참고

1 쿠버네티스 리눅스 서비스 강의
2 교재 Chapter12
... 따로 공부 필요...

OpenSSH(Open Secure Shell)

• 시스템을 원격에서 접속할 때 사용하는 서비스

네트워크 설정하기

• NAT 네트워크
• 호스트 전용 어뎁터

ssh 접속 사전 확인

[root@localhost ~]# systemctl status sshd -l
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2022-05-16 21:35:40 KST; 50min ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 1187 (sshd)
    Tasks: 1
   CGroup: /system.slice/sshd.service
           └─1187 /usr/sbin/sshd -D

May 16 21:35:39 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
May 16 21:35:40 localhost.localdomain sshd[1187]: Server listening on 0.0.0.0 port 22.
May 16 21:35:40 localhost.localdomain sshd[1187]: Server listening on :: port 22.
May 16 21:35:40 localhost.localdomain systemd[1]: Started OpenSSH server daemon.

방화벽

• 22번 포트 열렸는지 확인

[root@localhost ~]# netstat -an | grep 22
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
udp        0      0 192.168.122.1:53        0.0.0.0:*                          
unix  2      [ ACC ]     STREAM     LISTENING     32265    /tmp/.esd-0/socket
unix  2      [ ACC ]     STREAM     LISTENING     30682    @/tmp/.ICE-unix/2240
unix  2      [ ACC ]     STREAM     LISTENING     32286    /run/user/0/pulse/native
unix  2      [ ACC ]     STREAM     LISTENING     30468    /tmp/ssh-efkJM47MMie4/agent.2240
unix  2      [ ACC ]     STREAM     LISTENING     30683    /tmp/.ICE-unix/2240
...

ssh 연결

• sever 에서 ip확인

[root@localhost ~]# ifconfig
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 fe80::419c:d7a6:23a:557  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:b3:88:11  txqueuelen 1000  (Ethernet)
        RX packets 1873  bytes 2711062 (2.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 845  bytes 59742 (58.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

• Client 에서 ssh 원격 접속
  ssh 계정이름@서버ip or host_name

[root@localhost ~]# ssh root@10.0.2.15
ssh: connect to host 10.0.2.15 port 22: No route to host

원격 root 로그인 방지

• server 에서

  • /etc/ssh/sshd_config vi 편집
  • #PermitRootLogin yes ==> permitRootLogin no 로 변경
  • systemctl restart sshd

• Client 에서

[root@localhost ssh]# ssh root@10.0.2.15
ssh: connect to host 10.0.2.15 port 22: No route to host