前提条件

• SSH服务已打开。
• SSH端口不会被防火墙关闭。
• 配置文件中各主机名称和IP配置正确。
• 所有机器节点间网络畅通。
• 如果为普通用户建立互信，需要提前在各主机创建相同用户并设置相同密码。
• 如果各主机安装并启动了SELinux服务，需要确保/root和/home目录安全上下文为默认值（root目录：system_u:object_r:home_root_t:s0，home目录：system_u:object_r:admin_home_t:s0）或者关闭掉SELinux服务。

  检查系统SELinux状态的方法：执行命令getenforce，如果返回结果是Enforcing ，说明SELinux安装并启用。

  检查目录安全上下文的命令：

  ls -ldZ /root | awk '{print $4}'

  ls -ldZ /home | awk '{print $4}'

  恢复目录安全上下文命令：

  restorecon -r -vv /home/

  restorecon -r -vv /root/

  语法
  

• 建立互信

  gs_sshexkey -f HOSTFILE [-W PASSWORD] [...]  [--skip-hostname-set] [-l LOGFILE]

  检查互信

• gs_sshexkey -f HOSTFILE --check [-l LOGFILE]

  清理互信

• gs_sshexkey -f HOSTFILE --clean [-W PASSWORD] [...] [-l LOGFILE]

  显示帮助信息

• gs_sshexkey { -? | --help }

  显示版本号信息

• gs_sshexkey { -V | --version }

  参数说明
  

• -f

  主机列表，列出所有需要建立互信主机的IP。

  

  • 确保hostfile文件中只配置正确的主机IP，不包含其它信息。

  • 如果.ssh-文件夹下公私钥文件存在，则不会重新生成公私钥，使用当前的公私钥文件。如果公私钥文件内容有损，无法校验，会出现建互信失败，可手动删除密钥文件，创建互信时会自动生成新的公私钥文件。
• -W

  待建互信用户的密码。如果不指定该参数则在建立互信过程中需要交互式输入用户密码。如果各个主机的用户密码不一样时则使用多个-W参数，密码顺序和IP地址需要一一对应，交互式情况下则依次输入对应主机的密码。

• --skip-hostname-set

  是否将xml配置文件中主机名与IP的映射关系写入“/etc/hosts”文件中。默认写入，如果指定该参数则不写入。

• --check

  检查互信是否正常。只检查当前主机到其他远程主机之间的互信

• --clean

  清理已创建的互信。和创建互信对应，只负责清理gs_sshexkey脚本创建的互信。

• -l

  指定日志文件的保存路径。

  取值范围：任意存在的可访问的绝对路径。

• -?，--help

  显示帮助信息。

• -V，--version

  显示版本号信息。

示例

• 普通用户建立互信。
  各主机用户密码相同情况下建立互信。Gauss@234为用户密码。

  [omm@plat1 script]#gs_sshexkey -f hostfile -W Gauss@234
  Checking network information.
  All nodes in the network are Normal.
  Successfully checked network information.
  Creating SSH trust.
  Creating the local key file.
  Successfully created the local key files.
  Appending local ID to authorized_keys.
  Successfully appended local ID to authorized_keys.
  Updating the known_hosts file.
  Successfully updated the known_hosts file.
  Appending authorized_key on the remote node.
  Successfully appended authorized_key on all remote node.
  Checking common authentication file content.
  Successfully checked common authentication content.
  Distributing SSH trust file to all node.
  Successfully distributed SSH trust file to all node.
  Verifying SSH trust on all hosts.
  Successfully verified SSH trust on all hosts.
  Successfully created SSH trust.

• root用户建立互信。

  各主机用户密码相同情况下建立互信。Gauss@234为用户密码。

  [root@plat1 script]#./gs_sshexkey -f hostfile  -W Gauss@234
  Checking network information.
  All nodes in the network are Normal.
  Successfully checked network information.
  Creating SSH trust.
  Creating the local key file.
  Successfully created the local key files.
  Appending local ID to authorized_keys.
  Successfully appended local ID to authorized_keys.
  Updating the known_hosts file.
  Successfully updated the known_hosts file.
  Appending authorized_key on the remote node.
  Successfully appended authorized_key on all remote node.
  Checking common authentication file content.
  Successfully checked common authentication content.
  Distributing SSH trust file to all node.
  Successfully distributed SSH trust file to all node.
  Verifying SSH trust on all hosts.
  Successfully verified SSH trust on all hosts.
  Successfully created SSH trust.

  各主机用户密码相同情况下，在交互式模式下建立互信。

  [root@plat1 script]#./gs_sshexkey -f hostfile
  Please enter password for current user[root].
  Password: 
  Checking network information.
  All nodes in the network are Normal.
  Successfully checked network information.
  Creating SSH trust.
  Creating the local key file.
  Successfully created the local key files.
  Appending local ID to authorized_keys.
  Successfully appended local ID to authorized_keys.
  Updating the known_hosts file.
  Successfully updated the known_hosts file.
  Appending authorized_key on the remote node.
  Successfully appended authorized_key on all remote node.
  Checking common authentication file content.
  Successfully checked common authentication content.
  Distributing SSH trust file to all node.
  Successfully distributed SSH trust file to all node.
  Verifying SSH trust on all hosts.
  Successfully verified SSH trust on all hosts.
  Successfully created SSH trust.