root@ubuntu24:~/.ssh# ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/root/.ssh/id_ed25519):    ##保存秘钥的位置
/root/.ssh/id_ed25519 already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase):   ##为秘钥设置密码，即使被人有你的秘钥没有你的密码也是无法登录aniuger
Enter same passphrase again:    ##确认密码
Your identification has been saved in /root/.ssh/id_ed25519
Your public key has been saved in /root/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:8XZObMP0G.... root@ubuntu24
The key's randomart image is:
+--[ED25519 256]--+

设置密码短语 Passphrase : 强烈建议设置。给私钥文件上额外保险。即使电脑被黑，私钥文件被偷了，黑客没有这个密码短语也无法使用它。每次连接需要多输入一次，后面会用 ssh-agent 来解决。

查看：cat ~/.ssh/id_rsa.pub | cat ~/.ssh/id_ed25519.pub

将公钥部署到服务器

把公钥复制到需要的主机上：

su root
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@192.168.0.130
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@192.168.0.131
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@192.168.0.132

将公钥内容追加到 ~/.ssh/authorized_keys 文件中：cat id_ed25519.pub >> authorized_keys，注意 >> 是追加，不要写成 >。

root@ubuntu24:~/.ssh# cat authorized_keys
ssh-ed25519 AAAAC3N......xuh administrator@axxx
ssh-ed25519 AAAAC3N......KR4 root@ubuntu24

禁用密码登录

nano /etc/ssh/sshd_config，最好也禁止 root 用户直接通过 SSH 登录

# 开启root登录
PermitRootLogin yes
# 公钥认证
PubkeyAuthentication yes
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile      .ssh/authorized_keys .ssh/authorized_keys2
# 禁用密码认证
PasswordAuthentication no

ssh-agent

启动 agent：

eval "$(ssh-agent -s)"

将你的私钥添加到 agent（只需要在每次开机后做一次）

ssh-add ~/.ssh/id_ed25519

管理多台服务器，每次都输入 ssh user@ip 也很低效。可以在电脑的 ~/.ssh/ 目录下创建一个 config 文件来管理所有连接。

touch ~/.ssh/config
nano ~/.ssh/config

Host master
HostName 192.168.0.130
User root
IdentityFile ~/.ssh/id_ed25519

Host node1
HostName 192.168.0.131
User root
IdentityFile ~/.ssh/id_ed25519

Host node2
HostName 192.168.0.132
User root
IdentityFile ~/.ssh/id_ed25519