【前言】
目的：在兩個Linux之間建立信任關系，互相訪問不用輸入密碼
環境：RHEL5+SSH
說明：需要建立信任關系的用戶為Oracle，兩台主機hostname分別為：vm1/vm2
【步驟】
(1)、切換到需要建立信任關系的用戶，這裡是oracle用戶
(2)、執行命令：ssh-keygen -d,然後一直回車.
該命令會在用戶home目錄下生成一個隱藏的.ssh目錄。目錄裡面有兩個文件：
id_dsa、id_dsa.pub
這兩個是密鑰文件，id_dsa是密鑰，id_dsa.pub是公鑰
(3)、在.ssh目錄下建立文件：authorized_keys2
(4)、在主機vm2上面執行步驟1~3
(5)、將vm1主機的id_dsa.pub文件內容復制到vm2主機的authorized_keys2
(6)、將vm2主機的id_dsa.pub文件內容復制到vm1主機的authorized_keys2
詳細步驟可以參考下面：
[root@vm1:/]#su - oracle
[oracle@vm1]#pwd
/home/oracle
[oracle@vm1]#ls -la
總計 44
drwx------ 3 oracle oinstall 4096 03-30 17:48 .
drwxr-xr-x 4 root root 4096 03-30 17:00 ..
-rw------- 1 oracle oinstall 933 03-31 15:54 .bash_history
-rw-r--r-- 1 oracle oinstall 24 03-30 17:00 .bash_logout
-rw-r--r-- 1 oracle oinstall 629 03-30 17:48 .bash_profile
-rw-r--r-- 1 oracle oinstall 124 03-30 17:00 .bashrc
-rw-r--r-- 1 oracle oinstall 515 03-30 17:00 .emacs
drwxr-xr-x 3 oracle oinstall 4096 03-30 17:00 .kde
-rw------- 1 oracle oinstall 682 03-30 17:48 .viminfo
-rw-r--r-- 1 oracle oinstall 658 03-30 17:00 .zshrc
[oracle@vm1]#ssh-keygen -d
Generating public/private dsa key pair.
Enter file in which to save the key (/home/oracle/.ssh/id_dsa):
Created directory '/home/oracle/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/oracle/.ssh/id_dsa.
Your public key has been saved in /home/oracle/.ssh/id_dsa.pub.
The key fingerprint is:
24:a2:81:6c:f3:77:b2:99:79:50:c4:2b:bb:98:8f:ca oracle@vm1
[oracle@vm1]#ls -la
總計 48
drwx------ 4 oracle oinstall 4096 04-01 19:27 .
drwxr-xr-x 4 root root 4096 03-30 17:00 ..
-rw------- 1 oracle oinstall 933 03-31 15:54 .bash_history
-rw-r--r-- 1 oracle oinstall 24 03-30 17:00 .bash_logout
-rw-r--r-- 1 oracle oinstall 629 03-30 17:48 .bash_profile
-rw-r--r-- 1 oracle oinstall 124 03-30 17:00 .bashrc
-rw-r--r-- 1 oracle oinstall 515 03-30 17:00 .emacs
drwxr-xr-x 3 oracle oinstall 4096 03-30 17:00 .kde
drwx------ 2 oracle oinstall 4096 04-01 19:27 .ssh
-rw------- 1 oracle oinstall 682 03-30 17:48 .viminfo
-rw-r--r-- 1 oracle oinstall 658 03-30 17:00 .zshrc
[oracle@vm1]#cd .ssh
[oracle@vm1]#ls -l
總計 8
-rw------- 1 oracle oinstall 668 04-01 19:27 id_dsa
-rw-r--r-- 1 oracle oinstall 600 04-01 19:27 id_dsa.pub
[oracle@vm1]#touch authorized_keys2
[oracle@vm1]#ls -l
總計 8
-rw-r--r-- 1 oracle oinstall 0 04-01 19:27 authorized_keys2
-rw------- 1 oracle oinstall 668 04-01 19:27 id_dsa
-rw-r--r-- 1 oracle oinstall 600 04-01 19:27 id_dsa.pub
[oracle@vm1]#cp id_dsa.pub id_dsa.pub.vm1
[oracle@vm1]#scp id_dsa.pub.vm1 vm2:/home/oracle/.ssh/
The authenticity of host 'vm2 (139.122.1.20)' can't be established.
RSA key fingerprint is 2d:01:46:c1:55:6e:57:ef:0c:c1:55:50:b4:fa:39:6a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'vm2,139.122.1.20' (RSA) to the list of known hosts.
oracle@vm2's password:
id_dsa.pub.vm1 100% 600 0.6KB/s 00:00
[oracle@vm1]#ls -l
總計 20
-rw-r--r-- 1 oracle oinstall 0 04-01 19:27 authorized_keys2
-rw------- 1 oracle oinstall 668 04-01 19:27 id_dsa
-rw-r--r-- 1 oracle oinstall 600 04-01 19:27 id_dsa.pub
-rw-r--r-- 1 oracle oinstall 600 04-01 19:29 id_dsa.pub.vm1
-rw-r--r-- 1 oracle oinstall 600 04-01 19:30 id_dsa.pub.vm2
-rw-r--r-- 1 oracle oinstall 398 04-01 19:29 known_hosts
[oracle@vm1]#cat id_dsa.pub.vm2
ssh-dss AAAAB3NzaC1kc3MAAACBAL/W2eqD725BtEZeB+v/VOBm1TIlCU4BnDlatNBLSdNtNpnLvGU4mcv8Ym9Xk25plMB2J3YJY4o6FGVFLrAaBVzsJFvWJcZDzrsGNyaEFmW6M8SbxQV4lC/kITkuSAXnmMGE2oSeHUxRFVO5AdOIQ7x5W7bJtOe+WcHA6xgunUcTAAAAFQCMlW/wduHRlTRyluNsUhz2IF7ZrQAAAIAOzgpQbvibWn0pUstJ5jIN0J53OHVXk4wVz/R8tg9ltob+V7Jru3ABDs3/DpLJC4Ep1B1gW6rI+/sxr6Z2qGT100WOz3xKowDNREst9SHiwXPVjPy/Vv/Ymqeugc5AX3/eicVtgCgY+hxfM+4rBrTLZ19HyNSGF7YxVrsEuPSEqAAAAIB8XKN6qc7HjTfngcqwmDREaagb7y8VkYj4kUTl31vrvTXBBeUCCuaVvAUPF1bf7U55Iy4OMv6hJ4ZBXwNzK/6/2QKYt3tS8ncFg/PkGRHvafQi8HglIbAoI9cErIDDb7G55mDtoctyuoCe6apfcnxJiJNFxxgxJjjgAHdNIpEBsg== oracle@vm2
[oracle@vm1]#cat id_dsa.pub.vm2 > authorized_keys2
[oracle@vm1]#cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 vm1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
139.122.1.10 vm1
139.122.1.20 vm2
[oracle@vm1]#ssh vm2 ls
[oracle@vm1]#ssh vm2 ls -a
.
..
.bash_history
.bash_logout
.bash_profile
.bashrc
.emacs
.kde
.ssh
.viminfo
.zshrcd
成功之後用ssh或者scp命令都不用輸入密碼【建立後第一次訪問可能要確認一次】，如果不成功可能原因如下：
1、.ssh目錄以及目錄內文件權限不正確
.ssh目錄權限為700，目錄內文件權限為644
2、復制公鑰文件id_dsa.pub的時候復制了多余的字符，比如空格或者換行，所以我上面演示的例子用了一種看起來比較
麻煩但算是安全的做法
備注：
如果要建立多台主機，比如四台主機之間的root用戶之間的信任關系，步驟和上面差不多，假設四台主機hostname分別為：
VM1
VM2
VM3
VM4
步驟如下：
(1)、用root用戶登陸VM1
(2)、cd ~
(3)、執行命令：ssh-keygen -d,然後一直回車.
(4)、在root用戶的主目錄的.ssh目錄下建立文件：authorized_keys2,修改權限為：644
(5)、在其他主機上面執行步驟1、2、3、4
(6)、將VM2、VM3、VM4主機的id_dsa.pub文件內容依次復制到csg-dev1主機的authorized_keys2內
(7)、在其他主機上重復步驟6[將除了自己之外的其他主機的公鑰文件的內容復制到本機的authorized_keys2裡面].
3、驗證
在csg-dev1上面用root用戶執行命令：
#ssh VM2主機IP ls
#ssh VM3主機IP ls
#ssh VM4主機IP ls
如果能順利列出對方主機文件，則說明配置成功.
