1、创建私有CA并进行证书申请。

创建CA所需要的文件

• 证书索引数据库文件 /etc/pki/CA/index.txt
• 证书的序列号文件 /etc/pki/CA/serial，指定初始值 01

生成CA私钥 /etc/pki/CA/private/cakey.pem

[root@bupt70 pki]# (umask 066; openssl genrsa -out CA/private/cakey.pem 2048)  
Generating RSA private key, 2048 bit long modulus  
....................................................+++  
........................................................................
..............................................+++  
e is 65537 (0x10001)  

生成CA自签名证书 /etc/pki/CA/cacert.pem

[root@bupt70 pki]# openssl req -x509 -new -key ./CA/private/cakey.pem -out ./CA/cacert.pem  -days 3650  
You are about to be asked to enter information that will be incorporated  
into your certificate request.  
What you are about to enter is what is called a Distinguished Name or a DN.  
There are quite a few fields but you can leave some blank  
For some fields there will be a default value,  
If you enter '.', the field will be left blank.  
-----  
Country Name (2 letter code) [XX]:CN             
State or Province Name (full name) []:xxxx          
Locality Name (eg, city) [Default City]:xxxx  
Organization Name (eg, company) [Default Company Ltd]:Rocket  
Organizational Unit Name (eg, section) []:IT  
Common Name (eg, your name or your server's hostname) []:www.rocket.com  
Email Address []:admin@rocket.com  
[root@bupt70 pki]# 

至此完成私有CA的创建

用户生成私钥和CA证书申请csr文件

[root@bupt70 application1]# (umask 066; openssl genrsa -out /data/application1/app1.key 2048)  
Generating RSA private key, 2048 bit long modulus  
..............+++  ..................................+++  
e is 65537 (0x10001) 

[root@bupt70 application1]# openssl req -new -key /data/application1/app1.key -out /data/application1/app1.csr  
You are about to be asked to enter information that will be incorporated  
into your certificate request.  
What you are about to enter is what is called a Distinguished Name or a DN.  
There are quite a few fields but you can leave some blank  
For some fields there will be a default value,  
If you enter '.', the field will be left blank.  
-----  
Country Name (2 letter code) [XX]:CN  
State or Province Name (full name) []:xxxx 
Locality Name (eg, city) [Default City]:xxxx 
Organization Name (eg, company) [Default Company Ltd]:Rocket  
Organizational Unit Name (eg, section) []:Sale     
Common Name (eg, your name or your server's hostname) []:app1.rocket.com  
Email Address []:app1@rocket.com  
Please enter the following 'extra' attributes  
to be sent with your certificate request  
A challenge password []:  
An optional company name []:  
[root@bupt70 application1]# 

生成证书文件*

[root@bupt70 CA]# openssl ca -in /data/application1/app1.csr -out /etc/pki/CA/certs/app1.crt -days 1000  
Using configuration from /etc/pki/tls/openssl.cnf  
Check that the request matches the signature  
Signature ok  
Certificate Details:  
       Serial Number: 1 (0x1)  
      Validity  
         Not Before: Jan 16 13:37:32 2022 GMT  
         Not After : Oct 12 13:37:32 2024 GMT  
      Subject:  
         countryName               = CN  
         stateOrProvinceName       = xxxx
         organizationName          = Rocket  
         organizationalUnitName    = Sale  
         commonName                = app1.rocket.com  
         emailAddress              = app1@rocket.com  
         X509v3 extensions:  
                X509v3 Basic Constraints:   
                CA:FALSE  
                Netscape Comment:   
                OpenSSL Generated Certificate  
                X509v3 Subject Key Identifier: 

2、总结ssh常用参数、用法

格式：ssh [参数] [远程主机] [命令]

ssh [user@]host [COMMAND]
ssh [-l user] host [COMMAND]

常用参数：
-l 指定连接远程服务器的用户名

[root@cent70 ~]# ssh -l thomas 10.0.0.181
thomas@10.0.0.181's password:

-o option，设置选项， 通常指定StrictHostKeyChecking=no 免去首次远程的验证添加交互

[root@cent70 ~]# ssh 10.0.0.122 -o StrictHostKeyChecking=no
Warning: Permanently added '10.0.0.122' (ECDSA) to the list of known hosts.
root@10.0.0.122's password:

-p port 指定远程服务器的端口（配置文件里可以修改端口）

[root@cent70 ~]# ssh -p 9527 10.0.0.181

-t 强制伪终端分配，可用于连续借助中间主机ssh登录

[root@centos8 ~]#ssh -t 10.0.0.8 ssh -t 10.0.0.7 ssh 10.0.0.6
root@10.0.0.8's password:
root@10.0.0.7's password:
root@10.0.0.6's password:
Last login: Fri May 22 09:10:28 2020 from 10.0.0.7
[root@centos6 ~]#

-v 显示调试信息模式，将 ssh处理信息过程显示出来以便排查登录异常原因

[root@cent70 ~]# ssh -v 10.0.0.122
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
...省略
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
root@10.0.0.122's password:

-X 支持x11协议转发，用于图形交互

[root@cent70 ~]# ssh -X 10.0.0.181 gedit
[root@cent70 ~]#

3、总结sshd服务常用参数。

Port
#ssh监听端口，默认22
ListenAddress ip
#默认监听所有IP，可在具有多个IP的服务器上指定监听IP，从而只允许指定IP远程
LoginGraceTime 2m
#ssh远程后输入密码登陆前的等待时间，默认120秒
PermitRootLogin yes
#ubuntu默认不允许root远程ssh登录，通过修改此参数即可
StrictModes yes 
#检查登录用户家目录以及.ssh/文件的所有者，权限等是否满足要求，通常家目录/.ssh目录权限是700，.ssh目录下文件是644或600（一般authorized_keys 和 id_rsa 是600）
MaxAuthTries 6 
#ssh本地登录的最大尝试次数，输入错误密码到6次则被拒绝登录.
MaxSessions 10 
#每个连接可以并行开启的最大会话数
MaxStartups
#未认证连接最大值（即打开ssh未输入密码的页面），默认值10
PubkeyAuthentication yes 
#启用基于key验证
PermitEmptyPasswords no
#允许账户空密码连接，默认禁用
PasswordAuthentication yes
#基于用户名和密码连接，默认启用
GatewayPorts no
#默认no表示端口转发绑定使用的地址是回环地址，修改成yes表示可以以非回环地址形式绑定端口转发，这样可以提供给其他主机访问。
ClientAliveInterval 0
#单位:秒，指定服务器向客户端请求消息的时间间隔，默认是0，修改成120代表每2分钟发送一次消息等待客户端相应，从而保持长连接。
ClientAliveCountMax 3 #默认3
#结合ClientAliveInterval，指的是客户端没有响应的超时限制是3次，达到3次没有相应就断开ssh。
UseDNS yes
#提高速度可改为no，启用主要是反向解析验证远程主机名是否和IP信息一致
GSSAPIAuthentication yes
#通过GSSAPI进行安全验证，默认开启，关闭可提高登录速度
Banner /path/file
#指定文件为ssh登录提示信息，默认无
#限制可登录用户的办法：
AllowUsers user1 user2 user3
DenyUsers user1 user2 user3
AllowGroups g1 g2
DenyGroups g1 g2

4、搭建dhcp服务，实现ip地址申请分发

本次验证基于VMware centos7实现，在验证前先关闭VMware对应模式的DHCP服务（NAT 或 host-only）
1、安装dhcp包（centos8上为dhcp-server）

[root@bupt71 ~]# yum install -y dhcp

2、dhcp主要文件

[root@bupt71 ~]# rpm -ql dhcp
...
/etc/dhcp/dhcpd.conf  #dhcp服务配置文件
/usr/sbin/dhcpd  #dhcp服务主程序
/usr/share/doc/dhcp-4.2.5/dhcpd.conf.example  #配置范例文件，直接复制内容过去修改使用即可
/usr/lib/systemd/system/dhcpd.service  #dhcp服务service文件

3、修改dhcpd.conf文件， 启动dhcp服务

[root@bupt71 ~]# cp /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example /etc/dhcp/dhcpd.conf
[root@bupt71 ~]# vim /etc/dhcp/dhcpd.conf

内容修改如下：

option domain-name-servers 10.0.0.2, 192.168.31.1, 180.76.76.76;
#添加dns服务器地址

default-lease-time 86400;
max-lease-time 8640000;
#自定义地址有效时间

subnet 10.0.0.0 netmask 255.255.255.0 {
  range 10.0.0.60 10.0.0.70;
  option routers 10.0.0.2, 10.0.0.1;
}
#定义dhcp分发的地址范围及路由网关
#跨网段的主机通过dhcp申请IP，需要在主机主机直连的路由器上开启中继功能，IP地址指向该路由网关

host host-1 {
  hardware ethernet 00:0c:29:1f:db:5b;
  fixed-address 10.0.0.80;
}
#绑定MAC地址和IP地址，注意静态dhcp分配地址不要跟上面动态分配的地址重合，否则会有冲突

启动服务

[root@bupt71 ~]# systemctl enable --now dhcpd
Created symlink from /etc/systemd/system/multi-user.target.wants/dhcpd.service to /usr/lib/systemd/system/dhcpd.service.
[root@bupt71 ~]# systemctl status dhcpd
● dhcpd.service - DHCPv4 Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/dhcpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Fri 2022-01-21 01:48:06 CST; 6s ago
     Docs: man:dhcpd(8)
           man:dhcpd.conf(5)
 Main PID: 1431 (dhcpd)
   Status: "Dispatching packets..."
   CGroup: /system.slice/dhcpd.service
           └─1431 /usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid

Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: All rights reserved.
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: For info, please visit https://www.isc.org/software/dhcp/
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Wrote 0 class decls to leases file.
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Wrote 0 deleted host decls to leases file.
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Wrote 0 new dynamic host decls to leases file.
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Wrote 0 leases to leases file.
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Listening on LPF/eth0/00:0c:29:e0:fe:fc/10.0.0.0/24
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Sending on   LPF/eth0/00:0c:29:e0:fe:fc/10.0.0.0/24
Jan 21 01:48:06 bupt71.edu.org dhcpd[1431]: Sending on   Socket/fallback/fallback-net
Jan 21 01:48:06 bupt71.edu.org systemd[1]: Started DHCPv4 Server Daemon.
[root@bupt71 ~]#

4、客户端dhcp获取ip地址
网卡设置为dhcp模式

[root@bupt81 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
NAME=eth0
DEVICE=eth0
ONBOOT=yes

重启网卡获取ip

[root@bupt81 ~]# ip address show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:1f:db:5b brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.80/24 brd 10.0.0.255 scope global dynamic noprefixroute eth0
       valid_lft 85997sec preferred_lft 85997sec
    inet6 fe80::690b:3200:1a27:6b43/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[root@bupt81 ~]#

[root@bupt72 ~]# ip a show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:0f:2d:72 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.60/24 brd 10.0.0.255 scope global noprefixroute dynamic eth0
       valid_lft 84205sec preferred_lft 84205sec
    inet6 fe80::3fb1:6d9d:49e6:79a7/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[root@bupt72 ~]#

dhcp服务已分配ip查看
dhcpd.leases仅记录动态分配记录

[root@bupt71 ~]# cat /var/lib/dhcpd/dhcpd.leases
# The format of this file is documented in the dhcpd.leases(5) manual page.
# This lease file was written by isc-dhcp-4.2.5

server-duid "\000\001\000\001)|o\222\000\014)\340\376\374";

lease 10.0.0.60 {
  starts 4 2022/01/20 19:08:05;
  ends 5 2022/01/21 19:08:05;
  cltt 4 2022/01/20 19:08:05;
  binding state active;
  next binding state free;
  rewind binding state free;
  hardware ethernet 00:0c:29:0f:2d:72;
  client-hostname "bupt72";
}

cat /var/log/message可以查看到静态分配的日志

Jan 21 03:08:04 bupt71 dhcpd: DHCPDISCOVER from 00:0c:29:0f:2d:72 via eth0
Jan 21 03:08:05 bupt71 dhcpd: DHCPOFFER on 10.0.0.60 to 00:0c:29:0f:2d:72 (bupt72) via eth0
Jan 21 03:08:05 bupt71 dhcpd: DHCPREQUEST for 10.0.0.60 (10.0.0.170) from 00:0c:29:0f:2d:72 (bupt72) via eth0
Jan 21 03:08:05 bupt71 dhcpd: DHCPACK on 10.0.0.60 to 00:0c:29:0f:2d:72 (bupt72) via eth0
Jan 21 03:17:33 bupt71 dhcpd: DHCPDISCOVER from 00:0c:29:1f:db:5b via eth0
Jan 21 03:17:33 bupt71 dhcpd: DHCPOFFER on 10.0.0.80 to 00:0c:29:1f:db:5b via eth0
Jan 21 03:17:33 bupt71 dhcpd: DHCPREQUEST for 10.0.0.80 (10.0.0.170) from 00:0c:29:1f:db:5b via eth0
Jan 21 03:17:33 bupt71 dhcpd: DHCPACK on 10.0.0.80 to 00:0c:29:1f:db:5b via eth0
[root@bupt71 ~]#