CA证书申请搭建dhcp服务

非淡泊无以明志，非宁静无以致远。这篇文章主要讲述CA证书申请搭建dhcp服务相关的知识，希望能为你提供帮助。
1、创建私有CA并进行证书申请。

[root@cenos8 ~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts,private} mkdir: created directory \'/etc/pki/CA\' mkdir: created directory \'/etc/pki/CA/certs\' mkdir: created directory \'/etc/pki/CA/crl\' mkdir: created directory \'/etc/pki/CA/newcerts\' mkdir: created directory \'/etc/pki/CA/private\' [root@cenos8 ~]# cd /etc/pki/CA [root@cenos8 CA]# ls certscrlnewcertsprivate [root@cenos8 CA]# tree . ├── certs ├── crl ├── newcerts └── private 4 directories, 0 files [root@cenos8 CA]# touch index.txt [root@cenos8 CA]# echo 0F > serial [root@cenos8 CA]# ls certscrlindex.txtnewcertsprivateserial [root@cenos8 ~]# openssl ca -in /data/app1/app1.csr-out /etc/pki/CA/certs/app1.crt -days 10 Using configuration from /etc/pki/tls/openssl.cnf Can\'t open /etc/pki/CA/private/cakey.pem for reading, No such file or directory 140309506324288:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_vate/cakey.pem\',\'r\') 140309506324288:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:7 unable to load CA private key [root@cenos8 ~]# cd /etc/pki/CA [root@cenos8 CA]# (umask 066; openssl genrsa -outprivate/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus (2 primes) .......+++++ ........................................................+++++ [root@cenos8 CA]# ll private total 4 -rw-------. 1 root root 1679 Aug 26 16:32 cakey.pem [root@cenos8 CA]# cat private/cakey.pem -----BEGIN RSA PRIVATE KEY----- MIIEpQIBAAKCAQEA42pKKyC8KYok4lyvJRpNmJhbH+27+93HDpTfEVXqAoiQN3Z0 u/W2F9QfSMlq03YgEN/OonFcgmAkJ4S5Uu0TQUkgJu42ZXsy23+93rU3ai9peTrt OyN1wU1DJMfR0CtYRxK4FLELjEa8FZ3N4f6CHP/swQGq8LNzMwF6Ydr7daHUU5Dh ZGVRDDcy4qly7PhLYYDUthNHluKeQiUxsY3EeWs1KLpobG21kaF6od72nnULZds9 m4eLvH8eEysZMLKFKHZZfBgJjSvWC2/T39Q9YrKlvBcXP/HVMkFyYVqULVSPxAEh bBc+Zt7zl+BDOiVMqXbLP6qH6WbAjpTmZ12fOQIDAQABAoIBAQCYlKDsrMryR/iV U8BDcZFsd5R0KKp+w38h3mqIFA+s4Xl5bOXHkoU5GZ5f1JvzAwdiqvbV8J8z7lNz nE5HQD8yB2EmHZ+rmOw3b06yFP34JZVrvEic7B6+shsBm3u/YsWY8gtF/r+Tv4XE LxuKrJsZ3/A2UushEhWRvEUjUKx0b/rXryqAUdPY3OiFnqvN9bjJJHCMQuMaQmeF ZrNruBC1NsPuTKouta6FqEKe9rFDaz+WfZ5vSyNMizF2l18jPH7ztRnrkh7gMpWF eAimjI+t9FQYbAxtbK9T+cK3dgBj3K5Lps0PcHeVh7c0/A2PmRS58V3fRQEbjN6p 7MUvgbetAoGBAPUNcZj+oEL2MaTaj6JXUsp+by8e5SZdN/cpakEyhJcgp3srKnUW 6BUe/uydm+pOtvflgmZFdKthYZVhF0ckJdvcZn4m4xLcZSZS6q3u4Iq4Ahlu2qI6 qCiPF7cQ+RJj9RCIH635ntbJlGKwpadQ7TmLYJxHHdy/8PvySABOSu6LAoGBAO2T IsTkjFGHtDCaRez+Cb4eMjAanBgOApn2mC1c7Xk2Oz12guOQ3FyhhV4KunTVY8hO QNBqEyn+orNyrTWAxsyE5umlMIZP46QVDtCiM7ukLLy8jWVMZzGFZnx7QYETvjtj UwRWnV5c/bv/47ZT2fW41dto2ePBK5sbSCuy1UXLAoGBAMa6bFGCzT0AoynqBWnG H2IQPuKbz4HZPzW15HGTImvdE3WTgA8M0JGwXVROTM8rnr5S5flCgmcpxhV6c4JC EmHGz2em6ae2DGGUBLWhb3+P0kQF3lCJ+S1LPhQ8M4Fyhp8thWN1eBb/ytJuJykV PAzatzKFifYnwqrPxQxacfIZAoGBAKEX7zChZQB3y1hVk+rSi5qt8QwrTwMEpQDv dFr2M1TI0DyqGrDibnolUEDnd213sNSHM23fL6V/M6YIsaig7KyLxeRSjefVTh/Z 45TXF8s51NgZ5qr0ttieg1MPZOh4kbrFa+p6LPVqiucq6aadjyMOtXy0yWKlfsML KdHvzqwnAoGAJNWFya3OrxPA9/iPpkRAr9iLgAbGYR5GZSxVcKYPZ5vgLltT6ZXP Xvjn+kk1faJ6M4ZICT8Ep5dKrvzA6CIp7clW5yxGN1zcxwn1HsQlB3ZBzu8k2sYn RJOMO9xWJnPoJm604W4gMYmcitPK1vlFoJHQTTzaKHq4hBOUycwuYHU= -----END RSA PRIVATE KEY----- [root@cenos8 CA]# cd [root@cenos8 ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 3650 -out /etc/pki/CA/cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:guangdong Locality Name (eg, city) [Default City]:shenzehng^H^H^C [root@cenos8 ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 3650 -out /etc/pki/CA/cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:guangdong Locality Name (eg, city) [Default City]:shenzheng Organization Name (eg, company) [Default Company Ltd]:xiaozz Organizational Unit Name (eg, section) []:it Common Name (eg, your name or your server\'s hostname) []:cenos8.xiaozz.org Email Address []:516694894@qq.com [root@cenos8 ~]# tree /etc/pki/CA /etc/pki/CA ├── cacert.pem ├── certs ├── crl ├── index.txt ├── newcerts ├── private │└── cakey.pem └── serial4 directories, 4 files [root@cenos8 ~]# cat /etc/pki/CA/cacert.pem -----BEGIN CERTIFICATE----- MIIEAzCCAuugAwIBAgIUUaICDOlGCEY179H2p6c52psCPaUwDQYJKoZIhvcNAQEL BQAwgZAxCzAJBgNVBAYTAkNOMRIwEAYDVQQIDAlndWFuZ2RvbmcxEjAQBgNVBAcM CXNoZW56aGVuZzEPMA0GA1UECgwGeGlhb3p6MQswCQYDVQQLDAJpdDEaMBgGA1UE AwwRY2Vub3M4LnhpYW96ei5vcmcxHzAdBgkqhkiG9w0BCQEWEDUxNjY5NDg5NEBx cS5jb20wHhcNMjEwODI2MDgzNzU2WhcNMzEwODI0MDgzNzU2WjCBkDELMAkGA1UE BhMCQ04xEjAQBgNVBAgMCWd1YW5nZG9uZzESMBAGA1UEBwwJc2hlbnpoZW5nMQ8w DQYDVQQKDAZ4aWFvenoxCzAJBgNVBAsMAml0MRowGAYDVQQDDBFjZW5vczgueGlh b3p6Lm9yZzEfMB0GCSqGSIb3DQEJARYQNTE2Njk0ODk0QHFxLmNvbTCCASIwDQYJ KoZIhvcNAQEBBQADggEPADCCAQoCggEBAONqSisgvCmKJOJcryUaTZiYWx/tu/vd xw6U3xFV6gKIkDd2dLv1thfUH0jJatN2IBDfzqJxXIJgJCeEuVLtE0FJICbuNmV7 Mtt/vd61N2ovaXk67TsjdcFNQyTH0dArWEcSuBSxC4xGvBWdzeH+ghz/7MEBqvCz czMBemHa+3Wh1FOQ4WRlUQw3MuKpcuz4S2GA1LYTR5binkIlMbGNxHlrNSi6aGxt tZGheqHe9p51C2XbPZuHi7x/HhMrGTCyhSh2WXwYCY0r1gtv09/UPWKypbwXFz/x 1TJBcmFalC1Uj8QBIWwXPmbe85fgQzolTKl2yz+qh+lmwI6U5mddnzkCAwEAAaNT MFEwHQYDVR0OBBYEFIzU1iDeCPi1nRICDaFpdmHIDToHMB8GA1UdIwQYMBaAFIzU 1iDeCPi1nRICDaFpdmHIDToHMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL BQADggEBACfeS8i9k3uslc7myFi/KWKrWkdm8uLPnTWMHxJME3FH5OVw8Jr6hMDQ lzBWWTWtt70/TeQqm79Q32nmw89DImssefJrzvyCD7GYmR54kGDoCa6A7jmco8JF /PS8MJj4p5R0x/ck+nmAyYCp3jI0UlKk8WVvgVgVEnnPSoEhD/L4gAo64sZjpwdc d671myP6wsSHE/2bZDV4jJTbrW20LoeTG5teqqoa3HdNWz1/H8HOySlDS5jKjMDm d/Xim5dQQ3PjYZksIFlGOclbI8jzlgwNXlovZ4bKb/YE4d6AV8CD7uAyhYwE8EcI daqLvI7XkxYpM0CTpbEthMnYWR8LFHw= -----END CERTIFICATE----- [root@cenos8 ~]# openssl x509 -in /etc/pki/CA/cacert.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 51:a2:02:0c:e9:46:08:46:35:ef:d1:f6:a7:a7:39:da:9b:02:3d:a5 Signature Algorithm: sha256WithRSAEncryption Issuer: C = CN, ST = guangdong, L = shenzheng, O = xiaozz, OU = it, CN = cenos8.xiaozz.org, emailAddress = 516694894@qq.com Validity Not Before: Aug 26 08:37:56 2021 GMT Not After : Aug 24 08:37:56 2031 GMT Subject: C = CN, ST = guangdong, L = shenzheng, O = xiaozz, OU = it, CN = cenos8.xiaozz.org, emailAddress = 516694894@qq.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:e3:6a:4a:2b:20:bc:29:8a:24:e2:5c:af:25:1a: 4d:98:98:5b:1f:ed:bb:fb:dd:c7:0e:94:df:11:55: ea:02:88:90:37:76:74:bb:f5:b6:17:d4:1f:48:c9: 6a:d3:76:20:10:df:ce:a2:71:5c:82:60:24:27:84: b9:52:ed:13:41:49:20:26:ee:36:65:7b:32:db:7f: bd:de:b5:37:6a:2f:69:79:3a:ed:3b:23:75:c1:4d: 43:24:c7:d1:d0:2b:58:47:12:b8:14:b1:0b:8c:46: bc:15:9d:cd:e1:fe:82:1c:ff:ec:c1:01:aa:f0:b3: 73:33:01:7a:61:da:fb:75:a1:d4:53:90:e1:64:65: 51:0c:37:32:e2:a9:72:ec:f8:4b:61:80:d4:b6:13: 47:96:e2:9e:42:25:31:b1:8d:c4:79:6b:35:28:ba: 68:6c:6d:b5:91:a1:7a:a1:de:f6:9e:75:0b:65:db: 3d:9b:87:8b:bc:7f:1e:13:2b:19:30:b2:85:28:76: 59:7c:18:09:8d:2b:d6:0b:6f:d3:df:d4:3d:62:b2: a5:bc:17:17:3f:f1:d5:32:41:72:61:5a:94:2d:54: 8f:c4:01:21:6c:17:3e:66:de:f3:97:e0:43:3a:25: 4c:a9:76:cb:3f:aa:87:e9:66:c0:8e:94:e6:67:5d: 9f:39 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 8C:D4:D6:20:DE:08:F8:B5:9D:12:02:0D:A1:69:76:61:C8:0D:3A:07 X509v3 Authority Key Identifier: keyid:8C:D4:D6:20:DE:08:F8:B5:9D:12:02:0D:A1:69:76:61:C8:0D:3A:07X509v3 Basic Constraints: critical CA:TRUE Signature Algorithm: sha256WithRSAEncryption 27:de:4b:c8:bd:93:7b:ac:95:ce:e6:c8:58:bf:29:62:ab:5a: 47:66:f2:e2:cf:9d:35:8c:1f:12:4c:13:71:47:e4:e5:70:f0: 9a:fa:84:c0:d0:97:30:56:59:35:ad:b7:bd:3f:4d:e4:2a:9b: bf:50:df:69:e6:c3:cf:43:22:6b:2c:79:f2:6b:ce:fc:82:0f: b1:98:99:1e:78:90:60:e8:09:ae:80:ee:39:9c:a3:c2:45:fc: f4:bc:30:98:f8:a7:94:74:c7:f7:24:fa:79:80:c9:80:a9:de: 32:34:52:52:a4:f1:65:6f:81:58:15:12:79:cf:4a:81:21:0f: f2:f8:80:0a:3a:e2:c6:63:a7:07:5c:77:ae:f5:9b:23:fa:c2: c4:87:13:fd:9b:64:35:78:8c:94:db:ad:6d:b4:2e:87:93:1b: 9b:5e:aa:aa:1a:dc:77:4d:5b:3d:7f:1f:c1:ce:c9:29:43:4b: 98:ca:8c:c0:e6:77:f5:e2:9b:97:50:43:73:e3:61:99:2c:20: 59:46:39:c9:5b:23:c8:f3:96:0c:0d:5e:5a:2f:67:86:ca:6f: f6:04:e1:de:80:57:c0:83:ee:e0:32:85:8c:04:f0:47:08:75: aa:8b:bc:8e:d7:93:16:29:33:40:93:a5:b1:2d:84:c9:d8:59: 1f:0b:14:7c [root@cenos8 ~]# yum -y install lrzsz [root@cenos8 ~]# sz /etc/pki/CA/cacert.pem #将文件cacert.pem传到windows上，修改文件名为cacert.pem.crt，双击安装证书。

文章图片

2、总结ssh常用参数、用法。ssh命令是ssh客户端，允许实现对远程系统验证的加密安全访问。ssh客户端配置文件是：/etc/ssh/ssh_config。
ssh命令配合的常见选项：
-P port：远程服务器监听的端口

ssh 10.0.0.8 -p 2222

-b 指定连接的源ip

ssh 10.0.0.8 -p 2222 -b 10.0.0.7

【CA证书申请搭建dhcp服务】-v 调试模式

ssh 10.0.0.8 -p 2222 -v

-C 压缩方式
-X支持x11转发
支持将远程Linux主机上的图形工具在当前设备使用
-t 强制伪tty分配，如：ssh -t remoteserver1 ssh -t remoteserver2 ssh
remoteserver3
-o option 如：-o StrictHostKeyChecking=no
-i < file> 指定私钥文件路径，实现基于key验证，默认使用文件： ~/.ssh/id_dsa,
~/.ssh/id_ecdsa, /.ssh/id_ed25519，/.ssh/id_rsa等
3、总结sshd服务常用参数。sshd服务器端的配置文件：/etc/ssh/sshd_config
常用参数：

Port#端口生产建议修改 ListenAddress ip LoginGraceTime 2m PermitRootLogin yes#默认ubuntu不允许root远程ssh登录 StrictModes yes#检查.ssh/文件的所有者，权限等 MaxAuthTries6#pecifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6. MaxSessions10#同一个连接最大会话 PubkeyAuthentication yes#基于key验证 PermitEmptyPasswords no#空密码连接 PasswordAuthentication yes#基于用户名和密码连接 GatewayPorts no ClientAliveInterval 10#单位:秒 ClientAliveCountMax 3#默认3 UseDNS yes#提高速度可改为no GSSAPIAuthentication yes#提高速度可改为no MaxStartups#未认证连接最大值，默认值10 Banner /path/file#以下可以限制可登录用户的办法： AllowUsers user1 user2 user3 DenyUsers user1 user2 user3 AllowGroups g1 g2 DenyGroups g1 g2

4、搭建dhcp服务，实现ip地址申请分发

[root@centos8 ~]# yum -y install dhcp-server [root@centos8 ~]# cp /usr/share/doc/dhcp-server/dhcpd.conf.example /etc/dhcp/dhcpd.conf [root@centos8 ~]# cat /etc/dhcp/dhcpd.conf # dhcpd.conf # # Sample configuration file for ISC dhcpd ## option definitions common to all supported networks... option domain-name "example.org"; option domain-name-servers 180.76.76.76, 223.5.5.5; default-lease-time 86400; max-lease-time 106400; # Use this to enble / disable dynamic dns updates globally. #ddns-update-style none; # If this DHCP server is the official DHCP server for the local # network, the authoritative directive should be uncommented. #authoritative; # Use this to send dhcp log messages to a different log file (you also # have to hack syslog.conf to complete the redirection). log-facility local7; # No service will be given on this subnet, but declaring it helps the # DHCP server to understand the network topology.subnet 10.0.0.0 netmask 255.255.255.0 { range 10.0.0.150 10.0.0.180; option routers 10.0.0.2; next-server 10.0.0.100 filename "pxelinux.0"; }host test { hardware ethernet 00:0c:29:d8:f9:42; fixed-address 10.0.0.123; # This is a very basic subnet declaration.subnet 10.254.239.0 netmask 255.255.255.224 { range 10.254.239.10 10.254.239.20; option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org; }重启dhcp服务 [root@centos8 ~]# systemctl start dhcpd#dhcp 客户端申请地址的过程 dhclient -d #DHCP服务器的日志 [root@centos8 ~]#tail -f /var/lib/dhcpd/dhcpd.leases #DHCP客户端的日志 [root@centos7 ~]#ls /var/lib/dhclient/ dhclient.leases [root@centos7 ~]#cat /var/lib/dhclient/dhclient.leases