Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Сервер: ОС Ubuntu 22.04, openssh 8.9p1, ip-адрес 192.168.88.129.
  2. Клиент: ОС Ubuntu 23.10, openssh 8.9p1.

...

  1. 9.3p1, ip-адрес 192.168.88.147.

Настройка клиента:

  1. Для включение защиты по пин-коду необходимо установить пакет ssh-askpass. Для этого необходимо открыть терминал и выполнить команду:
    Code Block
    languagebash
    $ sudo apt-get install 

...

  1. ssh-askpass
  2. Укажем ssh-agent что необходимо запрашивать пин-код. Выполним команду

Настройка клиента:

  1. открываем терминал и создаем папку для ключей:
    Code Block
    languagebash
    $ mkdir ~/.ssh eval "$(ssh-agent -s; SSH_ASKPASS=/usr/bin/ssh-askpass)"
  2. Генерируем ключи:
    Code Block
    languagebash
    $ cd ~/.ssh
    $ sh-keygen -t ecdsa-sk -O resident -O application=ssh:YourTextHere -O verify-required
    Generating public/private ecdsa-sk key pair.
    You may need to touch your authenticator to authorize key generation.
    Enter PIN for authenticator: 
    Enter file in which to save the key (/home/tester/.ssh/id_ecdsa_sk):  
    /home/tester/.ssh/id_ecdsa_sk already exists.
    Overwrite (y/n)? y
    Enter passphrase (empty for no passphrase):  
    Enter same passphrase again:  
    Your identification has been saved in /home/tester/.ssh/id_ecdsa_sk
    Your public key has been saved in /home/tester/.ssh/id_ecdsa_sk.pub
    The key fingerprint is:
    SHA256:veX8eVHMp6r5jmrCtyonIK/bymj/22cyB8KytayhCz0 tester@192.168.88.141vIIfHBajgeOHYoMjbzaE2eUoXU40jwSALfpuHjr9YA tester@tester2310
    The key's randomart image is:
    +-[ECDSA-SK 256]--+
    |                +.o+ .           |
    | .ooO .                  |
    |               o o= *           |
    |         .      =|
    |    .   S . .  .o|
    |.... + .   =  ...=. o            |
    |+.o.  + S        |
    |.+ooo* @         |
    |o.E+= B =        |
    |.oEo=o.o o +.o     . o.  .|
    |+ooo+o=oo+ o...+.  . ..|
    |*B+oo*o*Oo++o o.oo      |
    +----[SHA256]-----+
  3. Копируем открытый ключ на сервер
    Code Block
    languagebash
    $ ssh-copy-id -i /home/tester/.ssh/id_ecdsa_sk.pub tester@192.168.88.129
    /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/tester/.ssh/id_ecdsa_sk.pub"
    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
    /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
    tester@rtub1910x64tester@192.168.88.129's password:  
    
    Number of key(s) added: 1
    
    Now try logging into the machine, with:    "ssh 'tester@192.168.88.129'"
    and check to make sure that only the key(s) you wanted were added.

...

Code Block
languagebash
//Пример вывода содержимого файла:
$ cat /home/tester/.ssh/authorized_keys keys 
sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBJgH8rLL3QBdtNFmtsbLqHvj78ql3W8xLA3ktuQ5MVXLE/5eXMmBMrMhwTstdU9JO4cKU2Amw0EZLCncShdEC10AAAAQc3NoOllvdXJUZXh0SGVyZQAAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGDUAOIwllamFgyF63KadbKHRhIwqdp3xVXzASQGc9nbI8HiRT4EtsYYh9Fq6so+rm0R6eAUSWeR644SF4u0QSAAAAAQc3NoOllvdXJUZXh0SGVyZQ== tester@192.168.88.129tester@tester2310 verify-required

Подключение:

Code Block
languagebash
//Необходимо будет ввести пароль от закрытого ключа, пин-код Рутокен MFA и нажать кнопку на устройстве.
$ ssh 192.168.88.129
Enter passphrase for key '/home/tester/-i ~/.ssh/id_ecdsa_sk': 192.168.88.129
Confirm user presence for key ECDSA-SK SHA256:veX8eVHMp6r5jmrCtyonIK/bymj/22cyB8KytayhCz0vIIfHBajgeOHYoMjbzaE2eUoXU40jwSALfpuHjr9YA
Enter PIN for ECDSA-SK key /home/tester/.ssh/id_ecdsa_sk: 
Confirm user presence for key ECDSA-SK SHA256:veX8eVHMp6r5jmrCtyonIK/bymj/22cyB8KytayhCz0vIIfHBajgeOHYoMjbzaE2eUoXU40jwSALfpuHjr9YA
User presence confirmed
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-94-generic x86_64)

  * Documentation:  https https://help.ubuntu.com
  * Management:       https://landscape.canonical.com
  * Support:            httpshttps://ubuntu.com/pro

Расширенное поддержание безопасности (ESM) для Applications выключено.

0 обновлений может быть применено немедленно.

15 дополнительных обновлений безопасности могут быть применены с помощью ESM Apps.
Подробнее о включении службы ESM Apps at https://ubuntu.com/esm

Last login: MonWed Feb 1214 14:16:49:2710 2024 from 192.168.88.141147