SSh双向免密配置

1. 手动免密

在两端都要做此操作，也就是A -> B, A <- B

1 在本地生成密钥

ssh-keygen -t rsa

2 推送到目的主机

ssh-copy-id metax@192.168.1.20

批量分发公钥

for ip in $(cat nodes.txt); do
    ssh-copy-id -i /root/.ssh/id_rsa.pub root@$ip
done

• nodes.txt里的内容为ip地址，每一行一个ip

2. 脚本免密

#!/bin/bash

SSH_USER="root"
ROOT_PASS="26&MuXi3751"
AUTH_KEYS_FILE="authorized_keys"
TMP_DIR="/tmp/ssh_setup_$$"
TMP_AUTH_KEYS="${TMP_DIR}/authorized_keys_merged"
SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=3 -o UserKnownHostsFile=/dev/null -o BatchMode=no"

red()    { echo -e "\033[31m$*\033[0m"; }
green()  { echo -e "\033[32m$*\033[0m"; }
yellow() { echo -e "\033[33m$*\033[0m"; }

if [ "$EUID" -ne 0 ]; then
    red "Run as root"
    exit 1
fi

IP_FILE="${1:-ip.txt}"

if [ ! -f "$IP_FILE" ]; then
    red "File not found"
    exit 1
fi

NODES=()
while read -r line; do
    line=$(echo "$line" | xargs)
    if [ -n "$line" ]; then
        NODES+=("$line")
    fi
done < "$IP_FILE"

green "Nodes count: ${#NODES[@]}"
printf "  %s\n" "${NODES[@]}"

if ! command -v sshpass &> /dev/null; then
    apt update -qq && apt install -y sshpass
fi

green "Testing SSH connectivity..."
for node in "${NODES[@]}"; do
    yellow "Testing $node"
    sshpass -p "$ROOT_PASS" ssh $SSH_OPTS ${SSH_USER}@$node exit 2>/dev/null || true
    green "   Continue"
done

mkdir -p "$TMP_DIR"
touch "$TMP_AUTH_KEYS"

for node in "${NODES[@]}"; do
    yellow "Processing $node"
    sshpass -p "$ROOT_PASS" ssh $SSH_OPTS ${SSH_USER}@$node "mkdir -p ~/.ssh && chmod 700 ~/.ssh" 2>/dev/null || true
    sshpass -p "$ROOT_PASS" ssh $SSH_OPTS ${SSH_USER}@$node "[ -f ~/.ssh/id_rsa ] || ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa" 2>/dev/null || true
    PUB_KEY=$(sshpass -p "$ROOT_PASS" ssh $SSH_OPTS ${SSH_USER}@$node "cat ~/.ssh/id_rsa.pub" 2>/dev/null)
    echo "$PUB_KEY" >> "$TMP_AUTH_KEYS"
done

sort -u -o "$TMP_AUTH_KEYS" "$TMP_AUTH_KEYS"

for node in "${NODES[@]}"; do
    yellow "Distributing keys to $node"
    cat "$TMP_AUTH_KEYS" | sshpass -p "$ROOT_PASS" ssh $SSH_OPTS ${SSH_USER}@$node "cat > ~/.ssh/$AUTH_KEYS_FILE && chmod 600 ~/.ssh/$AUTH_KEYS_FILE" 2>/dev/null || true
done

rm -rf "$TMP_DIR"

green "Verifying passwordless SSH..."
for i in {1..3}; do
    src=${NODES[$RANDOM % ${#NODES[@]}]}
    dst=${NODES[$RANDOM % ${#NODES[@]}]}
    [ "$src" = "$dst" ] && continue
    yellow "Testing $src -> $dst"
    ssh $SSH_OPTS ${SSH_USER}@$src "ssh $SSH_OPTS ${SSH_USER}@$dst echo OK" 2>/dev/null | grep -q OK && green "  Success" || red "  Skip"
done

green "All done!"

3. 日志与密钥查看

tail -n 20 /var/log/auth.log
cat /root/.ssh/id_rsa.pub # 自己的公钥
cat /root/.ssh/authorized_keys # 其它节点的公钥