1、安装服务器端软件包
先查看是否已经安装openSSH服务器软件包
# rpm -qa|grep openssh
openssh-askpass-.3p1-.el6_6..x86_64
openssh-server-.3p1-.el6_6..x86_64 #服务器端软件包
openssh-clients-.3p1-.el6_6..x86_64 #客户端软件包
openssh-.3p1-.el6_6..x86_64 #包含服务器端和客户端的核心文件
如果没有安装，挂载光盘，
#mkdir /mnt/local #创建一个目录，用于挂载光盘文件
# mount /dev/cdrom /mnt/local/
mount: block device /dev/sr0 is write-protected, mounting read-only
# cd /mnt/local/Packages/ #DVD镜像文件的盛放目录
进入光盘目录，找到并执行执行下列命令：
# rpm -ivh openssh-.3p1-.el6.x86_64.rpm
# rpm -ivh openssh-server-.3p1-.el6.x86_64.rpm
# rpm -ivh openssh-clients-.3p1-.el6.x86_64.rpm
# rpm -ivh openssh-askpass-.3p1-.el6.x86_64.rpm 按序安装
# ssh -v #版本信息
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips Feb
usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
[-D [bind_address:]port] [-e escape_char] [-F configfile]
[-I pkcs11] [-i identity_file]
[-L [bind_address:]port:host:hostport]
[-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
[-R [bind_address:]port:host:hostport] [-S ctl_path]
[-W host:port] [-w local_tun[:remote_tun]]
[user@]hostname [command]
2、服务器端配置文件详解
# cat /etc/ssh/sshd_config
一般默认不需要修改就能连接，每一行都是"关键词 值"的格式。
#Port #服务器监听的端口号
#AddressFamily any
#ListenAddress 0.0.0.0 #设置OpenSSH服务器绑定的IP
#ListenAddress :: # Disable legacy (protocol version ) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol
Protocol # HostKey for protocol version
#HostKey /etc/ssh/ssh_host_key #设置包含计算机私有主机秘钥的文件
# HostKeys for protocol version
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version server key
#KeyRegenerationInterval 1h
#ServerKeyBits #设置服务器秘钥的位数，最小值512，默认1024 # Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO #设置记录ssh日志消息的级别 # Authentication: #LoginGraceTime 2m #设置如果用户不能成功登录，在切断连接之前服务器需要等待的时间
#PermitRootLogin yes #设置root用户是否能够使用ssh登录
#StrictModes yes
#MaxAuthTries
#MaxSessions #指定允许每个网络连接打开的最大会话数，默认10 #RSAAuthentication yes #设置是否允许只有RSA安全验证
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no #设置是否允许用rhosts或/etc/hosts.equiv加上RSA进行安全验证
# similar for protocol version
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes #设置RhostsRSA验证和Hostbased验证的时候是否使用.rhosts和.shosts文件 # To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes #设置是否允许口令验证
#PermitEmptyPasswords no #设置是否允许用户口令为空字符串的账号登陆，默认no
PasswordAuthentication yes #设置是否允许口令验证 # Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no # Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes # GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no # Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes # Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS #AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes #设置是否允许X11转发
#X11DisplayOffset
#X11UseLocalhost yes
#PrintMotd yes #设置sshd是否在用户登陆的时候显示/etc/motd文件的信息
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval
#ClientAliveCountMax #设置允许超时的次数（指定从客户端断开连接之前，在没有接到响应时能够发送客户端活跃消息的次数）
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups :: #指定SSH守护进程并未经身份验证连接的最大数量，默认值是10
#PermitTunnel no
#ChrootDirectory none # no default banner path
#Banner none # override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server # Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server AllowGroups #设置允许连接的组群
AllowUsers #设置允许连接的用户
DenyGroup #设置拒绝连接的组群
DenyUsers #设置拒绝连接的用户（默认没有这个项，需要手动添加，若模式写成User@Host，则User和Host将同时被检查，限制特定用户在特定主机上连接SSH服务器，例Tom@192.168.10.10,表示拒绝用户Tom在192.168.10.10的主机上连接openSSH服务器
2、服务器配置实例
某公司内部部署OpenSSH服务器，为公司网络内的客户端计算机提供远程SSH登陆服务，具体参数：
服务器IP：192.168.0.2
监听端口：22
不允许空口令用户登陆
禁止test用户登陆
修改sshd_config文件参数如下;
13Port
ListenAddress 192.168.0.2
Protocol
SyslogFacility AUTHPRIV
#PermitEmptyPasswords no
PasswordAuthentication yes
DenyUsers test
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes #设置是否允许X11转发
Subsystem sftp /usr/libexec/openssh/sftp-server
3、控制SSH服务
[root@vnc Packages]# vim /etc/ssh/
moduli ssh_host_dsa_key ssh_host_key.pub
ssh_config ssh_host_dsa_key.pub ssh_host_rsa_key
sshd_config ssh_host_key ssh_host_rsa_key.pub
ssh_config 客户端配置文件
sshd_config 服务器配置文件
控制sshd服务
# service sshd start
# service sshd status
# service sshd stop restart
# service sshd reload 重新加载sshd服务配置
# chkconfig sshd on 开机自启动
# chkconfig --list sshd
四、配置Linux客户端软件
1、安装软件包
光盘或yum安装openssh和openssh-clients软件包
客户端配置文件ssh_config
# Host * 只对匹配后面字符串的计算机有效，* 表示所有计算机
# ForwardAgent no
# ForwardX11 no
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# GSSAPIKeyExchange no
# GSSAPITrustDNS no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port
# Protocol ,
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-@openssh.com,hmac-ripemd160
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
Host *
GSSAPIAuthentication yes
# If this option is set to yes then remote X11 clients will have full access
# to the original X11 display. As virtually no X11 client supports the untrusted
# mode correctly we set this to yes.
ForwardX11Trusted yes
# Send locale-related environment variables
SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
SendEnv XMODIFIERS
2、ssh远程登录程序
ssh [选项] [用户]@主机[命令]
注意：设置好防火墙和SELinux，如果客户端无法连接，很多情况是这里出的问题
登录时不指定用户名，在本地服务器上的登陆名就会被传递给远程主机;
$ ssh 192.168.175.134
若希望指定不同用户名，用下面的命令：
例：2.1、以用户vn登陆到IP为192.168.175.138的用户
# ssh vn@192.168.175.138
例：登陆并查看目录信息
# ssh root@192.168.175.138 ls -ahl /home
3、scp安全远程文件复制程序
命令的语法：
scp [选项] [[用户@主机1:]]文件1 [[用户@主机2:]文件2
例子1：用vn账户将本地/home目录下的update.sh文件传到192.168.175.138主机;/root目录下，同时更名为u.sh
[vn@vn /]$ whoami
vn 当前用户名
[vn@vn /]$ scp /home/update.sh root@192.168.175.138:/root/u.sh
例子2：用vn账户把/home及其目录下所有文件和子目录都传送到远程主机/root/test目录下：
[vn@vn /]$ scp -r /home root@192.168.175.138:/root/test
root@192.168.175.138's password: //输入密码
[vn@vn /]$ ssh root@192.168.175.138 ls -ld /root/test/home //这里可以查看传送的文件
root@192.168.175.138's password:
drwxr-xr-x. root root 7月 : /root/test/home
例子3：将远程主机上/root/test/home目录及其子目录传送到本地主机/root目录下
[root@vn vn]# scp -r root@192.168.175.138:/root/test/home /root
root@192.168.175.138's password:
[root@vn vn]# ls -ld /root/home/
drwxr-xr-x. root root 7月 : /root/home/
4、sftp安全的文件传输程序
命令语法：
sftp [选项]主机
sftp [用户@]主机[:文件]
sftp [用户@]主机[:dir[/]]
sftp [选项][用户@]主机
例子：
[root@vn vn]# scp -r root@192.168.175.138:/root/test/home /root
root@192.168.175.138's password:
[root@vn vn]# ls -ld /root/home/
drwxr-xr-x. root root 7月 : /root/home/
sftp> help 一些命令
Available commands:
bye Quit sftp
cd path Change remote directory to 'path'
chgrp grp path Change group of file 'path' to 'grp'
chmod mode path Change permissions of file 'path' to 'mode'
chown own path Change owner of file 'path' to 'own'
df [-hi] [path] Display statistics for current directory or
filesystem containing 'path'
exit Quit sftp
get [-P] remote-path [local-path] Download file
help Display this help text
lcd path Change local directory to 'path'
lls [ls-options [path]] Display local directory listing
lmkdir path Create local directory
ln oldpath newpath Symlink remote file
lpwd Print local working directory
ls [-1aflnrSt] [path] Display remote directory listing
lumask umask Set local umask to 'umask'
mkdir path Create remote directory
progress Toggle display of progress meter
put [-P] local-path [remote-path] Upload file
pwd Display remote working directory
quit Quit sftp
rename oldpath newpath Rename remote file
rm path Delete remote file
rmdir path Remove remote directory
symlink oldpath newpath Symlink remote file
version Show SFTP version
!command Execute 'command' in local shell
! Escape to local shell
? Synonym for help
sftp>
五、Windows客户端
putty或Xshell
六、OpenSSH服务器高级配置：
1、禁止root用户ssh登陆
编辑配置文件：
[root@computer ~]# vim /etc/ssh/sshd_config
将#PermitRootLogin yes 去掉注释，将yes更改为no
重启ssh服务：
[root@computer ~]# service sshd restart
测试：
[root@vn ~]# ssh root@192.168.175.138
root@192.168.175.138's password:
Permission denied, please try again. //连接被拒绝
2、创建SSH认证秘钥
ssh-keygen命令可以生成、管理和转换SSH认证秘钥，使用SSH v1创建RSA秘钥，使用SSH v2创建RSA或DSA秘钥。-t指定生成类型，默认为SSH v2连接的RSA秘钥。
命令语法：
ssh-kengen [选项]
[root@computer ~]# ssh-keygen help
Too many arguments.
usage: ssh-keygen [options]
Options:
-a trials Number of trials for screening DH-GEX moduli.
-B Show bubblebabble digest of key file.
-b bits Number of bits in the key to create.
-C comment Provide new comment.
-c Change comment in private and public key files.
-D pkcs11 Download public key from pkcs11 token.
-e Convert OpenSSH to RFC key file.
-F hostname Find hostname in known hosts file.
-f filename Filename of the key file.
-G file Generate candidates for DH-GEX moduli.
-g Use generic DNS resource record format.
-H Hash names in known_hosts file.
-h Generate host certificate instead of a user certificate.
-I key_id Key identifier to include in certificate.
-i Convert RFC to OpenSSH key file.
-L Print the contents of a certificate.
-l Show fingerprint of key file.
-M memory Amount of memory (MB) to use for generating DH-GEX moduli.
-N phrase Provide new passphrase.
-O option Specify a certificate option.
-P phrase Provide old passphrase.
-p Change passphrase of private key file.
-q Quiet.
-R hostname Remove host from known_hosts file.
-r hostname Print DNS resource record.
-S start Start point (hex) for generating DH-GEX moduli.
-s ca_key Certify keys with CA key.
-T file Screen candidates for DH-GEX moduli.
-t type Specify type of key to create.
-V from:to Specify certificate validity interval.
-v Verbose.
-W gen Generator to use for generating DH-GEX moduli.
-y Read private key file and print public key.
-Z name,... User/host principal names to include in certificate
-z serial Specify a serial number.
例1、创建RSA秘钥
[root@computer ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): //直接回车，使用默认文件保存秘钥
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): //输入秘钥保护密码
Enter same passphrase again: //再次输入秘钥保护密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
:5f:::4a:7a:9d:5a:fb::::c7:::b9 root@computer
The key's randomart image is:
+--[ RSA ]----+
| . .+. |
| o oo . |
| oo + . = |
| .. o = = +|
| S. o + +.|
| . o E |
| * |
| . |
| |
+-----------------+
例2、显示主机的公钥文件的SSHFP指纹资源记录
[root@computer ~]# ssh-keygen -r rhel
rhel IN SSHFP 38b3bd45ce295040ebb21a415f5a4674e36c0389
rhel IN SSHFP 2cf544964ba9cba2c1135f5decc96dd92a897c1d
例3、创建ssh认证秘钥，指定秘钥文件为/root/.ssh/known_hosts
[root@computer ~]# ssh-keygen -f /root/.ssh/known_hosts
[root@computer ~]# ssh-keygen -f /root/.ssh/known_hosts
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): //输入秘钥保护密码
Enter same passphrase again: //再次输入秘钥保护密码
Your identification has been saved in /root/.ssh/known_hosts.
Your public key has been saved in /root/.ssh/known_hosts.pub.
The key fingerprint is:
f8:b0:c0:8d:bd:1f:d3:c9:ae:e5::5f::ca::b9 root@computer
The key's randomart image is:
+--[ RSA ]----+
| |
| . |
| o |
| . + o . |
| + = E . |
| . = = o . . |
| o + O . . .|
| . B . . . |
| o.o . |
+-----------------+
例4、创建DSA秘钥
[root@computer ~]# ssh-keygen -d
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa): 直接回车，使用默认文件保存秘钥
Enter passphrase (empty for no passphrase): 使用秘钥保护密码
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:
b0:fd::1d::f2::b4:a0:cb:ad:be::3c:d2: root@computer
The key's randomart image is:
+--[ DSA ]----+
| .o.. |
| .+.o.o|
| . ...+ o.|
| + ..o . |
| . S .o . |
| oo o |
| E o.B |
| . = . |
| o. |
+-----------------+
七、使用秘钥认证方式连接OpenSSH服务器实例
服务器端：192.168.175.134 （hostname: vn)
客户端：192.168.175.138 (hostname: computer)
1、OpenSSH客户端配置
（1）、创建DSA秘钥
[root@computer ~]# ssh-keygen -d
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Passphrases do not match. Try again.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:
::0d::::dc:e8:b2:2b:::1d:7d:ba: root@computer
The key's randomart image is:
+--[ DSA ]----+
| .+*. |
| o*.o . |
| .o o o |
| . o+o E |
| . .ooS. o |
| . .o .. |
| o . |
| . . . |
| . |
+-----------------+
查看 /root/.ssh目录下生成的公钥和私钥文件：
[root@computer ~]# ls /root/.ssh/id_dsa*
/root/.ssh/id_dsa /root/.ssh/id_dsa.pub
安装公钥到OpenSSH服务器
[root@computer ~]# ssh-copy-id -i ~/.ssh/id_dsa.pub 192.168.175.134
The authenticity of host '192.168.175.134 (192.168.175.134)' can't be established.
RSA key fingerprint is 5e:0c:e1:cc:::a1:9b::d5:aa:2b:6d:7b:c3:.
Are you sure you want to continue connecting (yes/no)? yes 同意连接
Warning: Permanently added '192.168.175.134' (RSA) to the list of known hosts.
root@192.168.175.134's password: 输入主机192.168.175.134的root用户密码
Now try logging into the machine, with "ssh '192.168.175.134'", and check in: .ssh/authorized_keys to make sure we haven't added extra keys that you weren't expecting.
2、OpenSSH服务器配置
（1）、修改配置文件
# vim /etc/ssh/sshd_config
66 PasswordAuthentication no
（2）、重启服务
# service sshd restart
停止 sshd： [确定]
正在启动 sshd： [确定]
（3）、查看公钥(
[root@vn ~]# ls /root/.ssh/
authorized_keys known_hosts
[root@vn ~]# cat /root/.ssh/authorized_keys 该文件的内容和OpenSSH客户端上的公钥文件是一致的
ssh-dss AAAAB3NzaC1kc3MAAACBAPuwIw7NDzwNXWaxG5rUsySBzqMlGRTBtAqXWmA2gUsPgJXuf8F0y+cqjCt6EnISp98dPbUR9UkkGOtnl627kDrW1Q/zT6S4Z4d9QT94zEYhXZ8u3OJsxHW8vru1wEdyPG0AmYHrZyBONUdw8vjOn2RX1pIZ3qaHTgwcxWPPNH43AAAAFQDYTPLsiarPPiE1D5dQ0RcmfySwjQAAAIEA3aULtXsmcoB71kgZxj6iRIZpz+t06EfnRaXZbTCY7BlFNF16bY/Fjub/fOD51nZN4q9kaxkDFD6P7z2kMDP47j+9BVHEJFlCixUr8RimYCDPLgE8KIQuyt5ymdZ8TaGUOt1Fz5YsJ1YsSpk09rl0jGjl+vaqVVaihsGmmZdHkskAAACAZnNOLCE+T9mQmR4MNQUNFCDm0uDE8aet1UEHdh1GyQjLy4LfU/u2vRin8w4/2rmq2/zNUHTVXvWed/FG1oQQxSwUfOFhDmyh3mjl7O+fk1qznexC/mPuO3p49dhkkCBECqYGK9ZjrpLojoM7bxvkHT1TU86N7wLJK/n37/VIiXE= root@computer
3、连接OpenSSH服务器
[root@computer ~]# ssh 192.168.175.134
Enter passphrase for key '/root/.ssh/id_dsa': 输入秘钥保护密码
Last login: Fri Jul :: from 192.168.175.1
[root@vn ~]# ifconfig eth1|grep "inet addr" 登陆服务器成功
inet addr:192.168.175.134 Bcast:192.168.175.255 Mask:255.255.255.0