AWS(EC2) SSH公開鍵設定

AWSでセキュリティを高めるために踏み台(Gateway)サーバを設け、内部のサーバには踏み台経由でしかSSHアクセスさせない構成を取ることが考えられます。(ってかSecurity Groupでするんやけど。) その際、ローカルサブネット間でSSH通信を行うための設定をまとめました。そうです。何をいまさらです。踏み台サーバで秘密鍵と公開鍵を作成して公開鍵を内部サーバにぶち込んで終わりです。

■構成概要

GatewayサーバIP：10.0.8.250
Web01サーバIP：10.0.8.10

---

■Gatewayサーバにて秘密鍵(id_rsa)と公開鍵(id_rsa.pub)の生成
[ec2-user@ip-10-0-8-250 ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/ec2-user/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ec2-user/.ssh/id_rsa.
Your public key has been saved in /home/ec2-user/.ssh/id_rsa.pub.
The key fingerprint is:
b8:2f:b5:4b:6d:5f:e4:bd:9a:f4:e2:f2:85:17:76:d1 ec2-user@ip-10-0-8-250
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|                 |
|                 |
|         .   .   |
|      . o S  o E |
|       .  +  +   |
|    .   . O O .  |
|       . *.@ =   |
|        ..+=*    |
+-----------------+
[ec2-user@ip-10-0-8-250 ~]$ ll .ssh/
total 12
-rw------- 1 ec2-user ec2-user  400 May  2 03:18 authorized_keys
-rw------- 1 ec2-user ec2-user 1743 May  2 07:28 id_rsa
-rw-r--r-- 1 ec2-user ec2-user  406 May  2 07:28 id_rsa.pub
[ec2-user@ip-10-0-8-250 ~]$ cat .ssh/id_rsa.pub
ssh-rsa AAAAAAB3NzaC1yc2EAAA(中略)j3Nhm5RH9doQTZ/8Q== ec2-user@ip-10-0-8-250
[ec2-user@ip-10-0-8-250 ~]$
※公開鍵のパスワード忘れんように。


■公開鍵をWeb01サーバの.ssh/authorized_keysに追加
※初期のみSecurityGroupでSSH許可
※Gatewayサーバで作成したid_rsa.pubをFTP等で送るのめんどくさいんでクリップボード経由で作成。だからvi。
[ec2-user@ip-10-0-8-10 ~]$ vi id_rsa.pub
[ec2-user@ip-10-0-8-10 ~]$ cat id_rsa.pub >> .ssh/authorized_keys


■GatewayサーバからWeb01サーバに接続
[ec2-user@ip-10-0-8-250 ~]$ ssh 10.0.8.10
The authenticity of host '10.0.8.10 (10.0.8.10)' can't be established.
RSA key fingerprint is 25:23:55:1b:e7:34:8c:d8:c8:43:ef:31:0e:84:c8:6a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.8.10' (RSA) to the list of known hosts.
Enter passphrase for key '/home/ec2-user/.ssh/id_rsa':　←公開鍵のパスワード
Last login: Sat May  2 07:26:04 2012 from pc1.slb-unet.ocn.ne.jp

       __|  __|_  )
       _|  (     /   Amazon Linux AMI
      ___|\___|___|

See /usr/share/doc/system-release/ for latest release notes.
There are 11 security update(s) out of 22 total update(s) available
Run "sudo yum update" to apply all updates.
[ec2-user@ip-10-0-8-10 ~]$

接続成功！　--以上。--