SSH — kalitlar, ~/.ssh/config, agent

~18 daq · Linux · Tarmoq

Muammodan boshlaylik

Har kuni:

ssh root@45.12.34.56
root@45.12.34.56's password: ************

Murakkab parolni har safar terish. Uchta server — uchta parol va uchta IP ni eslab qolish. Va eng yomoni — serverning auth.log ida (18-dars) minglab begona urinish: internetdagi botlar kechayu kunduz root paroliga "123456", "admin", "password" ni sinab ko'rmoqda.

SSH kalitlari bularning hammasini hal qiladi: parolsiz, xavfsizroq va qisqa nomlar bilan — ssh dokon.

SSH nima?

SSH (Secure Shell) — masofadagi kompyuterga shifrlangan ulanish. Siz terminalda yozasiz — buyruqlar serverda bajariladi. Tarmoqdagi hech kim (Wi-Fi da, provayderda) nima yozganingizni ko'ra olmaydi.

ssh foydalanuvchi@server
ssh otabek@45.12.34.56
ssh otabek@dokon.uz
ssh -p 2222 otabek@dokon.uz          # nostandart port

Birinchi ulanishda:

The authenticity of host '45.12.34.56' can't be established.
ED25519 key fingerprint is SHA256:x8Kj3...
Are you sure you want to continue connecting (yes/no)?

yes — server "barmoq izi" ~/.ssh/known_hosts ga saqlanadi. Keyingi safar SSH uni tekshiradi: kimdir serverni almashtirgan bo'lsa (yoki hujum bo'lsa) — ogohlantiradi.

[!WARNING] WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! — e'tiborsiz qoldirmang. Agar serverni o'zingiz qayta o'rnatgan bo'lsangiz — normal: ssh-keygen -R 45.12.34.56 bilan eski yozuvni o'chiring. Aks holda — hujum bo'lishi mumkin.

Bitta buyruqni bajarib, darhol chiqish:

ssh otabek@dokon.uz "uptime"
ssh otabek@dokon.uz "df -h /"
ssh otabek@dokon.uz "sudo systemctl restart dokon"

Chiqish — exit yoki Ctrl+D.

SSH kalitlari

Parol o'rniga — kalit jufti:

  • Yopiq kalit (private) — ~/.ssh/id_ed25519 — faqat sizning kompyuteringizda, hech kimga bermaysiz
  • Ochiq kalit (public) — ~/.ssh/id_ed25519.pub — serverlarga, GitHub ga qo'yasiz; uni hamma ko'rsa ham xavfsiz

Analogiya: ochiq kalit — qulf; uni istalgan eshikka o'rnatasiz. Yopiq kalit — faqat sizdagi kalit; u qulfni ochadi.

1. Kalit yaratish

ssh-keygen -t ed25519 -C "otabek@noutbuk"

Enter file in which to save the key (/home/otabek/.ssh/id_ed25519): [Enter]
Enter passphrase (empty for no passphrase): ********
  • -t ed25519 — zamonaviy, qisqa va xavfsiz algoritm (eski rsa o'rniga)
  • -C — izoh (qaysi kompyuterdan ekanini bilish uchun)
  • Passphrase — yopiq kalitni himoya qiladi: noutbuk o'g'irlansa ham kalit ishlatib bo'lmaydi. Tavsiya etiladi (agent bilan har safar yozish shart emas — pastda)
ls -l ~/.ssh/

-rw------- 1 otabek otabek  464 Nov  6 12:00 id_ed25519        ← YOPIQ, 600
-rw-r--r-- 1 otabek otabek  102 Nov  6 12:00 id_ed25519.pub    ← ochiq

2. Ochiq kalitni serverga qo'yish

ssh-copy-id otabek@45.12.34.56

Oxirgi marta parolni so'raydi va ochiq kalitni serverdagi ~/.ssh/authorized_keys fayliga qo'shadi.

ssh-copy-id yo'q bo'lsa (masalan, Windows PowerShell da) — qo'lda:

cat ~/.ssh/id_ed25519.pub | ssh otabek@45.12.34.56 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Parolsiz kirish

ssh otabek@45.12.34.56

Parol so'ralmaydi (yoki faqat kalitning passphrase i).

GitHub ga qo'shish

cat ~/.ssh/id_ed25519.pub

Chiqishni nusxalab: GitHub → Settings → SSH and GPG keys → New SSH key. Tekshirish:

ssh -T git@github.com

Hi otabek! You've successfully authenticated...

Endi git clone git@github.com:... — token siz ishlaydi.

Ruxsatlar — SSH qat'iy

SSH noto'g'ri ruxsatli kalitlarni ishlatishdan bosh tortadi (20-dars):

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys     # serverda
chmod 600 ~/.ssh/config

"Kalit bilan kira olmayapman" muammosining yarmi — ruxsatlarda. Ikkinchi yarmi — serverdagi uy papkaning o'zi boshqalarga yozish uchun ochiq bo'lishi (chmod 755 ~ yoki qat'iyroq).

~/.ssh/config — qisqa nomlar

nano ~/.ssh/config

Host dokon
    HostName 45.12.34.56
    User deploy
    IdentityFile ~/.ssh/id_ed25519

Host dokon-test
    HostName 45.12.34.99
    User deploy
    Port 2222

Host *
    ServerAliveInterval 60
    AddKeysToAgent yes

Endi:

ssh dokon
ssh dokon-test "uptime"
scp fayl.txt dokon:/tmp/             # 35-dars
  • ServerAliveInterval 60 — har 60 soniyada "tirikman" signali; ulanish bekor turganda uzilib qolmaydi
  • Host * — barcha serverlar uchun umumiy sozlamalar

Bir nechta GitHub hisobi (shaxsiy va ish):

Host github-ish
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_ish

git clone git@github-ish:kompaniya/loyiha.git

ssh-agent — passphrase ni bir marta

Passphrase har safar so'ralmasligi uchun — agent kalitni xotirada saqlaydi:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l                   # agentdagi kalitlar

macOS va ko'p Linux ish stollarida agent avtomatik ishlaydi. Config dagi AddKeysToAgent yes — birinchi ishlatishda o'zi qo'shadi.

Agent forwarding

Server orqali GitHub dan git pull qilish kerak, lekin yopiq kalitni serverga ko'chirish — yomon fikr:

ssh -A dokon
# serverda:
git pull                     # sizning lokal kalitingiz ishlatiladi

-A — agent so'rovlarini sizning kompyuteringizga "uzatadi". Faqat ishonchli serverlarda ishlating.

Port forwarding — tunnel

Serverdagi MySQL faqat 127.0.0.1:3306 da (32-dars) — tashqaridan yopiq. Lekin lokal kompyuteringizdagi DBeaver / TablePlus bilan ulanmoqchisiz:

ssh -L 3307:localhost:3306 dokon

Endi kompyuteringizdagi localhost:3307 → shifrlangan tunnel → serverdagi localhost:3306. DBeaver da localhost:3307 ga ulaning. Bazani internetga ochmasdan, xavfsiz kirish.

ssh -N -L 3307:localhost:3306 dokon     # -N — shell ochmasdan, faqat tunnel

Server tomoni: sshd sozlamalari

Kalit bilan kirish ishlashini tekshirgandan keyin, parolni o'chirish (42-dars):

sudo nano /etc/ssh/sshd_config

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo sshd -t                    # sintaksisni tekshirish
sudo systemctl restart ssh

[!WARNING] Parolni o'chirishdan oldin yangi terminalda kalit bilan kirish ishlashini tekshiring va eski sessiyani yopmang. Xato qilsangiz — ochiq sessiya orqali tuzatasiz. Aks holda serverdan butunlay qulflanib qolasiz (faqat hosting panelidagi konsol orqali kirish mumkin bo'ladi).

Nima uchun shunday?

Nima uchun kalit paroldan xavfsizroq?

Parol — sir, va uni server bilan bo'lishasiz: har kirishda u serverga yuboriladi (shifrlangan bo'lsa ham). Server buzilsa yoki soxta bo'lsa — parol o'g'irlanadi. Uni taxmin qilish ham mumkin: botlar millionlab variantni sinaydi. Kalitda esa yopiq qism hech qachon kompyuteringizdan chiqmaydi: server tasodifiy "savol" yuboradi, sizning kompyuteringiz yopiq kalit bilan "imzolaydi", server ochiq kalit bilan imzoni tekshiradi. Ochiq kalit o'g'irlansa ham — undan yopiqni hisoblab bo'lmaydi. ed25519 kalitni taxmin qilish esa amalda imkonsiz. Shuning uchun PasswordAuthentication no — har bir serverda birinchi qadam.

Xulosa

Eslab qoling:

  • ssh foydalanuvchi@server; ssh server "buyruq" — bitta buyruq
  • ssh-keygen -t ed25519 — kalit yaratish; passphrase — tavsiya
  • Yopiq kalit — faqat sizda (600); ochiq kalit — serverlarga, GitHub ga
  • ssh-copy-id server — ochiq kalitni authorized_keys ga
  • ~/.ssh/config — Host nomlari, User, Port, IdentityFile
  • ssh-add — agent; -A — forwarding (faqat ishonchli serverlarda)
  • ssh -L 3307:localhost:3306 server — tunnel
  • Serverda: PasswordAuthentication no, PermitRootLogin no — avval kalitni tekshirib

Keyingi dars

35-dars: Fayl ko'chirish — scp va rsync