基于无密码的ssh访问

利用ssh-keygen去生成一把公钥和一把私钥，然后把公钥上传到服务器的一个指定的文件中，放到这个文件的公钥我们认为是一个受信任的公钥
如果我们第一次ssh一个服务器，服务器会把他的公钥发送给我们，我们必须输入yes接受这个公钥，然后这个公钥会存放到当前用户家目录下的.ssh/known_hosts这个文件里面。

[root@yaoguang .ssh]# ssh yaoguang
The authenticity of host 'yaoguang (fe80::20c:29ff:fe44:5ccc%ens160)' can't be establi
shed.ECDSA key fingerprint is SHA256:AdMOsDLpG65K5b3y7gLHt2FEBU8Hu4qARelb7v/Via4.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes   #服务器将密钥发送给客户端，输入yes接受密钥
Warning: Permanently added 'yaoguang,fe80::20c:29ff:fe44:5ccc%ens160' (ECDSA) to the l
ist of known hosts.root@yaoguang's password: 
Permission denied, please try again.
root@yaoguang's password:    ###输入密码，这个时候客户端用公钥加密输入的密码，然后密码发送给服务器，服务器用私钥解密以及验证这个公钥的合法性
Activate the web console with: systemctl enable --now cockpit.socket
Last failed login: Thu Mar 24 20:19:46 CST 2022 from fe80::20c:29ff:fe44:5ccc%ens160 o
n ssh:nottyThere was 1 failed login attempt since the last successful login.
Last login: Thu Mar 24 19:45:52 2022
[root@yaoguang ~]# exit
logout
Connection to yaoguang closed.
[root@yaoguang .ssh]# cat known_hosts 
yaoguang,fe80::20c:29ff:fe44:5ccc%ens160 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzd
HAyNTYAAAAIbmlzdHAyNTYAAABBBKasxxTPgHpmCOhRaxEI1LwonRS9p8tdVXcFOz8z0hLdcUO0O47qCmVldMHmbzvH3bM0LGbzLBhVah+AsKN5nw0=

[root@yaoguang .ssh]# ssh-keygen   #生成一把私钥和一把公钥，可以加-t知名密钥的算法，一种是rsa，一种是dsa，不加-t默认是rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):  #回车
Enter passphrase (empty for no passphrase):  #回车（是否给私钥设置密码)，如果给私钥设置密码，在连接服务器的时候需要输入私钥密码
Enter same passphrase again:  #回车
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:wTQu8AImD9Mh1EfbVVAR/olRPs97pG6aXssGnmsUW3k root@yaoguang
The key's randomart image is:
+---[RSA 3072]----+
|*o=.o.  oo+=o.   |
| B.o +o+... o    |
|  . o.o.+  o o . |
|     . . .  = B E|
|        S  . * +.|
|            +  o.|
|           o oo..|
|            +=o..|
|           o==+  |
+----[SHA256]-----+
[root@yaoguang .ssh]# ls
id_rsa  id_rsa.pub  known_hosts
[root@yaoguang .ssh]# ssh-copy-id -i id_rsa.pub yaoguang #ssh-copy-id这个工具把公钥上传到服务器当前用户的.ssh/authorized_keys文件中，
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
yaoguang^H^H^H^C
[root@yaoguang .ssh]# ssh-copy-id -i id_rsa.pub yaoguang
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out an
y that are already installed/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now
 it is to install the new keysroot@yaoguang's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'yaoguang'"
and check to make sure that only the key(s) you wanted were added.

[root@yaoguang .ssh]# ssh yaoguang
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Thu Mar 24 20:20:26 2022 from fe80::20c:29ff:fe44:5ccc%ens160

如果私钥设置了密码，使用ssh-agent和ssh-add这两个工具，然后在第一次远程登录输入密码后，之后在登录是不用手动输入密码的，agent这个工具会自动帮你输入密码。
每次重启都要操作这个步骤