如来神掌第一式第三招----SSH详解

 [root@work ~]# /usr/bin/ssh -v localhost
        OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013                    第一阶段,双方确认协议版本号和ssh版本号
        debug1: Reading configuration data /etc/ssh/ssh_config
        debug1: Applying options for *
        debug1: Connecting to localhost [::1] port 22.
        debug1: Connection established.
        debug1: permanently_set_uid: 0/0
        debug1: identity file /root/.ssh/identity type -1
        debug1: identity file /root/.ssh/identity-cert type -1
        debug1: identity file /root/.ssh/id_rsa type 1
        debug1: identity file /root/.ssh/id_rsa-cert type -1
        debug1: identity file /root/.ssh/id_dsa type -1
        debug1: identity file /root/.ssh/id_dsa-cert type -1
        debug1: identity file /root/.ssh/id_ecdsa type -1
        debug1: identity file /root/.ssh/id_ecdsa-cert type -1
        debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
        debug1: match: OpenSSH_5.3 pat OpenSSH*
        debug1: Enabling compatibility mode for protocol 2.0
        debug1: Local version string SSH-2.0-OpenSSH_5.3
        debug1: SSH2_MSG_KEXINIT sent                            #第二阶段,双方确认/支持使用的数据加密算法,消息摘要算法,
        debug1: SSH2_MSG_KEXINIT received
        debug1: kex: server->client aes128-ctr hmac-md5 none
        debug1: kex: client->server aes128-ctr hmac-md5 none
        debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
        debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
        debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
        debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
        The authenticity of host ‘localhost (::1)‘ can‘t be established.
        RSA key fingerprint is 23:67:cf:22:2c:74:27:ec:29:e1:d9:a6:49:cd:4c:a2.
        Are you sure you want to continue connecting (yes/no)? yes
        Warning: Permanently added ‘localhost‘ (RSA) to the list of known hosts.
        debug1: ssh_rsa_verify: signature correct
        debug1: SSH2_MSG_NEWKEYS sent
        debug1: expecting SSH2_MSG_NEWKEYS
        debug1: SSH2_MSG_NEWKEYS received
        debug1: SSH2_MSG_SERVICE_REQUEST sent
        debug1: SSH2_MSG_SERVICE_ACCEPT received
        debug1: Authentications that can continue: publickey,password
        debug1: Next authentication method: publickey
        debug1: Trying private key: /root/.ssh/identity
        debug1: Offering public key: /root/.ssh/id_rsa
        debug1: Authentications that can continue: publickey,password
        debug1: Trying private key: /root/.ssh/id_dsa
        debug1: Trying private key: /root/.ssh/id_ecdsa
        debug1: Next authentication method: password                #第三阶段,进入身份验证的过程
        root@localhost‘s password:
        debug1: Authentication succeeded (password).
        debug1: channel 0: new [client-session]
        debug1: Requesting no-more-sessions@openssh.com
        debug1: Entering interactive session.                         
        debug1: Sending environment.
        debug1: Sending env LANG = en_US.UTF-8
        Last login: Wed May 31 16:41:45 2017 from 192.168.199.1

[root@work ~]# rpm -qa|grep openssh; rpm -ql openssh-server  
openssh-5.3p1-104.el6.x86_64
openssh-clients-5.3p1-104.el6.x86_64
openssh-askpass-5.3p1-104.el6.x86_64
openssh-server-5.3p1-104.el6.x86_64

全部配置文件
/etc/pam.d/ssh-keycat
/etc/pam.d/sshd
/etc/rc.d/init.d/sshd
/etc/ssh/sshd_config      服务端配置文件
/etc/ssh/ssh_config 　　  客户端配置文件
/etc/sysconfig/sshd
/usr/libexec/openssh/sftp-server
/usr/libexec/openssh/ssh-keycat
/usr/sbin/.sshd.hmac
/usr/sbin/sshd
/usr/share/doc/openssh-server-5.3p1
/usr/share/doc/openssh-server-5.3p1/HOWTO.ssh-keycat
/usr/share/man/man5/moduli.5.gz
/usr/share/man/man5/sshd_config.5.gz
/usr/share/man/man8/sftp-server.8.gz
/usr/share/man/man8/sshd.8.gz
/var/empty/sshd

#       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

#Port 22    SSH服务端口号
#AddressFamily any          #指定运行时使用的协议簇如果配置只使用了 IPV6，而系统内没有启用 IPV6、或 IPV6 协议没有得到有效配置，就可能会导致出现Cannot bind any address问题
#ListenAddress 0.0.0.0    #监听IPV4地址
#ListenAddress ::          #监听IPV6地址

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2            #使用ssh2协议  也可以配置Protocol 2,1 代表i如果2协商不成功，再使用1 ，不建议配置

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key   # SSH version 1 使用的私钥 
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key  # SSH version 2 使用的 RSA 私钥 
#HostKey /etc/ssh/ssh_host_dsa_key  # SSH version 2 使用的 DSA 私钥 

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH    # 当有人使用 SSH 登入系统的时候，SSH会记录登陆信息，这个信息要记录在什么 daemon name 底下，预设是以 AUTH 来设定的，即是 /var/log/secure 里面 
SyslogFacility AUTHPRIV
#LogLevel INFO# 登录记录的等级 任何讯息！  QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 

# Authentication:

#LoginGraceTime 2m   当使用者连上 SSH server 之后，会出现输入密码的画面，在该画面中，在多久时间内没有成功连上 SSH server就断线！时间为秒！ 
#PermitRootLogin yes     #定义是否允许root登陆
#StrictModes yes
#MaxAuthTries 6   最大登陆尝试次数
#MaxSessions 10　　最大绘画连接数

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don‘t trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don‘t read the user‘s ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes# 定义是否使用密码登陆,如果准备使用公钥认证可以设置为no
#PermitEmptyPasswords no   # 定义是否允许空密码登陆.
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no     是否允许质疑-应答(challenge-response)认证。默认值是"yes"。

# Kerberos options 
#KerberosAuthentication no 
#KerberosOrLocalPasswd yes 
#KerberosTicketCleanup yes 
#KerberosGetAFSToken no 
#KerberosUseKuserok yes 
# GSSAPI options GSSAPIAuthentication no  #用于Kerberos验证的，而对于绝大多数人来说，不可能使用这种验证机制的，所以要注意把他们停掉。
#GSSAPIAuthentication yes 　　#是否允许使用基于 GSSAPI 的用户认证。默认值为"no"。仅用于SSH-2。
#GSSAPICleanupCredentials yes GSSAPICleanupCredentials yes 是否在用户退出登录后自动销毁用户凭证缓存。默认值是"yes"。仅用于SSH-2。
#GSSAPIStrictAcceptorCheck yes  
#GSSAPIKeyExchange no 
# Set this to ‘yes‘ to enable PAM authentication, account processing, 
# and session processing. If this is enabled, PAM authentication will 
# be allowed through the ChallengeResponseAuthentication and 
# PasswordAuthentication. Depending on your PAM configuration, 
# PAM authentication via ChallengeResponseAuthentication may bypass 
# the setting of "PermitRootLogin without-password". 
# If you just want the PAM account and session checks to run without 
# PAM authentication, then enable this but set PasswordAuthentication 
# and ChallengeResponseAuthentication to ‘no‘. 
#UsePAM no 
UsePAM yes     支持PAM,从而支持可**的安全模块,加载安全配置,如limit.conf等 
# Accept locale-related environment variables AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS 
#AllowAgentForwarding yes 
#AllowTcpForwarding yes 
#GatewayPorts no 
#X11Forwarding no X11Forwarding yes 
#X11DisplayOffset 10 
#X11UseLocalhost yes 
#PrintMotd yes 
#PrintLastLog yes 
#TCPKeepAlive yes 
#UseLogin no 　　是否在交互式会话的登录过程中使用 login(1) 。默认值是"no"。
#UsePrivilegeSeparation yes 
#PermitUserEnvironment no
#Compression delayed   开启压缩选项
#ClientAliveInterval 0 
#ClientAliveCountMax 3 
#ShowPatchLevel no 
UseDNS no #是否应该对远程主机名进行反向解析，以检查此主机名是否与其IP地址真实对应。默认值为"yes"。
#PidFile /var/run/sshd.pid 
#MaxStartups 10:30:100 
#PermitTunnel no 
#ChrootDirectory none 
# no default banner path 
#Banner none 
# override default of no subsystems 
Subsystem sftp /usr/libexec/openssh/sftp-server 
# Example of overriding settings on a per-user basis 
#Match User anoncvs 
# X11Forwarding no# 是否允许进行 X11 转发,如果允许X11转发并且sshd(8)代理的显示区被配置为在含有通配符的地址(X11UseLocalhost)上监听。那么将可能有额外的信息被泄漏。由于使用X11转发的可能带来的风险，此指令默认值为"no"。需要注意的是，禁止X11转发并不能禁止用户转发X11通信，因为用户可以安装他们自己的转发器。如果启用了 UseLogin ，那么X11转发将被自动禁止。
# AllowTcpForwarding no 
# ForceCommand cvs server

允许有1000次验证连接请求,如20秒不能完成校验,则断开验证连接请求 
有三次密码验证机会 
MaxStartups 1000 
LoginGraceTime 20 
MaxAuthTries 3

1、 expect程序
#!/usr/bin/expect -f
set timeout 10
set server [lindex $argv 0]
set user [lindex $argv 1]
set upasswd [lindex $argv 2]
set rpasswd [lindex $argv 3]
set "sudoers" [lindex $argv 4]
set "Keys" [lindex $argv 5]
set time [exec date +"%Y-%m-%d_%H:%M.%S"]
log_file /home/mssh/program/log/host/$server$time

spawn ssh -l $user $server -i "/root/.ssh/$Keys"
expect {
        "yes/no)?\ " {send "yes\r";exp_continue}
        "Pass*"  {send "$upasswd\r";exp_continue}
        "pass*"  {send "$upasswd\r";exp_continue}
        #"*ass*"  {send "$upasswd\r";exp_continue}
        "*@*"   {send "$sudoers\r"}
        }

expect {
        "pass*" {send "$rpasswd\r";exp_continue}
        "Pass*" {send "$rpasswd\r";exp_continue}
        "码" {send "$rpasswd\r";exp_continue}
        "*令*" {send "$rpasswd\r";exp_continue}
        "#"     interact
        }

调用执行程序
#!/bin/bash
#rm -rf ./log/*
PASSWDPath=/home/mssh/program/log/passwd.txt
>/home/mssh/program/log/run.log

if [ ! -d "/home/mssh/program/log/host" ]; then
        mkdir "/home/mssh/program/log/host"
fi
#cmd=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"`
host=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $1}‘`
user=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $2}‘`
upasswd=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $3}‘`
rpasswd=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $4}‘`
sudoers=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $5}‘`
keys=`cat /home/mssh/program/config/hosts.txt | grep -w "$1"| awk -F "|" ‘{print $8}‘`
/home/mssh/program/mssh.exp $host $user $upasswd $rpasswd "$sudoers" "$keys"

密码文件格式： 
10.200.64.221|gasd|123456|123456|su - root|JSSZ|JSSZ-AZ01-POD01-VRM-01|rd_rsa

(需要使用dos2unix  对密码文件进行转换，否则在读取密钥的时候会报 not accessible: No such file or directory.Linux和Windows文本文件的行结束标志不同。在Linux中，
文本文件用"/n"表示回车换行，而Windows用"/r/n"表示回车换行。有时候在Windows编写shell脚本时需要注意这个，否则shell脚本会报"No such file or directory"或"
command not found line x"之类的错误，如果不知晓前因后果，肯定会被这个折腾得相当郁闷。)


转换前

转换后

export HISTTIMEFORMAT="[%F %T]"
# history
USER_IP=`who -u am i 2>/dev/null| awk ‘{print $NF}‘|sed -e ‘s/[()]//g‘`
USER=`who am i 2>/dev/null| awk ‘{print $1}‘`
if [ "$USER_IP" = "" ]
then
  USER_IP=`hostname`
fi

if [ ! -d /tmp/.hist ]
then
   mkdir /tmp/.hist
   chmod 777 /tmp/.hist
fi

if [ ! -d /tmp/.hist/${LOGNAME} ]
then
    mkdir /tmp/.hist/${LOGNAME}
    chmod 300 /tmp/.hist/${LOGNAME}
fi
HISTSIZE=100000
export HISTSIZE
DT=`date "+%Y%m%d_%H%M%S"`
export DT
export DEL
HISTFILE="/tmp/.hist/${LOGNAME}/${USER}.hist"
chmod 600 /tmp/.hist/${LOGNAME}/*.hist 2>/dev/null
umask 022