[{"data":1,"prerenderedAt":642},["ShallowReactive",2],{"wiki-/wiki/linux/ssh":3},{"id":4,"title":5,"body":6,"description":633,"extension":634,"meta":635,"navigation":636,"path":637,"section":638,"seo":639,"stem":640,"__hash__":641},"wiki/wiki/linux/ssh.md","Настройка SSH-ключей",{"type":7,"value":8,"toc":617},"minimark",[9,21,27,30,35,38,42,55,59,67,71,76,81,120,123,137,140,145,156,163,167,171,190,193,199,208,211,270,274,277,294,297,301,304,317,320,328,331,337,340,356,362,366,383,405,409,415,418,439,446,453,456,476,485,488,492,497,507,512,519,525,528,540,545,552,557,560,573,577,595,599,613],[10,11,12,16,17,20],"p",{},[13,14,15],"strong",{},"Время:"," 10 мин · ",[13,18,19],{},"Сложность:"," ★☆☆☆☆",[10,22,23,26],{},[13,24,25],{},"Подходит:"," ✓ Ubuntu 22.04 · ✓ Debian 12 · ✓ AlmaLinux 9",[28,29],"hr",{},[31,32,34],"h2",{"id":33},"краткое-описание","Краткое описание",[10,36,37],{},"Вход по SSH-ключу безопаснее пароля: ключ нельзя подобрать перебором. После настройки ключей отключите парольную аутентификацию — это уберёт целый класс атак на сервер.",[31,39,41],{"id":40},"когда-пригодится","Когда пригодится",[43,44,45,49,52],"ul",{},[46,47,48],"li",{},"Вы хотите войти на сервер без пароля",[46,50,51],{},"Вы хотите запретить вход по паролю",[46,53,54],{},"Вы настраиваете автоматизацию (CI/CD, скрипты) с доступом к серверу",[31,56,58],{"id":57},"что-понадобится","Что понадобится",[43,60,61,64],{},[46,62,63],{},"Доступ к серверу по SSH (пока с паролем)",[46,65,66],{},"Терминал на вашем компьютере",[31,68,70],{"id":69},"пошаговая-инструкция","Пошаговая инструкция",[72,73,75],"h3",{"id":74},"_1-сгенерируйте-ключ-на-своём-компьютере","1. Сгенерируйте ключ на своём компьютере",[10,77,78],{},[13,79,80],{},"Linux и macOS:",[82,83,88],"pre",{"className":84,"code":85,"language":86,"meta":87,"style":87},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ssh-keygen -t ed25519 -C \"your@email.com\"\n","bash","",[89,90,91],"code",{"__ignoreMap":87},[92,93,96,100,104,107,110,114,117],"span",{"class":94,"line":95},"line",1,[92,97,99],{"class":98},"sBMFI","ssh-keygen",[92,101,103],{"class":102},"sfazB"," -t",[92,105,106],{"class":102}," ed25519",[92,108,109],{"class":102}," -C",[92,111,113],{"class":112},"sMK4o"," \"",[92,115,116],{"class":102},"your@email.com",[92,118,119],{"class":112},"\"\n",[10,121,122],{},"Команда создаст два файла:",[43,124,125,131],{},[46,126,127,130],{},[89,128,129],{},"~/.ssh/id_ed25519"," — приватный ключ (никому не передавайте)",[46,132,133,136],{},[89,134,135],{},"~/.ssh/id_ed25519.pub"," — публичный ключ (этот копируется на сервер)",[10,138,139],{},"При запросе пути нажмите Enter, чтобы использовать путь по умолчанию. Passphrase можно оставить пустым или задать для дополнительной защиты.",[10,141,142],{},[13,143,144],{},"Windows (PowerShell):",[82,146,150],{"className":147,"code":148,"language":149,"meta":87,"style":87},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ssh-keygen -t ed25519\n","powershell",[89,151,152],{"__ignoreMap":87},[92,153,154],{"class":94,"line":95},[92,155,148],{},[10,157,158,159,162],{},"Ключи появятся в ",[89,160,161],{},"C:\\Users\\YourName\\.ssh\\",".",[72,164,166],{"id":165},"_2-скопируйте-публичный-ключ-на-сервер","2. Скопируйте публичный ключ на сервер",[10,168,169],{},[13,170,80],{},[82,172,174],{"className":84,"code":173,"language":86,"meta":87,"style":87},"ssh-copy-id -i ~/.ssh/id_ed25519.pub user@SERVER_IP\n",[89,175,176],{"__ignoreMap":87},[92,177,178,181,184,187],{"class":94,"line":95},[92,179,180],{"class":98},"ssh-copy-id",[92,182,183],{"class":102}," -i",[92,185,186],{"class":102}," ~/.ssh/id_ed25519.pub",[92,188,189],{"class":102}," user@SERVER_IP\n",[10,191,192],{},"Введите пароль от сервера — больше он не понадобится.",[10,194,195,198],{},[13,196,197],{},"Windows"," — скопируйте вручную. Выведите содержимое публичного ключа:",[82,200,202],{"className":147,"code":201,"language":149,"meta":87,"style":87},"cat $env:USERPROFILE\\.ssh\\id_ed25519.pub\n",[89,203,204],{"__ignoreMap":87},[92,205,206],{"class":94,"line":95},[92,207,201],{},[10,209,210],{},"Войдите на сервер с паролем и добавьте ключ:",[82,212,214],{"className":84,"code":213,"language":86,"meta":87,"style":87},"mkdir -p ~/.ssh\nchmod 700 ~/.ssh\necho \"вставьте_содержимое_pub_ключа_сюда\" >> ~/.ssh/authorized_keys\nchmod 600 ~/.ssh/authorized_keys\n",[89,215,216,227,239,260],{"__ignoreMap":87},[92,217,218,221,224],{"class":94,"line":95},[92,219,220],{"class":98},"mkdir",[92,222,223],{"class":102}," -p",[92,225,226],{"class":102}," ~/.ssh\n",[92,228,230,233,237],{"class":94,"line":229},2,[92,231,232],{"class":98},"chmod",[92,234,236],{"class":235},"sbssI"," 700",[92,238,226],{"class":102},[92,240,242,246,248,251,254,257],{"class":94,"line":241},3,[92,243,245],{"class":244},"s2Zo4","echo",[92,247,113],{"class":112},[92,249,250],{"class":102},"вставьте_содержимое_pub_ключа_сюда",[92,252,253],{"class":112},"\"",[92,255,256],{"class":112}," >>",[92,258,259],{"class":102}," ~/.ssh/authorized_keys\n",[92,261,263,265,268],{"class":94,"line":262},4,[92,264,232],{"class":98},[92,266,267],{"class":235}," 600",[92,269,259],{"class":102},[72,271,273],{"id":272},"_3-проверьте-вход-по-ключу","3. Проверьте вход по ключу",[10,275,276],{},"Не закрывая текущий сеанс, откройте новый терминал и подключитесь:",[82,278,280],{"className":84,"code":279,"language":86,"meta":87,"style":87},"ssh -i ~/.ssh/id_ed25519 user@SERVER_IP\n",[89,281,282],{"__ignoreMap":87},[92,283,284,287,289,292],{"class":94,"line":95},[92,285,286],{"class":98},"ssh",[92,288,183],{"class":102},[92,290,291],{"class":102}," ~/.ssh/id_ed25519",[92,293,189],{"class":102},[10,295,296],{},"Если вход прошёл без запроса пароля — ключ работает.",[72,298,300],{"id":299},"_4-отключите-парольную-аутентификацию","4. Отключите парольную аутентификацию",[10,302,303],{},"Откройте конфигурацию SSH на сервере:",[82,305,307],{"className":84,"code":306,"language":86,"meta":87,"style":87},"nano /etc/ssh/sshd_config\n",[89,308,309],{"__ignoreMap":87},[92,310,311,314],{"class":94,"line":95},[92,312,313],{"class":98},"nano",[92,315,316],{"class":102}," /etc/ssh/sshd_config\n",[10,318,319],{},"Найдите строку:",[82,321,326],{"className":322,"code":324,"language":325},[323],"language-text","#PasswordAuthentication yes\n","text",[89,327,324],{"__ignoreMap":87},[10,329,330],{},"Замените на:",[82,332,335],{"className":333,"code":334,"language":325},[323],"PasswordAuthentication no\n",[89,336,334],{"__ignoreMap":87},[10,338,339],{},"Перезапустите SSH:",[82,341,343],{"className":84,"code":342,"language":86,"meta":87,"style":87},"systemctl restart sshd\n",[89,344,345],{"__ignoreMap":87},[92,346,347,350,353],{"class":94,"line":95},[92,348,349],{"class":98},"systemctl",[92,351,352],{"class":102}," restart",[92,354,355],{"class":102}," sshd\n",[10,357,358,359,162],{},"Проверьте: попытка войти с паролем должна вернуть ",[89,360,361],{},"Permission denied (publickey)",[31,363,365],{"id":364},"проверка-результата","Проверка результата",[82,367,369],{"className":84,"code":368,"language":86,"meta":87,"style":87},"ssh user@SERVER_IP\n# Вход без запроса пароля\n",[89,370,371,377],{"__ignoreMap":87},[92,372,373,375],{"class":94,"line":95},[92,374,286],{"class":98},[92,376,189],{"class":102},[92,378,379],{"class":94,"line":229},[92,380,382],{"class":381},"sHwdD","# Вход без запроса пароля\n",[82,384,386],{"className":84,"code":385,"language":86,"meta":87,"style":87},"ssh -o PasswordAuthentication=yes user@SERVER_IP\n# Permission denied (publickey).\n",[89,387,388,400],{"__ignoreMap":87},[92,389,390,392,395,398],{"class":94,"line":95},[92,391,286],{"class":98},[92,393,394],{"class":102}," -o",[92,396,397],{"class":102}," PasswordAuthentication=yes",[92,399,189],{"class":102},[92,401,402],{"class":94,"line":229},[92,403,404],{"class":381},"# Permission denied (publickey).\n",[31,406,408],{"id":407},"возможные-ошибки","Возможные ошибки",[10,410,411],{},[13,412,413],{},[89,414,361],{},[10,416,417],{},"Проверьте права на файлы:",[82,419,421],{"className":84,"code":420,"language":86,"meta":87,"style":87},"chmod 700 ~/.ssh\nchmod 600 ~/.ssh/authorized_keys\n",[89,422,423,431],{"__ignoreMap":87},[92,424,425,427,429],{"class":94,"line":95},[92,426,232],{"class":98},[92,428,236],{"class":235},[92,430,226],{"class":102},[92,432,433,435,437],{"class":94,"line":229},[92,434,232],{"class":98},[92,436,267],{"class":235},[92,438,259],{"class":102},[10,440,441,442,445],{},"Публичный ключ должен быть записан в ",[89,443,444],{},"~/.ssh/authorized_keys"," полностью, в одну строку.",[10,447,448],{},[13,449,450],{},[89,451,452],{},"ssh-copy-id: ERROR: ssh: connect to host",[10,454,455],{},"Неверный IP-адрес или порт. Если SSH работает на нестандартном порту:",[82,457,459],{"className":84,"code":458,"language":86,"meta":87,"style":87},"ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@SERVER_IP\n",[89,460,461],{"__ignoreMap":87},[92,462,463,465,467,469,471,474],{"class":94,"line":95},[92,464,180],{"class":98},[92,466,183],{"class":102},[92,468,186],{"class":102},[92,470,223],{"class":102},[92,472,473],{"class":235}," 2222",[92,475,189],{"class":102},[10,477,478],{},[13,479,480,481,484],{},"После перезапуска ",[89,482,483],{},"sshd"," потерял доступ",[10,486,487],{},"Не закрывайте текущую сессию до проверки нового входа. Если доступ потерян — используйте VNC-консоль в панели управления Cheesecake Cloud.",[31,489,491],{"id":490},"faq","FAQ",[10,493,494],{},[13,495,496],{},"Как добавить второй ключ?",[10,498,499,500,503,504,506],{},"Добавьте содержимое нового ",[89,501,502],{},".pub","-файла в ",[89,505,444],{}," на сервере — каждый ключ на отдельной строке.",[10,508,509],{},[13,510,511],{},"Как работать с несколькими серверами удобнее?",[10,513,514,515,518],{},"Создайте ",[89,516,517],{},"~/.ssh/config"," на своём компьютере:",[82,520,523],{"className":521,"code":522,"language":325},[323],"Host myserver\n    HostName SERVER_IP\n    User username\n    IdentityFile ~/.ssh/id_ed25519\n\nHost staging\n    HostName STAGING_IP\n    User deploy\n    IdentityFile ~/.ssh/id_ed25519\n",[89,524,522],{"__ignoreMap":87},[10,526,527],{},"После этого подключайтесь просто:",[82,529,531],{"className":84,"code":530,"language":86,"meta":87,"style":87},"ssh myserver\n",[89,532,533],{"__ignoreMap":87},[92,534,535,537],{"class":94,"line":95},[92,536,286],{"class":98},[92,538,539],{"class":102}," myserver\n",[10,541,542],{},[13,543,544],{},"Один ключ для нескольких серверов?",[10,546,547,548,551],{},"Да, публичный ключ можно добавить в ",[89,549,550],{},"authorized_keys"," на любом количестве серверов. Это удобно и безопасно — каждый сервер хранит только публичную часть.",[10,553,554],{},[13,555,556],{},"Нужен ли passphrase на ключе?",[10,558,559],{},"Passphrase шифрует приватный ключ на диске. Если кто-то получит файл ключа — без passphrase он сразу сможет им воспользоваться. Для личного использования passphrase удобно хранить в ssh-agent:",[82,561,563],{"className":84,"code":562,"language":86,"meta":87,"style":87},"ssh-add ~/.ssh/id_ed25519\n",[89,564,565],{"__ignoreMap":87},[92,566,567,570],{"class":94,"line":95},[92,568,569],{"class":98},"ssh-add",[92,571,572],{"class":102}," ~/.ssh/id_ed25519\n",[31,574,576],{"id":575},"полезные-ссылки","Полезные ссылки",[43,578,579,588],{},[46,580,581],{},[582,583,587],"a",{"href":584,"rel":585},"https://www.openssh.com/manual.html",[586],"nofollow","OpenSSH manual",[46,589,590],{},[582,591,594],{"href":592,"rel":593},"https://man.openbsd.org/ssh_config",[586],"ssh_config(5)",[31,596,598],{"id":597},"следующие-статьи","Следующие статьи",[43,600,601,607],{},[46,602,603],{},[582,604,606],{"href":605},"/wiki/linux/ubuntu","Первые шаги на Ubuntu 22.04",[46,608,609],{},[582,610,612],{"href":611},"/wiki/linux/firewall","Файрвол на Linux: обзор",[614,615,616],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":87,"searchDepth":229,"depth":229,"links":618},[619,620,621,622,628,629,630,631,632],{"id":33,"depth":229,"text":34},{"id":40,"depth":229,"text":41},{"id":57,"depth":229,"text":58},{"id":69,"depth":229,"text":70,"children":623},[624,625,626,627],{"id":74,"depth":241,"text":75},{"id":165,"depth":241,"text":166},{"id":272,"depth":241,"text":273},{"id":299,"depth":241,"text":300},{"id":364,"depth":229,"text":365},{"id":407,"depth":229,"text":408},{"id":490,"depth":229,"text":491},{"id":575,"depth":229,"text":576},{"id":597,"depth":229,"text":598},"Как настроить вход по SSH-ключу и отключить парольную аутентификацию.","md",{},true,"/wiki/linux/ssh","Linux",{"title":5,"description":633},"wiki/linux/ssh","sh9vqV7nTgVxbBP_yyftY75SLMrM1ZNZpaS1Wo5pPlE",1788285516908]