最後更新: 2015-07-16
目錄
- 建立 SSH Pri & Pub Keys
- 由私匙找回公匙
- 移除己知 server 的 fingerprint
- 在 known_hosts file 找回 Server 的公匙
- 找出 Server 公匙的 fingerprint
- 更改私匙的 password
- OpenSSH format key -> PEM format key
- Re-generating SSH Server Host Keys
建立 SSH Pri & Pub Keys
ssh-keygen # Default 建立 /root/.ssh/id_rsa 及 /root/.ssh/id_rsa.pub
用 key 認證
grep AuthorizedKeysFile /etc/ssh/sshd_config
AuthorizedKeysFile %h/.ssh/authorized_keys
mv /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
Other Opts
-C comment
-O option # This option may be specified multiple times
clear Clear all enabled permissions. This is useful for clearing the default set of permissions
no-agent-forwarding, no-port-forwarding, no-x11-forwarding, no-user-rc ...
-N new_passphrase
Tips
# 不問任何野直接建立 key file
ssh-keygen -f /root/.ssh/id_rsa -N ''
建立 Private & Public Key
# 建立在 ~/.ssh
ssh-keygen
# 建立在指定地方
mkdir anotherServer
ssh-keygen -f anotherServer
由私匙找回公匙
ssh-keygen -y -f .ssh/id_rsa
-y # read a private OpenSSH format file and print an OpenSSH public key to stdout
-f filename
移除己知 server 的 fingerprint
# -R Removes all keys belonging to hostname from a known_hosts file
ssh-keygen -R datahunter.org
Original contents retained as /home/lwy/.ssh/known_hosts.old
在 known_hosts file 找回 Server 的公匙
# -F Search for the specified hostname in a known_hosts file
ssh-keygen -F datahunter.org
|1|fa9xbxellA2dzk8lFJ2xWMnNTBk=|dBR/mGq/IgH6D8FuODQYN0/WWxI= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqmJyHruxq4R+Qnwas7XKKbTUfhtDKnQJeasQ eNkKfPfGpYEnW8bymKLkW4RNDQIryBYe7t1v9UWXRC9xgWmjJ0Z0MyXLaDJ4NxO Ey3WOtCJhQzTn9AJA16CjOitZwWDROUSdrvUQgZQibzvR+jcYW6eqt63jOfVnyj0dS d1II8ubCQVjSJlldxRuy6b4QU3vbS6eyHIFUKSAqvVamsZFwNt8UM2i52N/ym6T4wld 6Pzob+zH8DoVW7XMwWl8wVAvzBGonEk3Y0Vptp/rBMHG7YYGXPZib5Oc5TaGqKY 0pUaM+64UWb9FDVK2bCfOfiP6ZV9h9N6c2kXIh/UivvIUeQ==
找出 Server 公匙的 fingerprint
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
-l Show fingerprint of specified public key file.
2048 07:6b:43:b4:f2:db:90:2b:f0:6f:f8:04:fd:6a:b1:28 /etc/ssh/ssh_host_rsa_key.pub (RSA)
一次過看所有 public key 的 fingerprint
ls /etc/ssh/*key.pub | xargs -n 1 ssh-keygen -l -f
更改私匙的 password
# -p Requests changing the passphrase of a private key file
# -N new_passphrase 配會 "-p" 使用
ssh-keygen -p
加密了的 Private Key:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,E6F770E02C2655A6
.............................................
.............................................
-----END RSA PRIVATE KEY-----
OpenSSH format key -> PEM format key
-----BEGIN OPENSSH PRIVATE KEY-----
TO
-----BEGIN RSA PRIVATE KEY-----
# -m key_format Specify a key format for the -i (import) or -e (export) conversion options.
# “RFC4716” (RFC 4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public key) or “PEM” (PEM public key).
# 沒有 backup 地把 key 轉了 format
ssh-keygen -p -N "" -m pem -f /path/to/key
Re-generating SSH Server Host Keys
grep HostKey /etc/ssh/sshd_config
HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key
rm /etc/ssh/ssh_host_* -f
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
Remark
-N new_passphrase # Provides the new passphrase
一次過建立所有 key rsa, ecdsa, ed25519)
-A # 在 default key file path 建立 rsa1, rsa, dsa and ecdsa host key