[原]同主目录多用户通过ssh进行密钥登陆.docxVIP

[原]同主目录多用户通过ssh进行密钥登陆作为ssh客户端的机器，有多个用户，他们属于同一个主目录，并且都需要进行密钥验证。而私钥id_rsa的权限必须为600，其他用户不能访问。我们就需要用ssh的-i参数解决这问题。一、系统环境引用操作系统：Asianux 3.0应用软件：OpenSSH v4.3p2客户端和服务端同一IP地址：192.168.48.128服务端用户：hyphen（以该用户模拟服务端）用户1：test、主目录：/home/test、宿组：test用户2：user、主目录：/home/test、宿组：test二、单用户密钥登陆为了方便说明，这里先做个单用户使用密钥登陆sshd服务器的过程。以test用户为例。1、客户端创建密钥：引用[test@asianux3 ~]$ ssh-keygen -t rsaGenerating public/private rsa key pair.Enter file in which to save the key (/home/test/.ssh/id_rsa):Enter passphrase (empty for no passphrase):Enter same passphrase again:Your identification has been saved in /home/test/.ssh/id_rsa.Your public key has been saved in /home/test/.ssh/id_rsa.pub.The key fingerprint is:15:b0:02:35:b4:0d:d3:fe:9c:e8:56:e1:a6:06:8c:e9 test@asianux3然后拷贝公钥到服务器上：引用[test@asianux3 ~]$ scp .ssh/id_rsa.pub hyphen@192.168.48.128:~/.ssh/authorized_keysThe authenticity of host 192.168.48.128 (192.168.48.128) cant be established.RSA key fingerprint is 19:05:03:5c:ac:b5:9d:ba:15:5a:46:7e:32:0e:b8:79.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added 192.168.48.128 (RSA) to the list of known hosts.hyphen@192.168.48.128s password:id_rsa.pub??2、服务端在服务端上创建的authorized_keys默认权限是644，这不能满足安全要求，需要改为600：引用[hyphen@asianux3 ~]$ ll ~/.ssh/authorized_keys-rw-r--r-- 1 hyphen hyphen 395 11-10 13:32 /home/hyphen/.ssh/authorized_keys[hyphen@asianux3 ~]$ chmod 600 ~/.ssh/authorized_keys[hyphen@asianux3 ~]$ ll ~/.ssh/authorized_keys-rw------- 1 hyphen hyphen 395 11-10 13:32 /home/hyphen/.ssh/authorized_keys3、测试使用test用户，使用密钥进行登陆：引用[test@asianux3 ~]$ ssh hyphen@192.168.48.128Last login: Mon Nov 10 12:34:20 2008 from 192.168.48.128[hyphen@asianux3 ~]$测试成功。三、多用户登陆1、权限问题user用户的信息如下：引用[user@asianux3 ~]$ pwd/home/test[user@asianux3 ~]$ iduid=514(user) gid=513(test) groups=513(test)由于私钥权限是600的，user用户无法使用它进行登陆：引用[user@asianux3 ~]$ ll ~/.ssh/id_rsa-rw------- 1 test test 1675 11-10 12:40 /home/test/.ssh/id_rsa[user@asianux3 ~]$ ssh hyphen@192.168.48.128Enter passphrase for key /home/test/.s