練習 27：安全 Shell，ssh，sshd，scp · 笨辦法學 Linux 中文版

# 練習 27：安全 Shell，`ssh`，`sshd`，`scp` > 原文：[Exercise 27. Networking: secure shell, ssh, sshd, scp](https://archive.fo/vzDDW) > 譯者：[飛龍](https://github.com/wizardforcel) > 協議：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) > 自豪地采用[谷歌翻譯](https://translate.google.cn/) 你可能已經知道，[SSH](https://en.wikipedia.org/wiki/Secure_Shell) 是一種網絡協議，允許你通過網絡登錄到`vm1`。讓我們詳細研究一下。 > 安全 Shell（SSH）是一種網絡協議，用于安全數據通信，遠程 Shell 服務或命令執行，以及其它兩個聯網計算機之間的網絡服務，它們通過不安全網絡上的安全通道連接：服務器和客戶端（運行 SSH 服務器和 SSH 客戶端程序）。協議規范區分了兩個主要版本，被稱為 SSH-1 和 SSH-2。 > 協議最著名的應用是，訪問類 Unix 操作系統上的 shell 帳戶。它為替代 Telnet 和其他不安全的遠程 shell 協議而設計，如 Berkeley rsh 和 rexec 協議，它們以明文形式發送信息，特別是密碼，使得它們易于使用封包分析來攔截和暴露。SSH 使用的加密旨在通過不安全的網絡（如互聯網）提供數據的機密性和完整性。重要的 SSH 程序，概念和配置文件： + [OpenSSH](https://en.wikipedia.org/wiki/OpenSSH) - 開源的 ssh 程序實現。 + `ssh` - 允許你連接到 SSH 服務器的客戶端程序。Putty 就是這樣的客戶端程序。 + `sshd` - 服務器程序，允許你使用`ssh`連接到它。 + `/etc/ssh/ssh_config` - 默認的客戶端程序配置文件。 + `/etc/ssh/sshd_config` - 默認服務器程序配置文件。 + [公鑰密碼系統](https://en.wikipedia.org/wiki/Public-key_cryptography) - 一種需要兩個單獨密鑰的加密系統，其中一個密鑰是私鑰，其中一個密鑰是公鑰。雖然不同，密鑰對的兩個部分在數學上是相關的。一旦密鑰鎖定或加密了明文，另一個密鑰解鎖或解密密文。兩個密鑰都不能執行這兩個功能。其中一個密鑰是公開發布的，另一個密鑰是保密的。 + SSH 密鑰 - SSH 使用公鑰密碼系統來認證遠程計算機，并允許它對用戶進行認證（如有必要）。任何人都可以生成一對匹配的不同密鑰（公鑰和私鑰）。公鑰放置在所有計算機上，它們允許訪問匹配的私鑰的所有者（所有者使私鑰保密）。雖然認證基于私鑰，但認證期間密鑰本身不會通過網絡傳輸。 + `/etc/ssh/moduli` - 質數及其生成器，由`sshd(8)`用于 Diffie-Hellman Group Exchange 密鑰交換方法中。 + `/etc/ssh/ssh_host_dsa_key`, `/etc/ssh/ssh_host_rsa_key` - 主機 RSA 和 DSA 私鑰。 + `/etc/ssh/ssh_host_dsa_key.pub`, `/etc/ssh/ssh_host_rsa_key.pub` - 主機 RSA 和 DSA 公鑰。 SSH 協議非常重要，因此被廣泛使用，并且具有如此多的功能，你必須了解它的一些工作原理。這是它的一些用途： + `scp` - 通過 SSH 傳輸文件。 + `sftp` - 類似 ftp 的協議，用于管理遠程文件。 + `sshfs` - SSH 上的遠程文件系統。 + SSH 隧道 - 一種通過安全連接，傳輸幾乎任何數據的方法。這是非常重要的，因為它可以用于構建受保護系統的基礎，以及許多其他用途。為了了解這個協議，讓我們看看，在 SSH 會話中會發生了什么。為此，我們將開始研究`vm1`到`vm1`的連接的帶注解的輸出（是的，這是可以做到的，也是完全有效的）。概述： ``` 你輸入 SSH VM1 控制權現在傳遞給 SSH 客戶端 SSH 客戶端進入明文階段讀取配置與 SSH 服務器進行協議協商進入 SSH 傳輸階段與 SSH 服務器進行協商數據加密密碼數據完整性算法數據壓縮算法使用 Diffie-Hellman 算法啟動密鑰交換所得共享密鑰用于建立安全連接進入 SSH-userauth 階段要求你輸入密碼控制權現在傳遞給你你輸入密碼控制權現在傳遞給 SSH 客戶端 SSH 客戶端在 SSH 服務器對你進行認證進入 SSH 連接階段為你分配偽終端為你啟動 shell 控制權現在傳遞給你你在 vm1 上做一些（沒）有用的事情關閉 shell 控制全現在傳遞給 SSH 客戶端 SSH 客戶端關閉偽終端關閉連接 ``` 現在閱讀這個： + [SSH 協議揭秘](https://www.linuxjournal.com/article/9566) + <http://www.cs.ust.hk/faculty/cding/COMP581/SLIDES/slide24.pdf> 并研究 SSH 會話的真實輸出： ``` user1@vm1:~$ ssh -vv vm1 Protocol version selection, plaintext ------------------------------------- OpenSSH_5.5p1 Debian-6+squeeze2, OpenSSL 0.9.8o 01 Jun 2010 # Speaks for itself, I will mark such entries with -- below debug1: Reading configuration data /etc/ssh/ssh_config # Applying default options for all hosts. Additional options for each host may be # specified in the configuration file debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to vm1 [127.0.1.1] port 22. debug1: Connection established. debug1: identity file /home/user1/.ssh/id_rsa type -1 # no such files debug1: identity file /home/user1/.ssh/id_rsa-cert type -1 debug1: identity file /home/user1/.ssh/id_dsa type -1 debug1: identity file /home/user1/.ssh/id_dsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-6+squeeze2 debug1: match: OpenSSH_5.5p1 Debian-6+squeeze2 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2 debug2: fd 3 setting O_NONBLOCK SSH-transport, binary packet protocol ------------------------------------- debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received # Key exchange algorithms debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 # SSH host key types debug2: kex_parse_kexinit: ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss # Data encryption ciphers debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se # Data integrity algorithms debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 # Data compression algorithms debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows debug2: kex_parse_kexinit: reserved 0 # Messages back from server debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 # Message authentication code setup debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none # Key exchange debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug2: dh_gen_key: priv key bits set: 135/256 debug2: bits set: 498/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY # Server authentication. vm1 host key is not known because it is our first connection debug2: no key of type 0 for host vm1 debug2: no key of type 2 for host vm1 # Confirmation of host key acceptance The authenticity of host 'vm1 '(127.0.1.1)' can't be established. RSA key fingerprint is b6:06:92:5e:04:49:d9:e8:57:90:61:1b:16:87:bb:09. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'vm1' (RSA) to the list of known hosts. # Key is added to /home/user1/.ssh/known_hosts and checked debug2: bits set: 499/1024 debug1: ssh_rsa_verify: signature correct # Based on shared master key, data encryption key and data integrity key are derived debug2: kex_derive_keys debug2: set_newkeys: mode 1 # Information about this is sent to server debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received # IP roaming not enabled? Not sure about this. debug1: Roaming not allowed by server SSH-userauth ------------ debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/user1/.ssh/id_rsa ((nil)) debug2: key: /home/user1/.ssh/id_dsa ((nil)) debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Trying private key: /home/user1/.ssh/id_rsa debug1: Trying private key: /home/user1/.ssh/id_dsa debug2: we did not send a packet, disable method debug1: Next authentication method: password user1@vm1''s password: debug2: we sent a password packet, wait for reply debug1: Authentication succeeded (password). SSH-connection -------------- debug1: channel 0: new [client-session] debug2: channel 0: send open # Disable SSH mutiplexing. # More info: http://www.linuxjournal.com/content/speed-multiple-ssh-connections-same-server debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug2: callback start debug2: client_session2_setup: id 0 debug2: channel 0: request pty-req confirm 1 # Sending environment variables debug1: Sending environment. debug1: Sending env LANG = en_US.UTF-8 debug2: channel 0: request env confirm 0 debug2: channel 0: request shell confirm 1 # Set TCP_NODELAY flag: http://en.wikipedia.org/wiki/Nagle%27s_algorithm debug2: fd 3 setting TCP_NODELAY debug2: callback done # Connection opened debug2: channel 0: open confirm rwindow 0 rmax 32768 debug2: channel_input_status_confirm: type 99 id 0 # Pseudo terminal allocation debug2: PTY allocation request accepted on channel 0 debug2: channel 0: rcvd adjust 2097152 debug2: channel_input_status_confirm: type 99 id 0 # Shell is started debug2: shell request accepted on channel 0 # Loggin in is completed Linux vm1 2.6.32-5-amd64 #1 SMP Sun May 6 04:00:17 UTC 2012 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. Last login: Thu Jul 19 05:14:40 2012 from 10.0.2.2 user1@vm1:~$ debug2: client_check_window_change: changed debug2: channel 0: request window-change confirm 0 user1@vm1:~$ debug2: client_check_window_change: changed debug2: channel 0: request window-change confirm 0 user1@vm1:~$ logout Ending ssh connection --------------------- debug2: channel 0: rcvd eof # end of file debug2: channel 0: output open -> drain debug2: channel 0: obuf empty debug2: channel 0: close_write debug2: channel 0: output drain -> closed debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 # signalling that channels are half-closed for writing, through a channel protocol extension # notification "eow@openssh.com" http://www.openssh.com/txt/release-5.1 debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0 debug2: channel 0: rcvd eow # Ending connection debug2: channel 0: close_read debug2: channel 0: input open -> closed debug2: channel 0: rcvd close debug2: channel 0: almost dead debug2: channel 0: gc: notify user debug2: channel 0: gc: user detached debug2: channel 0: send close debug2: channel 0: is dead debug2: channel 0: garbage collecting debug1: channel 0: free: client-session, nchannels 1 Connection to vm1 closed. Transferred: sent 1928, received 2632 bytes, in 93.2 seconds Bytes per second: sent 20.7, received 28.2 debug1: Exit status 0 user1@vm1:~$ ``` 現在，你將學習如何在調試模式下啟動`sshd`，使用`scp`建立公鑰認證和復制文件。 ## 這樣做 ``` 1: mkdir -v ssh_test 2: cd ssh_test 3: cp -v /etc/ssh/sshd_config . 4: sed -i'.bak' 's/^Port 22$/Port 1024/' sshd_config 5: sed -i 's/^HostKey \/etc\/ssh\/ssh_host_rsa_key$/Hostkey \/home\/user1\/ssh_test\/ssh_host_rsa_key/' sshd_config 6: sed -i 's/^HostKey \/etc\/ssh\/ssh_host_dsa_key$/Hostkey \/home\/user1\/ssh_test\/ssh_host_dsa_key/' sshd_config 7: diff sshd_config.bak sshd_config 8: ssh-keygen -b 4096 -t rsa -N '' -v -h -f ssh_host_rsa_key 9: ssh-keygen -b 1024 -t dsa -N '' -v -h -f ssh_host_dsa_key 10: ssh-keygen -b 4096 -t rsa -N '' -v -f ~/.ssh/id_rsa 11: cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys 12: /usr/sbin/sshd -Ddf sshd_config > sshd.out 2>&1 & 13: ssh-keyscan -H vm1 127.0.0.1 >> ~/.ssh/known_hosts 14: /usr/sbin/sshd -Ddf sshd_config >> sshd.out 2>&1 & 15: ssh vm1 -v -p 1024 2>ssh.out 16: ps au --forest 17: logout 18: /usr/sbin/sshd -Ddf sshd_config >> sshd.out 2>&1 & 19: scp -v -P 1024 vm1:.bashrc . 2>scp.out ``` ## 你會看到什么 ``` user1@vm1:~$ mkdir -v ssh_test mkdir: created directory 'ssh_test' user1@vm1:~$ cd ssh_test user1@vm1:~/ssh_test$ cp -v /etc/ssh/sshd_config . '/etc/ssh/sshd_config' -> './sshd_config' user1@vm1:~/ssh_test$ sed -i'.bak' 's/^Port 22$/Port 1024/' sshd_config user1@vm1:~/ssh_test$ sed -i 's/^HostKey \/etc\/ssh\/ssh_host_rsa_key$/Hostkey \/home\/user1\/ssh_test\/ssh_host_rsa_key/' sshd_config user1@vm1:~/ssh_test$ sed -i 's/^HostKey \/etc\/ssh\/ssh_host_dsa_key$/Hostkey \/home\/user1\/ssh_test\/ssh_host_dsa_key/' sshd_config user1@vm1:~/ssh_test$ diff sshd_config.bak sshd_config 5c5 < Port 22 --- > Port 1024 11,12c11,12 < HostKey /etc/ssh/ssh_host_rsa_key < HostKey /etc/ssh/ssh_host_dsa_key --- > Hostkey /home/user1/ssh_test/ssh_host_rsa_key > Hostkey /home/user1/ssh_test/ssh_host_dsa_key user1@vm1:~/ssh_test$ ssh-keygen -b 4096 -t rsa -N '' -v -h -f ssh_host_rsa_key Generating public/private rsa key pair. Your identification has been saved in ssh_host_rsa_key. Your public key has been saved in ssh_host_rsa_key.pub. The key fingerprint is: 8c:0a:8d:ae:c7:34:e6:29:9c:c2:14:29:b8:d9:1d:34 user1@vm1 'The key's randomart image is: +--[ RSA 4096]----+ | | | E | |. .. . | |oo o. o | |.++.... S | |oo=... | |+=oo. | |o== | |oo | +-----------------+ user1@vm1:~/ssh_test$ ssh-keygen -b 1024 -t dsa -N '' -v -h -f ssh_host_dsa_key Generating public/private dsa key pair. Your identification has been saved in ssh_host_dsa_key. Your public key has been saved in ssh_host_dsa_key.pub. The key fingerprint is: cd:6b:2a:a2:ba:80:65:71:85:ef:2e:6a:c0:a7:d9:aa user1@vm1 'The key's randomart image is: +--[ DSA 1024]----+ | .. | | .. | | . .. | | o . o | |. o . S o | |o+ . . . | |o.= . o | |.o..o o o | |E=+o o .. | +-----------------+ user1@vm1:~/ssh_test$ ssh-keygen -b 4096 -t rsa -N '' -v -f ~/.ssh/id_rsa Generating public/private rsa key pair. Your identification has been saved in /home/user1/.ssh/id_rsa. Your public key has been saved in /home/user1/.ssh/id_rsa.pub. The key fingerprint is: 50:65:18:61:3f:41:36:07:4f:40:36:a7:4b:6d:64:28 user1@vm1 'The key's randomart image is: +--[ RSA 4096]----+ | =B&+* | | oE=.& | | . .= + | | . . + | | S . | | | | | | | | | +-----------------+ user1@vm1:~/ssh_test$ cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys user1@vm1:~/ssh_test$ /usr/sbin/sshd -Ddf sshd_config > sshd.out 2>&1 & [2] 26896 user1@vm1:~/ssh_test$ ssh-keyscan -H vm1 127.0.0.1 >> ~/.ssh/known_hosts # 127.0.0.1 SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2 # vm1 SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2 [2]+ Exit 255 /usr/sbin/sshd -Ddf sshd_config > sshd.out 2>&1 user1@vm1:~/ssh_test$ /usr/sbin/sshd -Ddf sshd_config >> sshd.out 2>&1 & [1] 26957 user1@vm1:~/ssh_test$ ssh vm1 -v -p 1024 2>ssh.out Linux vm1 2.6.32-5-amd64 #1 SMP Sun May 6 04:00:17 UTC 2012 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. Last login: Fri Jul 20 09:10:30 2012 from vm1.site Environment: LANG=en_US.UTF-8 USER=user1 LOGNAME=user1 HOME=/home/user1 PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games MAIL=/var/mail/user1 SHELL=/bin/bash SSH_CLIENT=127.0.1.1 47456 1024 SSH_CONNECTION=127.0.1.1 47456 127.0.1.1 1024 SSH_TTY=/dev/pts/0 TERM=xterm user1@vm1:~$ ps au --forest USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND user1 26224 0.0 1.2 23660 6576 pts/2 Ss 09:09 0:01 -bash user1 27020 1.0 0.6 68392 3236 pts/2 S 09:50 0:00 \_ sshd: user1 [priv] user1 27025 0.0 0.2 68392 1412 pts/2 S 09:50 0:00 | \_ sshd: user1@pts/0 user1 27026 9.0 1.2 23564 6404 pts/0 Ss 09:50 0:00 | \_ -bash user1 27051 0.0 0.2 16308 1060 pts/0 R+ 09:50 0:00 | \_ ps au --forest user1 27021 1.1 0.5 38504 2880 pts/2 S+ 09:50 0:00 \_ ssh vm1 -v -p 1024 root 1107 0.0 0.1 5932 620 tty6 Ss+ Jul18 0:00 /sbin/getty 38400 tty6 root 1106 0.0 0.1 5932 616 tty5 Ss+ Jul18 0:00 /sbin/getty 38400 tty5 root 1105 0.0 0.1 5932 620 tty4 Ss+ Jul18 0:00 /sbin/getty 38400 tty4 root 1104 0.0 0.1 5932 620 tty3 Ss+ Jul18 0:00 /sbin/getty 38400 tty3 root 1103 0.0 0.1 5932 616 tty2 Ss+ Jul18 0:00 /sbin/getty 38400 tty2 root 1102 0.0 0.1 5932 616 tty1 Ss+ Jul18 0:00 /sbin/getty 38400 tty1 user1@vm1:~$ logout user1@vm1:~/ssh_test$ [1]+ Exit 255 /usr/sbin/sshd -Ddf sshd_config > sshd.out 2>&1 user1@vm1:~/ssh_test$ /usr/sbin/sshd -Ddf sshd_config >> sshd.out 2>&1 & [1] 27067 user1@vm1:~/ssh_test$ scp -v -P 1024 vm1:.bashrc . 2>scp.out Environment: LANG=en_US.UTF-8 USER=user1 LOGNAME=user1 HOME=/home/user1 PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games MAIL=/var/mail/user1 SHELL=/bin/bash SSH_CLIENT=127.0.1.1 47459 1024 SSH_CONNECTION=127.0.1.1 47459 127.0.1.1 1024 .bashrc 100% 3184 3.1KB/s 00:00 [1]+ Exit 255 /usr/sbin/sshd -Ddf sshd_config >> sshd.out 2>&1 ``` ## 解釋 1. 創建`/home/user1/ssh_test`目錄。 1. 使其成為當前工作目錄。 1. 將`sshd_config`復制到此目錄。 1. 將`sshd`監聽端口從 22 更改為 1024，將副本命名為`sshd_config.bak`。 1. 替換 RSA 主機密鑰位置。 1. 替換 DSA 主機密鑰位置。 1. 顯示`sshd_config`的舊版本和新版本之間的差異。 1. 生成具有空密碼的，新的 4096 位 RSA 主機密鑰對，將其保存到`/home/user1/ssh_test/ssh_host_rsa_key`和`/home/user1/ssh_test/ssh_host_rsa_key.pub`。 1. 同樣的，但是對 DSA 密鑰執行。 1. 生成新的認證密鑰對，將其保存到`/home/user1/.ssh/id_rsa`和`/home/user1/.ssh/id_rsa.pub`。 1. 將`id_rsa.pub`復制到`/home/user1/.ssh/authorized_keys`，來允許無密碼認證。 1. 在調試模式下，在端口 1024 上啟動新的 SSH 服務器，將所有輸出保存到`sshd.log`。 1. 提取 SSH 客戶端的主機認證密鑰，并將其提供給`/home/user1/.ssh/known_hosts`。 1. 在調試模式下，在端口 1024 上啟動新的 SSH 服務器，將所有輸出附加到`sshd.log`。這是因為在調試模式下， SSH 服務器只維護一個連接。 1. 使用`ssh`客戶端連接到此服務器。 1. 以樹形式打印當前正在運行的進程。你可以看到，你正在使用`sshd`啟動的 bash，它服務于你的連接，而`sshd`又是由`sshd`啟動，你在幾行之前啟動了你自己。。 1. 退出`ssh`會話。 1. 再次啟動 SSH 服務器。 1. 將文件`.bashrc`從你的主目錄復制到當前目錄。 ## 附加題觀看此視頻，它解釋了加密如何工作：<http://www.youtube.com/watch?v=3QnD2c4Xovk> 閱讀：<http://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch03_04.htm> 閱讀文件`ssh.out`，`scp.out`和`sshd.out`中的調試輸出。向你自己解釋發生了什么。