vi /etc/ssh/sshd_config " ^) S/ L- V7 k
# Z0 i) d% C4 H% {9 G; X1.靽格寥閮 port (舐典銵憭 port)
+ S# |2 o$ M" _6 ^( N5 ]Port <port>1 }4 n1 v6 p2 W
6 G8 s6 u9 Z- ~) y) w4 I; j2.賜孵 ip (拍冽澆蝬脣/憭 IP 敶)) |2 i% E: f/ w0 }, _0 d( ? @: N
ListenAddress 192.168.1.103 \8 x/ t' E3 l1 ^. C. m
: ~. Q1 L! x$ r# [) @, Z2 A
3.蝳甇 root 餃; i& f/ W7 J9 f. @% v
PermitRootLogin no' N# X. R: l% I; i: \ G1 ^) m
蝞∠敹隞亙鈭箏董餃伐 su root嚗拍 sudo 撌乩
5 j- P4 i D% b$ n5 G( [" a
7 n3 y( q- W4 A8 _2 B$ g4.蝳甇V蝙函征撖蝣潛餃
. f, g! i0 r& \7 V: H) [PermitEmptyPasswords no
5 Y5 T8 n, {) X* X: h# n/ }& p7 B& ^& R
5.閮望蝯孵撣唾蝢斤餃
+ r0 S6 G7 K* p+ n) b# CAllowUsers <user1> <user2> <user3>4 t x/ _1 L2 T& m$ L( T O. O
AllowGroups <group>
. A. @& U. b1 {7 `. f( {) x0 EDenyUsers *' D. S' H* d* C6 _9 G
DenyGroups no-ssh% ]" h3 O5 G1 c; n! R2 q
寞撖阡嚗撠澆銝撣唾閮嚗憒 Allow 頝 Deny 閰梧蝯 Deny $ ?- f, o8 S Q+ M6 U
6 e) B! k; t3 R+ M: }6 O6.撱a文蝣潛駁嚗撘瑁翰雿輻 RSA/DSA 撽霅" W/ T, \& h7 B+ O0 l) X- e: h! O
RSAAuthentication yes
7 H e+ i) [4 K1 p2 vPubkeyAuthentication yes
9 W1 x5 X8 X" u) [AuthorizedKeysFile %h/.ssh/authorized_keys8 d& s& S, z$ H/ W/ t
PasswordAuthentication no- {4 W( K* X# @/ x8 R- E
銝衣Ⅱ靽 user ~/.ssh 甈 700嚗撠閰 user public key 亙 ~/.ssh/authorized_keys 銝准Public key Y孵舀撠 ssh-keygen
+ A z' N! E2 \, z2 j: j. L9 C ~5 p- j' k D1 t
7.閮 SSHv2
/ Y" L0 r7 o0 D2 YProtocol 28 o4 P* s# ~' ]5 A) N
3 c0 Q! [% P: Q" e2 k! `% p5 z8.嗥孵雿輻刻蝢斤銝餅雿餃亥綽鋆∩誑 somebody handsomebody 銝臭蝙典蝣潛餃亦箔
+ o8 W" P- W. aMatch User somebody,handsomebody
2 z- C- m7 |! s( N: {PasswordAuthentication no雿輻 TCP wrappers 嗡皞 IP7 p/ j" X, T. @
# vim /etc/hosts.deny
& \( E1 d" o1 F/ O. @. ysshd: ALL! t/ A% `: Z6 ?5 w. q: B4 n: Z3 Y
# vim /etc/hosts.allow
% y! N7 T$ Z4 ysshd: 192.168.1 1.2.3.4 # 閮 192.168.1.* 1.2.3.4 蝺
) s1 |! l" }1 D0 t5 I# o, u) u7 S+ F! z6 J, E
9.雿輻 iptables 嗡皞 IP
# R" r1 o4 u$ i* q9 A* h! J# iptables -A INPUT -p tcp -m state --state NEW --source 1.2.3.4 --dport 22 -j ACCEPT1 v* V) X4 {2 L
# iptables -A INPUT -p tcp --dport 22 -j DROP
) t/ ~7 F# B0 X閮剖蝡喟嚗亙璈敺賭摮嚗閬脣 iptables 閮剖4 \1 {0 Y& H" ^9 Q$ _$ {7 {
/ g S: p( a( M) `* \1 i; Q10.摰9 y; Q- r& ~; V4 X5 t4 i
雿臭誑雿輻其iptables訾嗅訕SH伐霈嗅其孵蝭批臭誑伐嗡銝賡乓雿臭誑其Y隞颱靘摮銝凋蝙 /second/minute/hour /day
1 N0 {+ L) V5 D& _+ U9 y蝚砌靘摮嚗憒銝冽嗉撓乩航炊撖蝣潘摰銝找閮勗刻赤SSH嚗璅瘥冽嗅其批芾賢閰虫甈∠駁
2 E1 [2 `8 O/ b8 Z% G # iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT8 R! ]; ~) R0 j/ g8 h1 ?0 ~+ f
# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP- M; Y2 M7 k0 i$ X% {; o
蝚砌靘摮嚗閮剔蔭iptables芸閮曹蜓璈193.180.177.13亙訕SH嚗典閰虫甈∪仃駁詨嚗iptables閮梯府銝餅瘥閰虫甈∠駁" X( x5 |! N% x7 ]5 E! j# J$ f
# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT3 }3 b3 w( s+ w: f8 [+ A: G
# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP, I: c& h6 C" B9 w2 j8 q% k
0 O& z J, ^: \, k
11.瑼X亦賊瑼獢甈嚗銝摰典銝閮梁餃9 j+ f5 s4 W: _4 `) r; K `
StrictModes yes" Z7 { {2 C' I+ q% j+ e
鈭賊瑼獢甈閮剖交航炊嚗航賡摰冽折◢芥憒雿輻刻 ~/.ssh/authorized_keys 甈亦 666嚗航賡嗡鈭箏臭誑典董
, @. X: W5 R+ M5 ~) |+ { ~8 ?( E- O. Z5 }( H8 o, E, _5 p9 ]
12.芾雿輻刻餃交憿舐內 banner (閰梯牧頝摰冽扳隞暻潮靽...? 憭扳臭誑函冗鈭斗孵頝憯鈭箏...= =a)% I9 z7 Y3 n% A' d, K/ ~$ X
Banner /etc/ssh/banner # 隞餅摮瑼( A: ^2 }- ~$ t+ j* J, x- f3 t
: d# i+ E) s% B' p7 i
13. su/sudo # M/ I6 _ m1 I- D& h
# vi /etc/pam.d/su
$ L# V/ \) S0 k1 {9 P+ _ auth required /lib/security/$ISA/pam_wheel.so use_uid
3 o0 [0 H- a8 d' S& r# visudo) @+ S i1 S# R$ @
%wheel ALL = (ALL) ALL% L6 f) e: d+ K
# gpasswd -a user1 wheel# z. [7 c- B- s }
4 f9 Y2 f. w( ^" b+ \& Q, \- O
14. ssh 雿輻刻: X4 d# Q% z7 r
# vi /etc/pam.d/sshd
5 w: ?3 q) a& _" } S; s auth required pam_listfile.so item=user sense=allow file=/etc/ssh_users onerr=fail
% L9 L# V! L0 Y1 p# A; @. u- t' s# echo <username> >> /etc/ssh_users! t3 U$ z* s( {! s9 s
15.脫迫SSH蝺暹(timeout),霈PuTTY SSH 銝港蝺
* u r6 p0 V2 m, |! J 靽格/etc/ssh/sshd_config" Y: m. g! e# X- w2 t) L
#TCPKeepAlive yes, N: [& x/ v0 p; B
#ClientAliveInterval 07 M8 Q4 ?8 i7 X x# z/ }/ H
#ClientAliveCountMax 3" v U+ z) ]* B% E/ } {" U
撠#踵==>摮瑼
2 z! \( U0 c6 Q; T) @+ H) R* V$ L) F#service ssd restart ==>sshd/ X1 h. d3 L0 [1 I7 o1 d) [" X
乩靘靽格 Pietty 賂脣PuTTY 蝺閮剖:
' T* t; ]4 o8 n5 }9 @ 豢Connection殷撠Seconds between keepalives [0 to turn off]喲甈雿頛詨交撟曄嚗喲銝null撠隞乩蝺4 r* S" b, {, ]' E' C$ y
x7 g6 w3 ^8 P+ K& r6 y; d1 } |
|