Centos7利用rsync实现文件同步和ssh免密登录

￡神魔★判官ぃ 2021-09-09 11:36 563阅读 0赞

(1)实验环境

两台CentOS7：

youxi1　　192.168.1.6

youxi2　　192.168.1.7

这里我将防火墙关闭进行实验，如果防火墙开启，请将端口加入到防火墙规则中。

(2).目标

在ssh端口不为22的情况下，进行单向免密登录或双向免密登录（端口不一致）

(3).实验

首先修改两台服务器的端口，vim /etc/ssh/sshd\_config，找到如下部分

将\#去除，22改为想要的端口号。这里我将youxi1的ssh端口号改为2890，youxi2的ssh端口号改为2891。

接着使用命令systemctl restart sshd重启服务。再使用netstat -tlunp | grep sshd查看端口号（如果没有netstat请安装net-tools）

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 </td> 
 <td> <code>[root@youxi1 Packages]# netstat -tlunp | grep sshd　　</code><code>//youxi1</code> <code>tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 0.0.0.0:2890&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9953/sshd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code> <code>tcp6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 :::2890&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9953/sshd</code> <code>[root@youxi2 ~]# netstat -tlunp | grep sshd　　</code><code>//youxi2</code> <code>tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 0.0.0.0:2891&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17526/sshd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</code> <code>tcp6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 :::2891&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17526/sshd</code> </td> 
 </tr> 
 </tbody> 
</table>

1）单向免密登录

youxi1使用ssh远程youxi2不需要密码，但youxi2使用ssh远程youxi1需要密码

在yousi1上使用ssh-keygen生成公钥和私钥（这里使用默认的rsa），一路默认即可

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 </td> 
 <td> <code>[root@youxi1 ~]# ssh-keygen -t rsa　　</code><code>//默认指定的是rsa，所以可以没有-t rsa</code> <code>Generating&nbsp;</code><code>public</code><code>/</code><code>private</code>&nbsp;<code>rsa key pair.</code> <code>Enter file&nbsp;</code><code>in</code>&nbsp;<code>which to save the key (/root/.ssh/id_rsa): 　　</code><code>//选项没有指定生成地址时，此处也可以指定</code> <code>Created directory&nbsp;</code><code>'/root/.ssh'</code><code>.</code> <code>Enter passphrase (empty&nbsp;</code><code>for</code>&nbsp;<code>no passphrase):</code> <code>Enter same passphrase again:</code> <code>Your identification has been saved&nbsp;</code><code>in</code>&nbsp;<code>/root/.ssh/id_rsa.</code> <code>Your&nbsp;</code><code>public</code>&nbsp;<code>key has been saved&nbsp;</code><code>in</code>&nbsp;<code>/root/.ssh/id_rsa.pub.</code> <code>The key fingerprint&nbsp;</code><code>is</code><code>:</code> <code>SHA256:ia+le9ZX3cAxztmIINJbWnEGrK9lq4lY4pYNevgqecM root@youxi1</code> <code>The key's randomart image&nbsp;</code><code>is</code><code>:</code> <code>+---[RSA 2048]----+</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; . .ooo&nbsp;&nbsp;&nbsp; |</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; . o =o&nbsp; o&nbsp; |</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; . B . = * |</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; .+.&nbsp; . B .|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; . S.&nbsp;&nbsp;&nbsp;&nbsp; o.|</code> <code>|&nbsp;&nbsp;&nbsp; .&nbsp; .&nbsp; +&nbsp;&nbsp; . o|</code> <code>| o o.+. o= . .&nbsp;&nbsp; |</code> <code>|o E.++.=+.o .&nbsp;&nbsp;&nbsp; |</code> <code>| o.*+ =+o. .&nbsp;&nbsp;&nbsp;&nbsp; |</code> <code>+----[SHA256]-----+</code> </td> 
 </tr> 
 </tbody> 
</table>

在没有指定生成地址时，会默认生成到家目录下的.ssh/目录下。使用rsa就会生成id\_rsa和id\_rsa.pub两个文件，如果使用的是dsa则生成的是id\_dsa和id\_dsa.pub两个文件。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 </td> 
 <td> <code>[root@youxi1 ~]# ls /root/.ssh/</code> <code>id_rsa&nbsp; id_rsa.pub</code> </td> 
 </tr> 
 </tbody> 
</table>

接着使用命令ssh-copy-id命令将公钥发到youxi2服务器上

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 </td> 
 <td> <code>[root@youxi1 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2891 root@192.168.1.7　　</code><code>//-p选项指定被远程的服务器的端口号</code> <code>/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed:&nbsp;</code><code>".ssh/id_rsa.pub"</code> <code>The authenticity of host&nbsp;</code><code>'[192.168.1.7]:2891 ([192.168.1.7]:2891)'</code>&nbsp;<code>can't be established.</code> <code>ECDSA key fingerprint&nbsp;</code><code>is</code>&nbsp;<code>SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.</code> <code>ECDSA key fingerprint&nbsp;</code><code>is</code>&nbsp;<code>MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.</code> <code>Are you sure you want to&nbsp;</code><code>continue</code>&nbsp;<code>connecting (yes/no)? yes　　</code><code>//yes继续</code> <code>/usr/bin/ssh-copy-id: INFO: attempting to log&nbsp;</code><code>in</code>&nbsp;<code>with the&nbsp;</code><code>new</code>&nbsp;<code>key(s), to filter&nbsp;</code><code>out</code>&nbsp;<code>any that are already installed</code> <code>/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed --&nbsp;</code><code>if</code>&nbsp;<code>you are prompted now it&nbsp;</code><code>is</code>&nbsp;<code>to install the&nbsp;</code><code>new</code>&nbsp;<code>keys</code> <code>root@192.168.1.7's password: 　　</code><code>//输入192.168.1.7服务器上的root用户的密码</code> <code>Number of key(s) added: 1</code> <code>Now&nbsp;</code><code>try</code>&nbsp;<code>logging&nbsp;</code><code>into</code>&nbsp;<code>the machine, with:&nbsp;&nbsp;&nbsp;</code><code>"ssh -p '2891' 'root@192.168.1.7'"</code> <code>and check to make sure that only the key(s) you wanted were added.</code> </td> 
 </tr> 
 </tbody> 
</table>

公钥传完后虽然会在本地生成.ssh/known\_hosts文件，但并不生效。而在youxi2服务器的root用户的家目录下生成.ssh目录，并含有authorized\_keys文件。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 </td> 
 <td> <code>[root@youxi1 ~]# ls .ssh/</code> <code>authorized_keys</code> </td> 
 </tr> 
 </tbody> 
</table>

此时youxi1上的id\_rsa.pub文件与youxi2是上的authorized\_keys文件相同。

最后测试：在youxi1上ssh远程youxi2，会发现并不需要输入密码

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 </td> 
 <td> <code>[root@youxi1 ~]# ssh -p 2891 root@192.168.1.7</code> <code>Last login: Sun May 12 17:46:49 2019&nbsp;</code><code>from</code>&nbsp;<code>youxi1.cn</code> <code>[root@youxi2 ~]# ls .ssh/</code> <code>authorized_keys</code> </td> 
 </tr> 
 </tbody> 
</table>

注意：是本机生成的公钥发给被远程的服务器，在发送公钥和远程服务器时，都需要指定被远程的服务器的端口号。

2）双向免密登录

双向免密就是互换公钥即可，这里接着上面把youxi2的公钥发送到youxi1上，并进行测试。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 </td> 
 <td> <code>[root@youxi2 ~]# ssh-keygen</code> <code>Generating&nbsp;</code><code>public</code><code>/</code><code>private</code>&nbsp;<code>rsa key pair.</code> <code>Enter file&nbsp;</code><code>in</code>&nbsp;<code>which to save the key (/root/.ssh/id_rsa):</code> <code>Enter passphrase (empty&nbsp;</code><code>for</code>&nbsp;<code>no passphrase):</code> <code>Enter same passphrase again:</code> <code>Your identification has been saved&nbsp;</code><code>in</code>&nbsp;<code>/root/.ssh/id_rsa.</code> <code>Your&nbsp;</code><code>public</code>&nbsp;<code>key has been saved&nbsp;</code><code>in</code>&nbsp;<code>/root/.ssh/id_rsa.pub.</code> <code>The key fingerprint&nbsp;</code><code>is</code><code>:</code> <code>SHA256:9+woxNPvkE99zGUEZNcI+DJaUUIZXXMKb7k/Y6kPiJU root@youxi2</code> <code>The key's randomart image&nbsp;</code><code>is</code><code>:</code> <code>+---[RSA 2048]----+</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; .+*++*.+|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; +..+.B.|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; o&nbsp; = .|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; + o. o |</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; .S+.E&nbsp; . o|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =.++.. =o|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; . ooo+..==|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; .&nbsp; *. +.o|</code> <code>|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...+... |</code> <code>+----[SHA256]-----+</code> <code>[root@youxi2 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2890 root@192.168.1.6</code> <code>/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed:&nbsp;</code><code>".ssh/id_rsa.pub"</code> <code>The authenticity of host&nbsp;</code><code>'[192.168.1.6]:2890 ([192.168.1.6]:2890)'</code>&nbsp;<code>can't be established.</code> <code>ECDSA key fingerprint&nbsp;</code><code>is</code>&nbsp;<code>SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg.</code> <code>ECDSA key fingerprint&nbsp;</code><code>is</code>&nbsp;<code>MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20.</code> <code>Are you sure you want to&nbsp;</code><code>continue</code>&nbsp;<code>connecting (yes/no)? yes</code> <code>/usr/bin/ssh-copy-id: INFO: attempting to log&nbsp;</code><code>in</code>&nbsp;<code>with the&nbsp;</code><code>new</code>&nbsp;<code>key(s), to filter&nbsp;</code><code>out</code>&nbsp;<code>any that are already installed</code> <code>/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed --&nbsp;</code><code>if</code>&nbsp;<code>you are prompted now it&nbsp;</code><code>is</code>&nbsp;<code>to install the&nbsp;</code><code>new</code>&nbsp;<code>keys</code> <code>root@192.168.1.6's password:</code> <code>Number of key(s) added: 1</code> <code>Now&nbsp;</code><code>try</code>&nbsp;<code>logging&nbsp;</code><code>into</code>&nbsp;<code>the machine, with:&nbsp;&nbsp;&nbsp;</code><code>"ssh -p '2890' 'root@192.168.1.6'"</code> <code>and check to make sure that only the key(s) you wanted were added.</code> <code>[root@youxi2 ~]# ssh -p 2890 root@192.168.1.6</code> <code>Last login: Sun May 12 17:24:54 2019&nbsp;</code><code>from</code>&nbsp;<code>youxi2.cn</code> <code>[root@youxi1 ~]#</code> </td> 
 </tr> 
 </tbody> 
</table>

# [Centos7利用rsync实现文件同步][Centos7_rsync] #

# **0x01 测试环境** #

CentOS 7.4 Rsync服务端：192.168.204.130
    CentOS 7.4 Rsync客户端：192.168.204.168

# **0x02 rsync同步方式** #

## 第一种方式：rsync通过ssh方式同步 ##

1、Rsync服务端和客户端都需要安装rsync

[root@localhost ~]# yum -y install rsync

2、使用

前提：需知道远程服务器开启ssh端口和账号密码

A、推文件：

[root@localhost tmp]# rsync -av /etc/passwd  192.168.204.168:/tmp/passwd.txt

![fe2c20863388e8eeabcb85037f9fcf95.png][]

B、拉文件

[root@localhost tmp]# rsync -av  192.168.204.168:/tmp/passwd.txt  /tmp/test.txt

![9534352b486e0896a054419627433dd1.png][]

\#指定ssh端口

[root@localhost tmp]# rsync -av -e "ssh -p 22" 192.168.204.168:/tmp/passwd.txt  /tmp/a.txt

![e22216319ce426cd3ad30a39916058ee.png][]

## 第二种方式：rsync通过服务的方式同步 ##

服务端配置：

1、编辑配置文件/etc/rsyncd.conf

motd file = /etc/rsyncd.motd
    transfer logging = yes
    log file = /var/log/rsyncd.log
    port = 873
    address = 192.168.204.130
    uid = nobody
    gid = nobody
    use chroot = no
    read only = no
    max connections = 10
    [common]
    comment = rsync info
    path = /tmp
    ignore errors
    auth users = admin
    secrets file = /etc/rsyncd.secrets
    hosts allow = 192.168.204.0/255.255.255.0
    hosts deny = *
    list = false

2、创建用户密码文件

echo "admin:123456" > /etc/rsyncd.secrets
    chmod 600 /etc/rsyncd.secrets

3、创建提示信息文件：

echo  "rsync  info"  >  /etc/rsyncd.motd

4、启动服务：

rsync  --daemon
    echo  "rsync  --daemon"  >>  /etc/rc.local

客户端配置：

创建密码文件（免密码输入）：

echo  "123456"  >  /root/passwd
    chmod  600  /root/passwd

拉取：

rsync -avz --password-file=/root/passwd  admin@192.168.204.130::common /tmp

![62605066c7c0db9ffa4172ce5cbc6057.png][]

推送：

rsync -avz --password-file=/root/passwd /tmp/ admin@192.168.204.130::common

![2476c4897ac2f09fc246c21f11e45b3b.png][]

定时任务：

1、新建一个rsync.sh文件，在文件中写入执行同步的命令：

rsync -avz --password-file=/root/passwd  admin@192.168.204.130::common /tmp  >/dev/null 2>&1
    
    chmod 755  rsync.sh

2、执行命令：crontab -e

在定时文件中写入定时执行任务，实例如下：
           * * * * * /home/rsync.sh                 每分钟执行一次同步脚本；
            0 * * * * /home/rsync.sh                 每小时执行一次同步脚本；
            0 0 * * * /home/rsync.sh                 每天零点执行一次同步脚本； 
            0 9,18 * * * /home/rsync.sh            每天的9AM和6PM执行一次同步脚本；

TIPS:匿名访问测试

列举整个同步目录或指定目录：
    rsync 10.0.0.12 ::
    rsync 10.0.0.12 :: www /
    
    下载文件或目录到本地：
    rsync – avz 10.0.0.12 :: WWW/  /var/tmp
    rsync – avz 10.0.0.12 :: www/  /var/tmp
    
    上传本地文件到服务端：
    rsync -avz webshell 10.0.0.12 :: WWW /

[Centos7_rsync]: https://www.cnblogs.com/xiaozi/p/11018496.html
[fe2c20863388e8eeabcb85037f9fcf95.png]: /images/20210908/04859ff41ab54bb4ab66c5175b49be11.png
[9534352b486e0896a054419627433dd1.png]: /images/20210908/877d0e9ee57f45a093b95347ef035d65.png
[e22216319ce426cd3ad30a39916058ee.png]: /images/20210908/24d176776d0443d4bea7da528fb663d9.png
[62605066c7c0db9ffa4172ce5cbc6057.png]: /images/20210908/a1ee389c0994499e95b6e841ead7a707.png
[2476c4897ac2f09fc246c21f11e45b3b.png]: /images/20210908/1fbf4649d7b64d9494ece3ebed24f242.png