1、创建私有CA并进行证书申请。
1.1、 创建CA相关目录和文件
[root@centos8 ~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts,private}
[root@centos8 ~]# touch /etc/pki/CA/index.txt
[root@centos8 ~]# echo 01 > /etc/pki/CA/serial
1.2、创建CA的私钥
[root@centos8 ~]# cd /etc/pki/CA/
[root@centos8 ~]# (umask 066; openssl genrsa -out private/cakey.pem 2048)
1.3、给CA颁发自签名证书
[root@centos8 ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 3650 -out /etc/pki/CA/cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:zhejiang
Locality Name (eg, city) [Default City]:hangzhou
Organization Name (eg, company) [Default Company Ltd]:ddq
Organizational Unit Name (eg, section) []:devops
Common Name (eg, your name or your server's hostname) []:ca.ddq.org
Email Address []:admin@ddq.org
1.4、用户生成私钥和证书申请文件
[root@centos8 ~]# mkdir /data1/app1
[root@centos8 ~]# (umask 066; openssl genrsa -out /data1/app1/app1.key 2048)
[root@centos8 ~]# req -new -key /data1/app1/app1.key -out /data1/app1/app1.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:zhejiang
Locality Name (eg, city) [Default City]:hangzhou
Organization Name (eg, company) [Default Company Ltd]:ddq
Organizational Unit Name (eg, section) []:it
Common Name (eg, your name or your server's hostname) []:app1.ddq.org
Email Address []:root@ddq.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#默认有三项内容必须和CA一致：国家，省份，组织
1.5、 CA颁发证书
[root@centos8 ~]# openssl ca -in /data1/app1/app1.csr -out /etc/pki/CA/certs/app1.crt -days 1000
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 22 01:39:46 2021 GMT
Not After : Mar 18 01:39:46 2024 GMT
Subject:
countryName = CN
stateOrProvinceName = zhejiang
organizationName = ddq
organizationalUnitName = it
commonName = app1.ddq.org
emailAddress = root@ddq.org
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A9:62:68:F2:83:26:04:EE:DC:E9:08:D2:73:87:10:74:5F:73:7A:39
X509v3 Authority Key Identifier:
keyid:AA:44:47:6C:3B:EC:B8:F8:35:A9:09:45:C8:B3:F7:CB:31:1A:9C:7E
Certificate is to be certified until Mar 18 01:39:46 2024 GMT (1000 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
1.6、 查看证书
[root@centos8 ~]# openssl x509 -in /etc/pki/CA/certs/app1.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CN, ST=zhejiang, L=hangzhou, O=ddq, OU=devops, CN=ca.ddq.org/emailAddress=admin@ddq.org
Validity
Not Before: Jun 22 01:39:46 2021 GMT
Not After : Mar 18 01:39:46 2024 GMT
Subject: C=CN, ST=zhejiang, O=ddq, OU=it, CN=app1.ddq.org/emailAddress=root@ddq.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bb:c1:52:91:5a:23:f7:30:29:03:d8:9b:fe:41:
02:99:e0:75:8d:88:33:87:96:26:89:d4:02:84:c6:
2f:6b:c9:b4:37:0c:b5:dc:a9:fc:3e:19:24:d8:38:
83:88:2f:b0:e6:55:00:76:bb:38:33:12:5a:ac:eb:
f6:7f:8a:1b:3b:79:e0:60:25:71:3d:7f:6d:88:aa:
77:58:c0:29:72:e3:d8:16:53:66:8c:d3:f6:c7:1b:
75:94:ea:e1:58:8c:27:ba:41:74:7c:1c:1f:38:f8:
b4:c7:17:6b:b2:68:7f:ec:b8:7f:ac:4a:d0:a5:88:
63:07:28:ca:0d:aa:ce:36:0b:23:4f:e4:5e:d4:dd:
b8:3f:a1:14:5e:e5:36:47:f9:e6:9b:ea:da:85:a7:
72:32:5b:54:dd:a2:2a:68:f8:65:93:da:62:28:ac:
cf:9b:46:56:49:e8:8e:ee:46:01:f2:67:4d:69:20:
2a:c3:a5:cc:c9:52:62:8f:07:3a:6c:30:49:00:8a:
df:7d:5a:95:d1:74:6b:a0:dc:cd:63:8e:cf:96:ff:
05:91:4d:9f:bd:eb:1a:00:47:90:81:c5:c6:c2:15:
8a:d0:6a:33:6d:d2:1f:d2:12:ed:db:68:c4:4b:b6:
26:4e:db:d6:a0:fc:a7:b4:06:a6:f5:f2:ed:2e:b5:
8a:f1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A9:62:68:F2:83:26:04:EE:DC:E9:08:D2:73:87:10:74:5F:73:7A:39
X509v3 Authority Key Identifier:
keyid:AA:44:47:6C:3B:EC:B8:F8:35:A9:09:45:C8:B3:F7:CB:31:1A:9C:7E
Signature Algorithm: sha256WithRSAEncryption
92:c6:c1:6a:6e:2d:df:d6:ab:ff:aa:32:6e:fc:76:7b:dc:52:
e8:fd:2e:e9:c2:b5:fa:3d:5d:c3:0b:1f:d6:75:1d:4e:18:19:
26:6e:13:88:df:ff:6e:56:c0:18:ea:8c:7a:95:43:e5:fd:b4:
11:bd:c2:10:05:9e:6b:9f:bc:d6:8a:44:0a:4f:09:7a:bf:c4:
3a:88:1c:23:29:0d:98:12:d3:ea:3c:8c:8a:31:43:7d:c4:58:
8f:e2:96:26:91:d3:e9:c4:64:3a:f9:86:f2:0e:60:52:af:b1:
62:59:63:3f:5c:96:82:de:a7:b0:43:4a:9d:67:aa:91:41:1e:
86:60:ba:0f:eb:b0:32:d5:27:83:87:4f:b2:6a:07:ff:4e:c0:
36:10:fa:46:e2:a6:39:a3:c3:35:43:46:4b:5c:9f:12:1a:8b:
1d:90:2a:99:c4:4d:e2:70:f2:2d:c5:a4:5b:f1:80:d2:6c:ca:
b3:d5:83:fe:86:ca:28:b2:ad:3e:c2:8f:ee:67:5c:99:45:97:
07:8c:1c:a7:1b:6a:4e:21:86:8c:7a:f5:30:af:e5:13:1b:92:
92:ee:3d:9c:f2:b1:6d:6a:b7:a4:32:09:49:07:35:db:c9:df:
03:ca:6d:5b:58:d8:b4:29:9c:59:d4:5d:6a:3c:8f:23:e7:64:
ca:ec:fd:59
#验证指定编号的对应证书有效性
[root@centos8 ~]# openssl ca -status 01
Using configuration from /etc/pki/tls/openssl.cnf
01=Valid (V)
[root@centos8 ~]# cat /etc/pki/CA/index.txt
V 240318013946Z 01 unknown /C=CN/ST=zhejiang/O=ddq/OU=it/CN=app1.ddq.org/emailAddress=root@ddq.org
[root@centos8 ~]# cat /etc/pki/CA/index.txt.old
[root@centos8 ~]# cat /etc/pki/CA/serial
02
[root@centos8 ~]# cat /etc/pki/CA/serial.old
01
1.7 将证书相关文件发送到客户端使用
[root@centos8 ~]# cp /etc/pki/CA/certs/app1.crt /data1/app1/
[root@centos8 ~]# tree /data1/app1/
/data1/app1/
├── app1.crt
├── app1.csr
└── app1.key
0 directories, 3 files
1.8 证书的信任
默认生成的证书，在windows上是不被信任的，可以通过将CA的自签名证书导入到windows的 受信任的根证书颁发机构 使私有CA签名的证书都获得windows的信任
2、总结ssh常用参数、用法
格式
ssh [user@]host [COMMAND]
ssh [-l user] host [COMMAND]
常用选项
-p port: 远程服务器监听端口
-b 指定连接的源IP
-v 调试模式
-C 压缩方式
-X 支持x11转发
-t 支持伪tty分配，如： ssh -t remoteserver1 ssh -t remoteserver2 ssh remoteserver3
-o option 如： StrictHostKeyChecking=no
-i <file> 指定私钥文件路径，实现基于key验证，默认使用文件： ~/.ssh/id_dsa，~/.ssh/id_ecdsa， ~/.ssh/id_ed25519，~/.ssh/id_rsa等
3、总结sshd服务常用参数。
常用参数
Port
ListenAddress ip
LoginGraceTime 2m
PermitRootLogin yes #默认ubuntu不允许root远程ssh登录
StrictModes yes #检查.ssh/文件的所有者，权限等
MaxAuthTries 6 #pecifies the maximum number of authentication
attempts permitted per connection. Once the number of failures reaches half
this value, additional failures are logged. The default is 6.
MaxSessions 10 #同一个连接最大会话
PubkeyAuthentication yes #基于key验证
PermitEmptyPasswords no #空密码连接
PasswordAuthentication yes #基于用户名和密码连接
GatewayPorts no
ClientAliveInterval 10 #单位:秒
ClientAliveCountMax 3 #默认3
UseDNS yes #提高速度可改为no
GSSAPIAuthentication yes #提高速度可改为no
MaxStartups #未认证连接最大值，默认值10
Banner /path/file以下可以限制可登录用户的办法：
AllowUsers user1 user2 user3
DenyUsers user1 user2 user3
AllowGroups g1 g2
DenyGroups g1 g2
