Linux服务器设置公钥等初始化操作脚本

Raw

#!/usr/bin/env bash set -euo pipefail # ====== 可配置项 ====== PUB_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQxxxxxxx [email protected]" SSH_DIR="$HOME/.ssh" AUTHORIZED_KEYS="$SSH_DIR/authorized_keys" SSHD_CONFIG="/etc/ssh/sshd_config" echo "[INFO] Starting server initialization..." # ====== 1. 确保 .ssh 目录存在且权限正确 ====== echo "[INFO] Ensuring .ssh directory..." mkdir -p "$SSH_DIR" chmod 700 "$SSH_DIR" # ====== 2. 添加公钥（幂等处理：避免重复）====== echo "[INFO] Adding public key..." touch "$AUTHORIZED_KEYS" if ! grep -qF "$PUB_KEY" "$AUTHORIZED_KEYS"; then echo "$PUB_KEY" >> "$AUTHORIZED_KEYS" echo "[INFO] Public key added." else echo "[INFO] Public key already exists. Skipping." fi chmod 600 "$AUTHORIZED_KEYS" # ====== 3. 修改 sshd_config ====== echo "[INFO] Configuring sshd..." # 备份 cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak_$(date +%F_%H-%M-%S)" # 确保 PubkeyAuthentication 启用 if grep -q "^#PubkeyAuthentication yes" "$SSHD_CONFIG"; then sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/' "$SSHD_CONFIG" elif ! grep -q "^PubkeyAuthentication yes" "$SSHD_CONFIG"; then echo "PubkeyAuthentication yes" >> "$SSHD_CONFIG" fi # ====== 4. 推荐安全增强项 ====== # 禁止密码登录（互联网服务器强烈建议，内网/专网服务器可选） # if grep -q "^#PasswordAuthentication" "$SSHD_CONFIG"; then # sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG" # elif grep -q "^PasswordAuthentication" "$SSHD_CONFIG"; then # sed -i 's/^PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG" # else # echo "PasswordAuthentication no" >> "$SSHD_CONFIG" # fi # 禁止 root 直接登录（可选） # if grep -q "^#PermitRootLogin" "$SSHD_CONFIG"; then # sed -i 's/^#PermitRootLogin.*/PermitRootLogin prohibit-password/' "$SSHD_CONFIG" # elif grep -q "^PermitRootLogin" "$SSHD_CONFIG"; then # sed -i 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/' "$SSHD_CONFIG" # else # echo "PermitRootLogin prohibit-password" >> "$SSHD_CONFIG" # fi # ====== 5. 重启 sshd ====== echo "[INFO] Restarting sshd..." if command -v systemctl >/dev/null 2>&1; then systemctl restart sshd || systemctl restart ssh else service sshd restart || service ssh restart fi echo "[INFO] Done."

1	#!/usr/bin/env bash
2	set -euo pipefail
3
4	# ====== 可配置项 ======
5	PUB_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQxxxxxxx [email protected]"
6	SSH_DIR="$HOME/.ssh"
7	AUTHORIZED_KEYS="$SSH_DIR/authorized_keys"
8	SSHD_CONFIG="/etc/ssh/sshd_config"
9
10	echo "[INFO] Starting server initialization..."
11
12	# ====== 1. 确保 .ssh 目录存在且权限正确 ======
13	echo "[INFO] Ensuring .ssh directory..."
14	mkdir -p "$SSH_DIR"
15	chmod 700 "$SSH_DIR"
16
17	# ====== 2. 添加公钥（幂等处理：避免重复）======
18	echo "[INFO] Adding public key..."
19	touch "$AUTHORIZED_KEYS"
20
21	if ! grep -qF "$PUB_KEY" "$AUTHORIZED_KEYS"; then
22	echo "$PUB_KEY" >> "$AUTHORIZED_KEYS"
23	echo "[INFO] Public key added."
24	else
25	echo "[INFO] Public key already exists. Skipping."
26	fi
27
28	chmod 600 "$AUTHORIZED_KEYS"
29
30	# ====== 3. 修改 sshd_config ======
31	echo "[INFO] Configuring sshd..."
32
33	# 备份
34	cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak_$(date +%F_%H-%M-%S)"
35
36	# 确保 PubkeyAuthentication 启用
37	if grep -q "^#PubkeyAuthentication yes" "$SSHD_CONFIG"; then
38	sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/' "$SSHD_CONFIG"
39	elif ! grep -q "^PubkeyAuthentication yes" "$SSHD_CONFIG"; then
40	echo "PubkeyAuthentication yes" >> "$SSHD_CONFIG"
41	fi
42
43	# ====== 4. 推荐安全增强项 ======
44
45	# 禁止密码登录（互联网服务器强烈建议，内网/专网服务器可选）
46	# if grep -q "^#PasswordAuthentication" "$SSHD_CONFIG"; then
47	# sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
48	# elif grep -q "^PasswordAuthentication" "$SSHD_CONFIG"; then
49	# sed -i 's/^PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
50	# else
51	# echo "PasswordAuthentication no" >> "$SSHD_CONFIG"
52	# fi
53
54	# 禁止 root 直接登录（可选）
55	# if grep -q "^#PermitRootLogin" "$SSHD_CONFIG"; then
56	# sed -i 's/^#PermitRootLogin.*/PermitRootLogin prohibit-password/' "$SSHD_CONFIG"
57	# elif grep -q "^PermitRootLogin" "$SSHD_CONFIG"; then
58	# sed -i 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/' "$SSHD_CONFIG"
59	# else
60	# echo "PermitRootLogin prohibit-password" >> "$SSHD_CONFIG"
61	# fi
62
63	# ====== 5. 重启 sshd ======
64	echo "[INFO] Restarting sshd..."
65
66	if command -v systemctl >/dev/null 2>&1; then
67	systemctl restart sshd \|\| systemctl restart ssh
68	else
69	service sshd restart \|\| service ssh restart
70	fi
71
72	echo "[INFO] Done."