $file steven@host:$dir
spawn ssh-copy-id -i $file "-p $port $user@$host"
expect {
"yes/no"    {send "yes\r";exp_continue}
"*password" {send "$password\r"}
}
expect eof
exit -onexit {
send_user "say good bye to you!\n"
}