SSH远程登陆docker容器

浙江雁荡山

环境：
Ubuntu 16.04（mac osx的VMware Fushion环境）
任务：
Ubuntu 16.04通过SSH登陆docker（目的是为了运行在其他服务器的Jenkins访问docker，这个是另外一篇文章）

1、用户密码认证方式登陆
hsl@ubuntu:~$ sudo docker images
[sudo] hsl 的密码：
REPOSITORY TAG IMAGE ID CREATED SIZE
hsl/ubuntu 14.04_add_sourcealiyun_git_vim_ssh 7e81fb2f82c5 44 minutes ago 634.2 MB
hsl/ubuntu 14.04_JenkinsWithDocker_key 6fb1d3cb7983 46 hours ago 760 MB
hsl/ubuntu 14.04_JenkinsWithDocker_password 659fcb00b0dc 3 days ago 760.1 MB
ubuntu 14.04 4a725d3b3b1c 8 days ago 188 MB
training/webapp latest 6fae60ef3446 15 months ago 348.8 MB
hsl@ubuntu:~$ sudo docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
hsl@ubuntu:~$ sudo docker run -tid -p 22 -P hsl/ubuntu:14.04_add_sourcealiyun_git_vim_ssh
ea153153c8837a4b0e1a8d0e6945200c7ac820c358d546202f1a95c72f12ca77
hsl@ubuntu:~$ sudo docker exec -ti ea /bin/bash
root@ea153153c883:/# cd /etc/ssh
root@ea153153c883:/etc/ssh# vim sshd_config
sshd_config 需要关注三个地方，未修改之前是这样：

PermitRootLogin without-password
#AuthorizedKeysFile%h/.ssh/authorized_keys
#PasswordAuthentication yes
说明：

#PermitRootLogin yes #允许root用户以任何认证方式登录（用户名密码认证和公钥认证）
#PermitRootLogin without-password #只允许root用公钥认证方式登录
#PermitRootLogin no #不允许root用户以任何认证方式登录
这里先修改两处：
PermitRootLogin without-password 改为 PermitRootLogin yes
#PasswordAuthentication yes 改为 PasswordAuthentication yes
root@ea153153c883:/etc/ssh# cdroot@ea153153c883:~# service ssh start
* Starting OpenBSD Secure Shell server sshd [ OK ]
root@ea153153c883:/# passwd root
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@ea153153c883:/# ifconfig
#获得docker的内网地址（inet addr）：172.17.0.2
root@ea153153c883:/# exit
exit
hsl@ubuntu:~$ ssh root@172.17.0.2
root@172.17.0.2's password:
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.13.0-93-generic x86_64)
* Documentation:  https://help.ubuntu.com/
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
root@ea153153c883:~# exit
logout
Connection to 172.17.0.2 closed.
hsl@ubuntu:~$ ifconfig
#获得宿主机的内网地址（inet地址）：192.168.127.159，这里试一下端口映射方式登陆docker
#因为做了端口映射，所以可以直接从映射的端口登陆，只需要知道和docker的22端口映射的宿主机端口和宿主机的ip（如果和docker的22做端口映射时候采用默认IP方式，则默认宿主机的所有IP都和docker的22端口映射，这样localhost和子网IP均可等登陆）
#即ssh root@172.17.0.2和ssh -p 32770 root@192.168.127.159都可以登陆docker
hsl@ubuntu:~$ ssh -p 32771 root@192.168.127.159
#第一次登陆有警告
The authenticity of host '[192.168.127.159]:32771 ([192.168.127.159]:32771)' can't be established.
ECDSA key fingerprint is SHA256:icDOU4lcWTiFb4eIKUtosFNrqzGMo5ufzqXQfPdtSZg.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.127.159]:32771' (ECDSA) to the list of known hosts.
root@192.168.127.159's password:
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-36-generic x86_64)
* Documentation:  https://help.ubuntu.com/
Last login: Sun Sep 4 06:00:37 2016 from 172.17.0.1
root@ea153153c883:~# exit
logout
Connection to 192.168.127.159 closed.
hsl@ubuntu:~$ ssh -p 32771 root@192.168.127.159
#再登录一遍就没有警告了
root@192.168.127.159's password:
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-36-generic x86_64)
* Documentation:  https://help.ubuntu.com/
Last login: Sun Sep 4 06:01:33 2016 from 192.168.127.159
root@ea153153c883:~# exit
logout
Connection to 192.168.127.159 closed.


2、公钥认证方式登陆

hsl@ubuntu:~$ sudo docker run -tid -p 22 -P hsl/ubuntu:14.04_add_sourcealiyun_git_vim_ssh
f2e54200c5c7f3310a27e274d7d8c9585ed3c79f921cb63edb8f3a00d1165e24
hsl@ubuntu:~$ sudo docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f2e54200c5c7 hsl/ubuntu:14.04_add_sourcealiyun_git_vim_ssh "/bin/bash" 15 seconds ago Up 10 seconds 0.0.0.0:32768->22/tcp big_brown
hsl@ubuntu:~$ sudo docker exec -it f2 /bin/bash
root@f2e54200c5c7:/# vim /etc/ssh/sshd_config

把第一步中提到的需要注意的三个地方做以下修改：

PermitRootLogin without-password

#AuthorizedKeysFile%h/.ssh/authorized_keys改为AuthorizedKeysFile%h/.ssh/authorized_keys
#PasswordAuthentication yes改为PasswordAuthentication yes
（如果服务器不在本地，千万不能PasswordAuthentication yes->no，万一当前的ssh链接中断，万一RAS认证没弄好，密码验证又禁止了。可以理解为公钥认证优先于用户密码认证，但是万一公钥认证失败，用用户密码认证以防万一）
root@f2e54200c5c7:/# exit
exit

hsl@ubuntu:~$ ssh-keygen -t rsa
#一直回车，生成宿主机的密钥
hsl@ubuntu:~$ cd .ssh
hsl@ubuntu:~/.ssh$ ls
id_rsa id_rsa.pub
hsl@ubuntu:~/.ssh$ scp id_rsa.pub root@172.17.0.2:~/.ssh/
root@172.17.0.2's password:
id_rsa.pub 100% 392 0.4KB/s 00:00  
hsl@ubuntu:~/.ssh$ sudo docker exec -it f2 /bin/bash
root@ea153153c883:/# cd  
root@ea153153c883:~# cd .ssh
root@ea153153c883:~/.ssh# ls
id_rsa.pub
root@ea153153c883:~/.ssh# mv id_rsa.pub authorized_keys
root@ea153153c883:~/.ssh# ls
authorized_keys
********可以替换上面的通过scp方法把公钥传送到docker*********
#或者直接把宿主机的id_rsa.pub内容复制到docker的/root/.ssh/authorized_keys
hsl@ubuntu:~$ cd .ssh
hsl@ubuntu:~/.ssh$ ls
id_rsa id_rsa.pub known_hosts
hsl@ubuntu:~/.ssh$ cat id_rsa.pub
#宿主机的公钥
hsl@ubuntu:~/.ssh$ sudo docker exec -it f2 /bin/bash
root@f2e54200c5c7:/# ssh-keygen -t rsa
#这一步只是为了方便产生docker的.ssh目录
root@f2e54200c5c7:/# cd
root@f2e54200c5c7:~# cd .ssh
root@f2e54200c5c7:~/.ssh# ls
id_rsa id_rsa.pub
root@f2e54200c5c7:~/.ssh# touch authorized_keys
root@f2e54200c5c7:~/.ssh# ls
authorized_keys id_rsa id_rsa.pub
root@f2e54200c5c7:~/.ssh# vim authorized_keys
#把宿主机的id_rsa.pub内容复制到docker的/root/.ssh/authorized_keys
********可以替换上面的通过scp方法把公钥传送到docker*********
root@f2e54200c5c7:/# service ssh start
* Starting OpenBSD Secure Shell server sshd [ OK ]
root@f2e54200c5c7:/# exit
exit
hsl@ubuntu:~/.ssh$ ssh root@172.17.0.2
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-36-generic x86_64)
* Documentation:  https://help.ubuntu.com/
Last login: Sun Sep 4 08:18:21 2016 from 172.17.0.1
root@f2e54200c5c7:~# exit
logout
Connection to 172.17.0.2 closed.


补充阅读资料
sshd_config配置
http://blog.csdn.net/zhu_xun/article/details/18304441
http://blog.licess.com/sshd_config/
http://19001989.blog.51cto.com/3447586/645882

外部访问容器
http://www.kancloud.cn/thinkphp/docker_practice/30928

SSH
http://www.ruanyifeng.com/blog/2011/12/ssh_remote_login.html
http://www.ruanyifeng.com/blog/2011/08/what_is_a_digital_signature.html
http://blog.csdn.net/21aspnet/article/details/7249401