在本地生成公私钥对，使用ssh-keygen生成，生成的私钥通常存储在客户端机器的 ~/.ssh/id_rsa 路径中，而公钥则存储在 ~/.ssh/id_rsa.pub 文件中
ssh-keygen -t rsa -b 2048 -f id_rsa
-t rsa：指定使用RSA算法生成密钥对-b 2048：指定密钥长度为2048位，以提高加密强度-f id_rsa：输出文件名前缀（生成两个文件：私钥和公钥）
执行后会得到如下输出：
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): ← 直接回车（不设密码）
Enter same passphrase again: ← 再次回车
Your identification has been saved in id_rsa
Your public key has been saved in id_rsa.pub
如果不执行-f参数，则会多一个输出：
Generating public/private rsa key pair.
Enter file in which to save the key (/home/kali/.ssh/id_rsa):
# 请输入要保存 SSH 密钥的文件路径（默认是 /home/kali/.ssh/id_rsa）
Enter passphrase for "/home/kali/.ssh/id_rsa" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kali/.ssh/id_rsa
Your public key has been saved in /home/kali/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:5aLAsLqAKQILKFhWJXQ7igBgofC5l16DWfKGhCraz4A kali@kali
The key's randomart image is:
+---[RSA 2048]----+
|=o..+.o |
|=. + o . |
|o B o + . |
|o= B X . o |
|O + X = S . |
|B* o + o . |
|E o . . |
|+. + |
|. o |
+----[SHA256]-----+
其中id_rsa为私钥，ssh登录的时候需要用到
id_rsa.pub为公钥，需要写入目标机器 ~/.ssh/authorized_keys`
公钥示例：
ssh-rsa AAAAB3...Z kali@kalissh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC72kHJRCO8GB1ECQL1Z6gxmGk2BK1EBfaG9llD3hEzOSX5Wp54hU9sC9Rs35ZBGs2n31UL0g31lnyNnZkTPGNjmmDsSkclOZqVbyReL7qsCE38m0zlzRfKNKHao5BUuqXEeWaVKccyxAHb6E415BaAKb3rnMB+PczqO7vymV3aZpuIknHtpS0DKzif9qQnZIw6flCGsJ9mF+byuO9BDiT0LTvJ2FD/ZG3aF0jDmsq53ZoNxeZPHiDy2Ymqq3T64GhzDaQh2VKylzgDGjE0isoc7HToI2tVjn+SKh7T5sgyQrRdpmtPydbKY9mCOpLIRLzY6COb3bOpqhh5UtF96JZb kali@kali
默认格式是：ssh-rsa AAAA... comment，其中 comment 通常是用户名 + 主机名,comment用于标记这个密钥是谁生成的
生成公私钥对后，将公钥写入远程主机的 authorized_keys 文件，通常位于远程主机的用户主目录下的 .ssh/authorized_keys 路径
例如
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnWeJ+yLOm2C9O59mj96M5+7Ui5l3cdVUjE+Aqx9+Wes9H3pk9zW6WTTU9hoO+kXFFTFFw8cTn81E6hbriCU57h8KUJqfj7fBKUNO7U9miVRh8PLN4kjZPzD7uByxQ3/scvV/M7WQLCH4xAs9FShFIEwr8PqqwcjC5dslozs1ihcwIFbA9ePyEj+ZIzAoXsngaOtMLCy/WzCu3T22AzCHkPm+qsskA7tx3Qj2wZWGo/szezmgwHrVWRfbmstloGdrWncs85rmFXIIlS9XozAUjb093jflz1fq8vKlAxssH7TuZcux8dnHq5/0sHMVZJh4pTWBVgWvqtxDxOFt+ArWH kali@kali" > /root/.ssh/authorized_keyscat /root/.ssh/authorized_keys
在终端登录的时候使用私钥登录：
ssh -i id_rsa user@192.168.1.1
报错及注意事项：
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa": bad permissions
当前的私钥 id_rsa权限是 0777，即所有用户都可以读写执行，这是极度不安全的，SSH 会拒绝使用这种私钥
解决方法：
把私钥权限设置为 600（仅自己可读写）
chmod 600 id_rsa_backdoor
如果出现以下报错：
no matching cipher found. Their offer: arcfour256,arcfour128
或
Unable to negotiate with 10.10.1.10 port 22: no matching cipher found. Their offer: rc4
这是因为服务器强制使用 RC4，而你客户端不支持，需要手动指定启用RC4
ssh -c arcfour admin@192.168.1.1
ssh -c arcfour128 admin@192.168.1.1
root证书登录
如果写入的是/root/.ssh/authorized_keys，则需要以下操作
mkdir -p /root/.ssh
chmod 700 /root/.ssh
chown root:root /root/.sshchmod 600 /root/.ssh/authorized_keys
chown root:root /root/.ssh/authorized_keys
确保权限如下
ls -ld /root/.ssh
ls -l /root/.ssh/authorized_keysdrwx------ 2 root root ... /root/.ssh
-rw------- 1 root root ... /root/.ssh/authorized_keys
确认可以使用公钥认证登录
grep -E 'PermitRootLogin|PubkeyAuthentication' /etc/ssh/sshd_configPermitRootLogin yes
PubkeyAuthentication yes
# the setting of "PermitRootLogin without-password".
报错debug1: send_pubkey_test: no mutual signature algorithm
原因为签名算法不兼容
ssh -v -i id_rsa \-o PubkeyAcceptedAlgorithms=+ssh-rsa \-o HostKeyAlgorithms=+ssh-rsa \root@192.168.22.131
调试ssh连接
ssh -v -i id_rsa root@192.168.22.131
# 或者更详细
ssh -vvv -i id_rsa root@192.168.22.131