由 reading 在 07-13-2004 10:03 发表:

如何让SSH只允许密钥连接？

我配置了服务器的 /etc/ssh/sshd_config

文件：

Package generated configuration file

See the sshd(8) manpage for details

What ports, IPs and protocols we listen for

Port 22

Use these options to restrict which interfaces/protocols sshd will bind to

#ListenAddress ::

#ListenAddress 0.0.0.0

Protocol 2

HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_dsa_key

#Privilege Separation is turned on for security

UsePrivilegeSeparation yes

Lifetime and size of ephemeral version 1 server key

KeyRegenerationInterval 3600

ServerKeyBits 768

Logging

SyslogFacility AUTH

LogLevel INFO

Authentication:

LoginGraceTime 600

PermitRootLogin no

StrictModes yes

RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile %h/.ssh/authorized_keys

Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

For this to work you will also need host keys in /etc/ssh_known_hosts

RhostsRSAAuthentication no

similar for protocol version 2

HostbasedAuthentication no

Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication

#IgnoreUserKnownHosts yes

To enable empty passwords, change to yes (NOT RECOMMENDED)

PermitEmptyPasswords no

Change to no to disable s/key passwords

ChallengeResponseAuthentication yes

Change to yes to enable tunnelled clear text passwords

PasswordAuthentication no

To change Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#AFSTokenPassing no

#KerberosTicketCleanup no

Kerberos TGT Passing does only work with the AFS kaserver

#KerberosTgtPassing yes

X11Forwarding no

X11DisplayOffset 10

PrintMotd no

PrintLastLog yes

KeepAlive yes

#UseLogin no

#MaxStartups 10:30:60

#Banner /etc/issue.net

Subsystem sftp /usr/lib/sftp-server

UsePAM yes

并且在客户端制作了密钥。并放到服务器端的

用户目录下/.ssh/ 改名为authorized_keys (而且chmod 0644)

可是我ssh的时候并不检查密钥。。。只能基于口令的连接。。

向大家请教。谢谢

=======================================

我的Oicq：160480

我的E-mail：[email protected]

家中电脑: C4 2G / 512M DDR 333 / 55G HD

GF4 64M / PHILIPS 150P2 / 8139c

Liton 16X DVD / Liton 8x D

由 yongjian 在 07-13-2004 12:21 发表:

用ssh -v 来登录看看.

由 taosiming 在 08-05-2004 10:34 发表:

现在有两台主机为inno1,inno3(OS:redhat 9.0)(也可以在一台机器上实验)

在inno1$HOME/.ssh上运行:

[inno-pdns@inno-1 inno-pdns]$mkdir .ssh;cd .ss