Linux系统裁剪笔记之五dropbear嵌入式系统专用ssh远程登录服务

1.什么裁剪?

本篇文章的主要目的是让笔者和读者更深的认识Linux系统的运作方式,大致内容就是把Linux拆开自己一个个组件来组装,然后完成一个微型的Linux系统.下面,让我们来实现吧..写的不好的地方请指教.

2.原理

大家都知道,操作系统的启动流程是(主要是Linux):POST—>BIOS—>MBR—kernel-->initrd-->sbin/init,

POST,BIOS都不是我们管的,所以这里我们从MBR开始,Linux的系统引导先主要是用的grub这个软件,grub引导系统了,然后启动内核,内核调用initrd来实现最基本的操作系统.

3.实验目的（给精简linux增加ssh服务应用） 

前期准备：已经安装制作了一个精简的linux系统

在宿主虚拟机添加IDE硬盘，并分2个分区，并挂载:

mount /dev/hda1 /mnt/boot

mount /dev/hda2 /mnt/sysroot

dropbear：嵌入式系统专用的ssh服务器端和客户端工具

服务器端：dropbear     dropbearkey

客户端：dbclient

dropbear默认使用nsswitch实现名称解析

/etc/nsswitch.conf

/lib/libnss_files*

/usr/lib/libnss3.so

/usr/lib/libnss_files*

dropbear会在用户登录检查其默认shell是否当前系统的安全shell

/etc/shells

主机密钥默认位置：

/etc/dropbear/

RSA：dropbear_rsa_host_key  （RSA加密方式）

长度可变，只要是8的整数倍，默认为1024

DSS：dropbear_dss_host_key   (DSS加密方式)

长度固定，默认为1024

dropbearkey 生成密钥命令

-t rsa|dss   指定密钥类型

-f /path/to/KEY_FILE  指定生成的密钥保存位置

-s SIZE  指定生成密钥的字节大小

 实现ssh远程登录服务的步骤如下：

 1、先下载dropbear-2013.56.tar.bz2

[root@localhost ~]# lftp test@10.109.134.247  登录ftp服务器

口令:

lftp test@10.109.134.247:/> get dropbear-2013.56.tar.bz2 下载dropber软件

1578454 bytes transferred

lftp test@10.109.134.247:/> exit

[root@localhost ~]# ls

anaconda-ks.cfg   Desktop   install.log   sbin   bin   sys  lib   dev

install.log.syslog    showdate.sh   busybox-1.20.2    dropbear-2013.56.tar.bz2

[root@localhost ~]# tar xf dropbear-2013.56.tar.bz2   解压缩安装包

[root@localhost ~]# cd dropbear-2013.56   进入解压缩目录

[root@localhost dropbear-2013.56]#./configure   编译前生成makefile

[root@localhost dropbear-2013.56]#make   编译

[root@localhost dropbear-2013.56]# make install  编译安装

install -d -m 755 /usr/local/sbin

install -m 755 dropbear /usr/local/sbin

chown root /usr/local/sbin/dropbear

chgrp 0 /usr/local/sbin/dropbear

install -d -m 755 /usr/local/bin

install -m 755 dbclient /usr/local/bin

chown root /usr/local/bin/dbclient

chgrp 0 /usr/local/bin/dbclient

install -d -m 755 /usr/local/bin

install -m 755 dropbearkey /usr/local/bin

chown root /usr/local/bin/dropbearkey

chgrp 0 /usr/local/bin/dropbearkey

install -d -m 755 /usr/local/bin

install -m 755 dropbearconvert /usr/local/bin

chown root /usr/local/bin/dropbearconvert

chgrp 0 /usr/local/bin/dropbearconvert

[root@localhost dropbear-2013.56]# cd ~   进入到家目录，该目录有复制binlib脚本

[root@localhost ~]# ./cpbin.sh    执行复制库命令脚本，复制dropbear所需的三个文档

dropbear  dbclient  dropbearkey

Your command:dropbear

copy /usr/local/sbin/dropbear is finished.

copy lib /lib64/libcrypt.so.1 finished.

copy lib /lib64/libutil.so.1 finished.

copy lib /usr/lib64/libz.so.1 finished.

copy /usr/local/sbin/dropbear finished.

Continue: dbclient

copy /usr/local/bin/dbclient is finished.

copy /usr/local/bin/dbclient finished.

Continue: dropbearkey

copy /usr/local/bin/dropbearkey is finished.

copy /usr/local/bin/dropbearkey finished.

Continue: q

[root@localhost ~]# sync

[root@localhost ~]# sync

[root@localhost ~]# cd /mnt/sysroot   进入到系统挂载的根目录

[root@localhost sysroot]# vim etc/shells  新建shell文档

/bin/sh

/bin/bash

/bin/ash

/bin/hush

[root@localhost sysroot]# vim etc/fstab  编辑fstab文档

sysfs       /sys         sysfs        defaults       0 0

proc       /proc         proc         defaults       0 0

devpts      /dev/pts      devpts        mode=620       0 0  新增改行内容

/dev/hda1    /boot        ext3         defaults       0 0

/dev/hda2    /           ext3         defaults       1 1

[root@localhost sysroot]# mkdir dev/pts   新建pts目录

[root@localhost sysroot]# sync

[root@localhost sysroot]# sync

[root@localhost sysroot]# mkdir etc/dropbear

[root@localhost sysroot]# dropbearkey -t rsa -f /mnt/sysroot/etc/dropbear

/drobear_rsa_host_key -s 2048  指定密钥类型为rsa并生成密钥存储在指定目录中

Will output 2048 bit rsa secret key to '/mnt/sysroot/etc/dropbear/dropbear_rsa_host_key'

Generating key, this may take a while...

Public key portion is:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAwCkisXjhRaNz1oHo4XbFR6LHGHx7rtk8CVGJ263h5UBWUtmoo/fVZK/x8ZvzJQiDJn3sQjxH9DT41wpFnu79Z1h2Fmfq0YSmRVc0jxlYGfJWScIbspkFF89kGa0z+PuqD1lEbbrzCQ8lfzqNS7CYA3OOZKlLxfGQbev7KGMqvaHOkorEHP7D27nIug1Ftm5DWqax3lIOfL5r5fdMMMVjVQvRM8ZXV7RiXZKnHeMJhkLcB4dbkZy1mktEjTd43tDUSf+Knz/oz0sEt1eNxSCoqf20Q62syJIWJhE3ZTTBdvrKhhoiEOP8UScgH88AogkQgONL7srCxZ0dCCFOIDZc+6q4Rc= root@localhost.localdomain

Fingerprint: md5 03:df:ce:13:9c:72:98:4c:56:10:77:21:2d:de:1f:6b

[root@localhost sysroot]# dropbearkey -t dss -f /mnt/sysroot/etc/dropbear

/drobear_dss_host_key   指定密钥类型为dss并生成密钥存储在指定目录中

Will output 1024 bit dss secret key to '/mnt/sysroot/etc/dropbear/dropbear_dss_host_key'

Generating key, this may take a while...

Public key portion is:

ssh-dss AAAAB3NzaC1kc3MAAACBAMgEVlFM0PqJxvTC4pqYue+3K+i08oaEQ/1LWHlg+ZizypeNj55dnMsIo2vjcYsDaBiXLj9iFH8mAfAiI7NEi9pl61y2LlLRvFuY2C1b2tb5i4fzWJ0f4bAbOUl7ETmjXtq2OHBauyrho+kAomvmoeub30oog0LSYoB91KhM5bQ/AAAAFQCPOzSbxoRJkfMdIPQiNlZ59oClVwAAAIBqHmhRS1C7CnkU3v0RAZzyyPqdaar6e6FV1fG8D/kS3wxedFH61PFPlNut7Y3qa3HTcuewal+yZChouKpVhSxMsRbdc+6qyiMxeO7nNKZbIzYa4+XvZTCBY71H8no0J4B+4t205w0ymMCnvFOH51yEdbQ9rCIdiIG5imufZHNwQgAAAIBH4AlrTagsMMzW5Lb0caXsXj0kodhckCKECWVVc7aP+x9ypKAyp1SSVkbzAvv8aSSlW4/V9OMxEq74hTT04Lp8Bh7Mng7YoFA1TMuaAP3MtBfcpOLy39mIFpniiQuk0loWfRwkhmjzxA+Z+J6GqoUjWr09st3ftQF0tgYAa6F+IA== root@localhost.localdomain

Fingerprint: md5 9f:b0:e3:8f:71:c4:ca:89:90:97:7f:a5:f1:48:dc:bf

[root@localhost sysroot]# ls etc/dropbear/

dropbear_dss_host_key  dropbear_rsa_host_key     两种类型的密钥已生成

[root@localhost sysroot]# mkdir usr/lib

[root@localhost sysroot]# ls usr/

bin  lib  lib64  local  sbin

[root@localhost sysroot]# pwd

/mnt/sysroot

[root@localhost sysroot]# cd ~

[root@localhost ~]# cp -d /lib/libnss_files* /mnt/sysroot/lib/ 复制密钥所需的库文件

[root@localhost ~]# cp -d /usr/lib/libnss3.so /usr/lib/libnss_files.so /mnt/sysroot/usr/lib/   复制密钥所需库文件，路径要对应

[root@localhost ~]# ls /mnt/sysroot/lib

libnss_files-2.5.so  libnss_files.so.2  modules

[root@localhost ~]# ls -l /mnt/sysroot/usr/lib

总计 1176

-rwxr-xr-x 1 root root 1188804 12-21 06:44 libnss3.so

lrwxrwxrwx 1 root root      27 12-21 06:44 libnss_files.so -> ../../lib/libnss_files.so.2

[root@localhost ~]# cp /etc/nsswitch.conf  /mnt/sysroot/etc/ 复制配置文件

[root@localhost ~]# vim /mnt/sysroot/etc/nsswitch.conf  编辑配置文件，只需保留以下四行即可

passwd:      files

shadow:      files

group:       files

hosts:       files dns

[root@localhost ~]# sync  把数据同步写入至硬盘