power小型機(jī)AIX上ssh安裝

1、power小型機(jī)AIX ssh安裝配置文檔文檔信息(文檔編號(hào)IBM AIX-122)文擋名稱作者電話QQpower小型機(jī)AIX ssh安裝配置文檔朱亞銘13951968365150111099文檔修訂記錄編號(hào)修訂內(nèi)容簡(jiǎn)述修訂日期修訂前版本號(hào)V1.0整體文檔的編寫2016.12.23注：技術(shù)交流郵箱 ymzhu2005目錄一、AIX 安裝并啟用openssh41.1 ssh用途41.2 安裝軟件41.3常規(guī)檢查命令6二、SSH無法登錄AIX的常見原因及解決辦法62.1、sshd子系統(tǒng)沒啟動(dòng)6如何檢查是否啟動(dòng)？7如何啟動(dòng)sshd子系統(tǒng)？72.2、沒有安裝openssh7怎么知道是否安裝了opens

2、sh？72.3、端口配置錯(cuò)誤8查看當(dāng)前端口？82.4、修改了openssh端口，但沒有重啟服務(wù)82.5、修改了openssh端口，但是端口沖突了82.6、協(xié)議不匹配9附件 相關(guān)資料91、查看ssh進(jìn)程92、重啟sshd服務(wù)93、/etc/ssh/sshd_config配置文件示例9一、AIX 安裝并啟用openssh1.1 ssh用途主要在ssh遠(yuǎn)程登錄和安裝Oracle數(shù)據(jù)庫時(shí)使用。1.2 安裝軟件在對(duì)應(yīng)的系統(tǒng)安裝盤內(nèi)，有響應(yīng)的ssh安裝包，盡量使用對(duì)應(yīng)版本的ssh安裝包，不然會(huì)有首先將系統(tǒng)光盤放進(jìn)光驅(qū)內(nèi)，使用命令#smitty easy_install安裝openssh.client和op

3、enssh_server這兩個(gè)軟件包重啟機(jī)器，查看openssh有沒有安裝并啟動(dòng)。一般安裝至此，就可以正常登錄到ssh界面了1.3常規(guī)檢查命令安裝過的文件集：lslpp -l | grep ssh查看ssh服務(wù)：lssrc -a | grep ssh啟動(dòng)ssh服務(wù)：startsrc -s sshd停止ssh服務(wù)：stopsrc -s sshd二、SSH無法登錄AIX的常見原因及解決辦法2.1、sshd子系統(tǒng)沒啟動(dòng)客戶端登錄時(shí)報(bào)錯(cuò)：The remote system refused the connection.如果是操作系統(tǒng)剛剛重啟，那么稍等一下，等它啟動(dòng)完成。否則，請(qǐng)檢查它是否啟動(dòng)。如何檢查

4、是否啟動(dòng)？已啟動(dòng)：# lssrc -s sshdSubsystem         Group            PID          Status  sshd             ssh              208930       active未啟

5、動(dòng)：# lssrc -s sshd   Subsystem         Group            PID          Status  sshd             ssh                       &

6、#160;   inoperative對(duì)于服務(wù)未啟動(dòng)這種問題，我們只要啟動(dòng)sshd子系統(tǒng)即可解決問題。如何啟動(dòng)sshd子系統(tǒng)？# startsrc -s sshd0513-059 The sshd Subsystem has been started. Subsystem PID is 553084.啟動(dòng)后檢查，發(fā)現(xiàn)sshd已經(jīng)啟動(dòng)，如下所示：# lssrc -s sshdSubsystem         Group            PID     

7、0;    Status  sshd             ssh               553084      active2.2、沒有安裝openssh客戶端登錄時(shí)報(bào)錯(cuò)：The remote system refused the connection.怎么知道是否安裝了openssh？方法一：lslpp# lslpp -l|grep ssh  openssh.bas

8、e.client     5.2.0.5300  COMMITTED  Open Secure Shell Commands  openssh.base.server     5.2.0.5300  COMMITTED  Open Secure Shell Server  openssh.man.en_US       5.2.0.5300  COMMITTED  Open Secure Shell  openssh.msg.en_US

9、       5.2.0.5300  COMMITTED  Open Secure Shell Messages -  openssh.base.client     5.2.0.5300  COMMITTED  Open Secure Shell Commands  openssh.base.server     5.2.0.5300  COMMITTED  Open Secure Shell Server如果沒有看到類似如上的結(jié)果，說明沒有安

10、裝。方法二： lssrc# lssrc -s sshd如果沒有任何結(jié)果，一般也說明沒安裝。方法三：smitty listsmitty list   List Installed Software and Related Information   List Installed Software  * SOFTWARE name                                

11、;      all   使用 /ssh在結(jié)果中找！安裝方法請(qǐng)參考：AIX6.1光盤安裝openssh2.3、端口配置錯(cuò)誤客戶端登錄時(shí)報(bào)錯(cuò)： The remote system refused the connection.查看當(dāng)前端口？# cat /etc/ssh/sshd_config找到Port開頭的行，如果前面有注釋（#Port），說明使用默認(rèn)端口22，否則就是使用了Port后面那個(gè)數(shù)字端口。2.4、修改了openssh端口，但沒有重啟服務(wù)客戶端登錄時(shí)報(bào)錯(cuò)：The remote system refused the conne

12、ction.這種問題一般是修改了端口后（/etc/ssh/sshd_config中的Port行），沒有重啟openssh服務(wù)，重啟方法：# stopsrc -s sshd# startsrc -s sshd2.5、修改了openssh端口，但是端口沖突了癥狀：客戶端登錄時(shí)沒有反應(yīng)。我曾經(jīng)將/etc/ssh/sshd_config中的 #Port 22 改成了 Port 25 做過測(cè)試，確實(shí)客戶端沒有反應(yīng)了，后來改成 Port 29 就可以連接上了。2.6、協(xié)議不匹配客戶端登錄時(shí)報(bào)錯(cuò)： The client has disconnected from the ser

13、ver.  Reason:Protocol version mismatch. Required protocol version is 1.3 - 1.99.  Received version was 2.0. 這是因?yàn)榭蛻舳说卿洉r(shí)選擇了ssh1協(xié)議，aix6.1安裝openssh后默認(rèn)使用2.0協(xié)議，需要客戶端登錄的協(xié)議改成ssh2即可登錄。附件 相關(guān)資料1、查看ssh進(jìn)程# ps -ef | grep sshd    root 430148 159844   0 02:26:48      - &

14、#160;0:00 /usr/sbin/sshd2、重啟sshd服務(wù)# stopsrc -s sshd0513-044 The /usr/sbin/sshd Subsystem was requested to stop.# startsrc -s sshd0513-059 The sshd Subsystem has been started. Subsystem PID is 241868.3、/etc/ssh/sshd_config配置文件示例# cat /etc/ssh/sshd_config#       $OpenBSD: sshd_conf

15、ig,v 1.80 2008/07/02 02:24:18 djm Exp $ # This is the sshd server system-wide configuration file.  See# sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with# O

16、penSSH is to specify options with their default value where# possible, but leave them commented.  Uncommented options change a# default value. #Port 22#AddressFamily any#ListenAddress 0.0.0.0#ListenAddress : # Disable legacy (protocol version 1) support in the server for new# installa

17、tions. In future the default will change to require explicit# activation of protocol 1Protocol 2 # HostKey for protocol version 1#HostKey /etc/ssh/ssh_host_key# HostKeys for protocol version 2#HostKey /etc/ssh/ssh_host_rsa_key#HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of epheme

18、ral version 1 server key#KeyRegenerationInterval 1h#ServerKeyBits 1024 # Logging# obsoletes QuietMode and FascistLogging#SyslogFacility AUTH#LogLevel INFO # Authentication: #LoginGraceTime 2m#PermitRootLogin yes#StrictModes yes#MaxAuthTries 6#MaxSessions 10 #RSAAuthentication yes

19、#PubkeyAuthentication yes#AuthorizedKeysFile     .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts#RhostsRSAAuthentication no# similar for protocol version 2#HostbasedAuthentication no# Change to yes if you don't trust /.ssh/known_hos

20、ts for# RhostsRSAAuthentication and HostbasedAuthentication#IgnoreUserKnownHosts no# Don't read the user's /.rhosts and /.shosts files#IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here!#PasswordAuthentication yes#PermitEmptyPasswords no # Change to no t

21、o disable s/key passwords#ChallengeResponseAuthentication yes # Kerberos options#KerberosAuthentication no#KerberosOrLocalPasswd yes#KerberosTicketCleanup yes#KerberosGetAFSToken no # GSSAPI options#GSSAPIAuthentication no#GSSAPICleanupCredentials yes # Set this to 'yes' to en

22、able PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and# PasswordAuthentication.  Depending on your PAM configuration,# PAM authentication via ChallengeResponseAuthentication may bypass# the setting of "PermitRootLogin without-password".# If you just want the PAM account and session checks to run without# PAM authentication, then enable this but set PasswordAuthentication# and ChallengeResponseAuthentication to 'no'.#