Windows下SSH安装使用

Windows下SSH安装使用

1. 通过Cygwin安装

安装配置参考目录

Windows下安装和使用Git(Cygwin篇)

http://blog.csdn.net/GarfieldEr007/article/details/50913256

https://microtechnology-services.github.io/2016/04/29/cygwin-sshd-on-windows-domain.html

Windows 环境 cygwin 安装 SSH

  • 访问 www.cygwin.com, 点击 “Install now!” 链接, 此操作将会下载一个安装文件, setup-x86.exe(或 setup-x86_64.exe); 保存到 Foo. 安装文件 setup-x86_64.exe 是一个小程序,当你运行它时,会从互联网下载真正的安装文件.

  • 双击setup.exe,会出现一系列的对话框. 选择 “Install from Internet.” 。“Local Package Directory” 选择 Foo. 对于 “Select install root directory” 我们建议你使用默认的 C:\cygwin. 随后会需要选择连接类型,根据你的网络情况选择。下一步选择一个软件镜像,选择离你最近的一个(如163的镜像或 http://mirrors.ustc.edu.cn) .

  • 接下来会需要你选择需要安装的包。若你不想安装某个包,点击使其出现 “skip” . 对于最小化的安装,你只需要选择 “cygwin” 和“openssh”,或再选择vim, 大概 1900KB; 而整个安装的话包会大很多。

  • 需要设置 HOME 和 PATH 环境变量. Ssh 会在给定的HOME目录下创建一个 .ssh 目录, 从而有地方存放数据,如你的公共和私有密钥. PATH 必须被设置到 Cygwin的 bin 目录, 从而可以找到 ssh 的可执行文件.

  • 有些还设置了环境变量 CYGWIN = ntsec tty,这样应该后面配置ssh时不需要输入CYGWIN 的值了

  • 安装完成后以管理员身份运行cygwin终端,输入ssh-host-config对ssh进行配置

    需要注意的几个配置:

    • strict modes -> yes
    • privilege separation -> no (或yes,会问是否创建新的名为sshd的用户)
    • value of CYGWIN for the daemon - ntsec
    • user to run as ->cyg_server (or whichever one maps to your domain user in /etc/passwd )
$ ssh-host-config
*** Info: Generating missing SSH host keys
*** Query: Overwrite existing /etc/ssh_config file? (yes/no) yes
*** Info: Creating default /etc/ssh_config file
*** Query: Overwrite existing /etc/sshd_config file? (yes/no) yes
*** Info: Creating default /etc/sshd_config file
*** Info: StrictModes is set to 'yes' by default.
*** Info: This is the recommended setting, but it requires that the POSIX
*** Info: permissions of the user's home directory, the user's .ssh
*** Info: directory, and the user's ssh key files are tight so that
*** Info: only the user has write permissions.
*** Info: On the other hand, StrictModes don't work well with default
*** Info: Windows permissions of a home directory mounted with the
*** Info: 'noacl' option, and they don't work at all if the home
*** Info: directory is on a FAT or FAT32 partition.
*** Query: Should StrictModes be used? (yes/no) yes
*** Info: Privilege separation is set to 'sandbox' by default since
*** Info: OpenSSH 6.1. This is unsupported by Cygwin and has to be set
*** Info: to 'yes' or 'no'.
*** Info: However, using privilege separation requires a non-privileged account
*** Info: called 'sshd'.
*** Info: For more info on privilege separation read /usr/share/doc/openssh/README.privsep.
*** Query: Should privilege separation be used? (yes/no) no
*** Info: Updating /etc/sshd_config file
*** Query: Do you want to install sshd as a service?
*** Query: (Say "no" if it is already installed as a service) (yes/no) yes
*** Query: Enter the value of CYGWIN for the daemon: [] ntsec
*** Info: On Windows Server 2003, Windows Vista, and above, the
*** Info: SYSTEM account cannot setuid to other users -- a capability
*** Info: sshd requires. You need to have or to create a privileged
*** Info: account. This script will help you do so.
*** Info: It's not possible to use the LocalSystem account for services
*** Info: that can change the user id without an explicit password
*** Info: (such as passwordless logins [e.g. public key authentication]
*** Info: via sshd) when having to create the user token from scratch.
*** Info: For more information on this requirement, see
*** Info: https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-nopasswd1
*** Info: If you want to enable that functionality, it's required to create
*** Info: a new account with special privileges (unless such an account
*** Info: already exists). This account is then used to run these special
*** Info: servers.
*** Info: Note that creating a new user requires that the current account
*** Info: have Administrator privileges itself.
*** Info: No privileged account could be found.
*** Info: This script plans to use 'cyg_server'.
*** Info: 'cyg_server' will only be used by registered services.
*** Query: Do you want to use a different name? (yes/no) no
*** Query: Create new privileged user account 'HOUZHIWEI-PC\cyg_server' (Cygwin name: 'cyg_server')? (yes/no) yes
*** Info: Please enter a password for new user cyg_server. Please be sure
*** Info: that this password matches the password rules given on your system.
*** Info: Entering no password will exit the configuration.
*** Query: Please enter the password:
*** Query: Reenter:
*** Info: User 'cyg_server' has been created with password 'victorho'.
*** Info: If you change the password, please remember also to change the
*** Info: password for the installed services which use (or will soon use)
*** Info: the 'cyg_server' account.
*** Info: The sshd service has been installed under the 'cyg_server'
*** Info: account. To start the service now, call `net start sshd' or
*** Info: `cygrunsrv -S sshd'. Otherwise, it will start automatically
*** Info: after the next reboot.
*** Info: Host configuration finished. Have fun!
  • 启动服务

    net start sshdcygrunsrv -S sshd 。由于已经安装sshd为service,下次启动系统会自动启动

  • 测试 (在DOS命令行下也是可以的)

    $ ssh -V # 不是 ssh -version
    OpenSSH_7.2p2, OpenSSL 1.0.2j 26 Sep 2016

    或者测试登录远程主机:ssh <remote host> -l <login name>

ssh-keygen 基本用法

搬运自 ssh-keygen 基本用法

使用 ssh-kengen 会在~/.ssh/目录下生成两个文件,不指定文件名(-f)和密钥类型(-t, 有 DSA, RSA, ECDSA, ED25519等)的时候,默认生成的两个文件是:

  • id_rsa
  • id_rsa.pub

第一个是私钥文件,第二个是公钥文件。

生成ssh key的时候,可以通过 -f (file)选项指定生成文件的文件名,如下:

[huqiu@101 .ssh]$ ssh-keygen -f test -C "test key"
# ~~文件名 ~~~~ 备注(comment)

如果没有指定文件名,会询问你输入文件名:

[huqiu@101 .ssh]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/huqiu/.ssh/id_rsa):

你可以输入你想要的文件名,这里我们输入test

注意: 使用SSH连接Github或OSChina等时,可能会出现

Permission denied (publickey)

这是因为你使用了自己的文件名,而非默认的id_rsa

连接方式一:指定文件 ssh -i ~/.ssh/id_rsa_oschina

> $ ssh -i ~/.ssh/id_rsa_oschina git@git.oschina.net
> PTY allocation request failed on channel 0
> Welcome to Git@OSC, houzw!
> Connection to git.oschina.net closed.
>

>

方式二:修改.ssh目录下的配置文件config(若没有则先touch ~/.ssh/config)

通过这种方式可以配置多个ssh key

高效使用 SSH 的 16 个技巧OpenSSH Config File Examples

> Host github // 主机别名,不能重名。
> HostName github.com // 主机所在域名或IP. github的Host必须写成“github.com” 【如果Host写成主机域名,可以省略?】
> PreferredAuthentications publickey
> User git // 登录用户名,当远程服务器上的用户名和本地的用户名不同
> IdentityFile ~/.ssh/user2 // 私钥路径
> Port 22000 //端口号,可选
>

设置Host别名之后,ssh登录时可以使用 ssh username@Host 的形式代替 ssh username@HostName

Github的SSH测试 $ ssh -T git@github.com

密码

之后,会询问你是否需要输入密码(passphrase)。输入密码之后,以后每次都要输入密码。请根据你的安全需要决定是否需要密码,如果不需要,直接回车:

[huqiu@101 .ssh]$ ssh-keygen -t rsa -f test -C "test key"
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Passphrase也是一种密码,是在程序读取你的私钥文件时要用到的(即你的私钥文件被加密保存了).如果你想完全自动登录对端(不想交互式输入任何东西)那么这里可以不输入passphrase(直接回车),不过从安全性上面来说并不是太好(更好的办法是采用 ssh-agent 来加载密钥(加载时输入passphrase),然后在后面使用过程中就是 ssh-agent 与对端交互,不再需要输入passphrase了)

结果

如果文件名是test,结果是:

[huqiu@101 .ssh]$ ll test*
-rw------- 1 huqiu huqiu 1675 Sep 15 13:24 test
-rw-r--r-- 1 huqiu huqiu 390 Sep 15 13:24 test.pub

备注

上面生成的命令中,-C选项是公钥文件中的备注:

[huqiu@101 .ssh]$ cat test.pub
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAlgjiMw7AskxbvpQY9rmZPQxQBzh9laxFvbaini2EgmQkNsXBA9WJOXn2YBJauoiVsdUKBWA97avjsobrTxsCYvFr1yQQvTfTlbqlqGNIhQc/3HjTl2pIkClpDWvBrRN+jpyESS4MNbfOL1qjT4c/QhGvj6U6HrN6kUyn58oyyJpTzOLG74AZELJ2Led57QvTw1yJXZuAMWioR0A3BGd25fdocLX3ebux6ya8AsloOVYfsAqGlggrARe6FXjLfMH4a/nxaAdiDYVXU/Vr1ybK9P7SfyEDGJi3JtgiPUlA6vPxUC
E+9IJPQaqqeqCGzrJ6G/XO7om1v9YLLG/H/ZN2tQ== test key # ~~~~备注

文件的权限

为了让私钥文件和公钥文件能够在认证中起作用,请确保权限正确。

对于.ssh 以及父文件夹,当前用户用户一定要有执行权限,其他用户最多只能有执行权限

对于公钥和私钥文件也是: 当前用户一定要有执行权限,其他用户最多只能有执行权限。

  • 对于客户端: 私钥必须为600权限或者更严格权限(400),一旦其他用户可读,私钥就不起作用(如640),表现为系统认为不存在私钥。
  • 对于服务器端:要求必须公钥其他用户不可写,一旦其他用户可写(如660),就无法用key登录,表现为:Permission denied(publickey)
  • 同时要求.ssh目录其他用户不可写,一旦其他用户可写(如770),就无法使用key登录,表现为:Permission denied(publickey)

不仅.ssh目录,更上 层的目录的权限同样会有影响。

home中用户目录的可写,表示其他用户对.ssh子目录也有改写的权限(删除或重命令),也就导致ssh判断.ssh为其他用户可写,拒绝使用key登录。

对于利用公钥登录,对其他用户配置执行权限是没有问题的。但是对于git,公钥和私钥, 以及config等相关文件的权限,其他用户不可有任何权限。

> chmod 700 ~/.ssh
> chmod 600 ~/.ssh/authorized_keys
>

>

SSH免密码登录

生成密钥

D:\Program Files\ConsoleZ>ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/houzhiwei/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/houzhiwei/.ssh/id_rsa.
Your public key has been saved in /home/houzhiwei/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:mclUKbp4BzSf7pMP6+iB55xOzgLIj79gHc+9eF1gsR0 houzhiwei@houzhiwei-PC
The key's randomart image is:
+---[RSA 2048]----+
| .. |
| o .o.E |
| . +.o+ . |
| oooB . |
|.. . . +S . |
|..o =.+ o . |
| ooo.+++o.. |
|.....B.==+ |
| .o.=@ooo. |
+----[SHA256]-----+
D:\Program Files\ConsoleZ>

将公钥拷贝到目标服务器:

  • 使用ssh-copy-id 工具

这一次要输入密码.如果生成密钥时输入了passphrase的话,这里还得输入passphrase

houzw@houzw-PC ~/.ssh
$ ssh-copy-id -i ~/.ssh/id_rsa_centos.pub houzw@192.168.1.109
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/houzw/.ssh/id_rsa_centos.pub"
The authenticity of host '192.168.1.109 (192.168.1.109)' can't be established.
ECDSA key fingerprint is SHA256:kCnXmyP9B/4nm+OLG5Nm6NiFOgg2YO3kkjPq3aS08yo.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
houzw@192.168.1.109's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'houzw@192.168.1.109'"
and check to make sure that only the key(s) you wanted were added.

ssh-copy-id 把本地主机的公钥复制到远程主机的authorized_keys文件上,也会给远程主机的用户主目录(home)和~/.ssh, 和~/.ssh/authorized_keys设置合适的权限 。

如果需要指定端口

ssh-copy-id -i /path/key/file.pub "user@server.example.com -p 4242"

如果设置之后还是需要输入密码,请检查服务器.ssh~/.ssh/authorized_keys的权限及本机sshconfigconfig中设置Host别名之后,ssh登录时可以使用 ssh username@Host 的形式代替 ssh username@HostName 。如

> Host centos
> HostName 192.168.1.109
> IdentityFile ~/.ssh/id_rsa_centos
> User houzw
>

>

则可以用ssh houzw@centos 登录。这时候再使用 ssh houzw@192.168.1.109 就需要输入密码了

  • 使用scp,第一次会要求输入一次密码

scp -i ~/.ssh/id_rsa_centos.pub houzw@192.168.1.109:~/.ssh/authorized_keys

  • 先登录,再拷贝,再添加(考虑到权限问题)
$ ssh username@www-03.nixcraft "umask 077; mkdir .ssh"
$ cat $HOME/.ssh/id_rsa.pub | ssh username@www-03.nixcraft "cat >> .ssh/authorized_keys"

删除ssh中旧的公钥记录

ssh-keygen -f "~/.ssh/known_hosts" -R 192.168.1.254

如果mkstemp: No such file or directory),去掉-f参数

houzw@houzw-PC ~/.ssh
$ ssh-keygen -R 192.168.1.109
# Host 192.168.1.109 found: line 3
/home/houzw/.ssh/known_hosts updated.
Original contents retained as /home/houzw/.ssh/known_hosts.old

关于HOME环境变量:最好不设置!

Cygwin确定用户主目录有几个原则,依照顺序确定主目录。首先查看系统的HOME环境变量,其次查看/etc/passwd中为用户设置的主目录。有的软件遵照这个原则,而有些Cygwin应用,如ssh,却没有使用HOME环境变量而直接使用/etc/passwd中的的设置(这会导致ssh-keygen 生成的密钥对文件不会存放到设置的HOME目录(如D:\Programs\SSH,即 /cygdrive/d/Programs/SSH)下,而是其默认目录下,如/home/houzw/.ssh/id_rsa)。要想避免在同一个Cygwin环境下有两个不同的用户主目录设置,可以采用下面两种方法。

  • 方法1:修改Cygwin启动的批处理文件(如:C:\cygwin\Cygwin.bat),在批处理的开头添加如下的一行,就可以清除其他软件为Windows引入的HOME环境变量。set HOME=

    此方法时,ssh-keygen还是默认使用的/etc/passwd中的的设置

  • 方法2:如果希望使用HOME环境变量指向的主目录,则通过手工编辑/etc/passwd文件,将其中用户主目录修改成HOME环境变量所指向的目录。(ssh-keygen不再使用默认的/etc/passwd中的的设置,但是ssh localhost登录之后仍是其中的路径,没办法免密码登录localhost ?)

    若没有passwd文件,则创建一个:mkpasswd -l > /etc/passwd ,内容会自动生成。

    passwd文件每一行内容: 用户名:口令:用户标识号:组标识号:注释性描述:主目录:登录Shell

    houzw:*:197608:197121:U-houzw-PC\houzw,S-1-5-21-1228681770-2473699563-3202222160-1000:/home/houzw:/bin/bash中的/home/houzw 修改为/cygdrive/d/Programs/SSH

最好就使用默认的主目录,不然无法免密码登录(也有可能我哪里设置有问题)


移除已有的 sshd 服务和用户

如果想移除已存在的一个sshd服务,先停止然后移除

cygrunsrv --stop sshd # 或 net stop sshd
cygrunsrv --remove sshd # 或 cygrunsrv --R sshd

然后删除本机的 cyg_server 用户(net user cyg_server /del)(或你自己在ssh-host-config中设置的用户名).


移除 Cygwin

# sotp sshd
net stop sshd
# 刪除 cygwin
sc delete sshd
# 刪除帳號 sshd cyg_server
net user sshd /del
net user cyg_server /del
#
takeown /f C:\cygwin /r /d y
icacls c:\cygwin /t /grant everyone:F
# 刪除檔案目錄
rmdir /s /q c:\cygwin

2. 使用Git

下载安装

文章目录
  1. 1. Windows下SSH安装使用
    1. 1.1. 1. 通过Cygwin安装
    2. 1.2. ssh-keygen 基本用法
      1. 1.2.1. 密码
      2. 1.2.2. 结果
      3. 1.2.3. 备注
      4. 1.2.4. 文件的权限
      5. 1.2.5. SSH免密码登录
        1. 1.2.5.1. 生成密钥
        2. 1.2.5.2. 将公钥拷贝到目标服务器:
      6. 1.2.6. 删除ssh中旧的公钥记录
        1. 1.2.6.1. 关于HOME环境变量:最好不设置!
    3. 1.3. 移除已有的 sshd 服务和用户
    4. 1.4. 2. 使用Git
|