52AV璈A|52AV.ONE

 曉撖蝣
 蝡唾酉
敹急瑕
  • av隢憯BBS
  • 璈A
  • 芣瑟憭瘚
  • 鞎澆
  • 52av鋆貉摰
  • 典啣
  • 銝剜-銝剖銝餅
Yahoo!憟拇撠
望: 璈A
Google憟拇撠
望: 璈A
     
亦: 3240|敺: 0
銝銝銝駁 銝銝銝駁

[ssh] 靽格 sshd 閮剖 ,閮剖瑼 /etc/ssh/sshd_config

[銴鋆賡包
頝唾唳摰璅撅
璅銝
潸” 2015-12-28 10:28:36 | 芰閰脖 撣 |摨閬 |梯璅∪
vi /etc/ssh/sshd_config % g) n: K6 c# i( _8 a
4 d/ s2 ^) a; T9 e' A
1.靽格寥閮 port (舐典銵憭 port)6 B# E, c) Z( j# p" z3 F& \) c
Port <port>, i* t% N# a3 L% C" H: n, H

8 Q+ Q! d8 Z5 z: J2.賜孵 ip (拍冽澆蝬脣/憭 IP 敶)
! H2 _  T# K% O3 z# IListenAddress 192.168.1.10( I" C0 [- b2 C# X# @: l7 U

7 m* J. b2 H: y( N3.蝳甇 root 餃' C9 M; u: [+ t6 [
PermitRootLogin no3 R, f6 l: D# O+ j% ~9 D# U: M
蝞∠敹隞亙鈭箏董餃伐 su root嚗拍 sudo 撌乩
+ p  Z1 H) @+ Y: l2 q+ J0 A$ b+ B4 I. C$ U- M6 T6 s
4.蝳甇V蝙函征撖蝣潛餃
& [0 F* a8 p% K+ mPermitEmptyPasswords no7 L" \: C$ j7 c1 [: V' V$ ^% L

" h4 D& \2 ^. \; z4 _, f5.閮望蝯孵撣唾蝢斤餃
3 Z) X% S9 x! i) w" u& S  o$ _AllowUsers <user1> <user2> <user3>0 V; _0 w" e! r$ i
AllowGroups <group>/ F! l; W5 {1 \% ?+ O+ ?0 B
DenyUsers */ g8 h9 Z! {0 w' i7 x3 H0 W  Z" l$ l
DenyGroups no-ssh# L5 e! \; |& N( J; C
寞撖阡嚗撠澆銝撣唾閮嚗憒 Allow 頝 Deny 閰梧蝯 Deny   b6 |* r! O9 z* Y. A( A  Y

7 T3 t' f$ V1 ~) ^  w6.撱a文蝣潛駁嚗撘瑁翰雿輻 RSA/DSA 撽霅+ w/ V8 ]! v8 s4 w5 Z$ {
RSAAuthentication yes
/ `2 o, U0 c7 P* {- S$ ~' APubkeyAuthentication yes
1 D" \: [; }. B. R: P0 P4 zAuthorizedKeysFile %h/.ssh/authorized_keys/ H3 \$ ~3 R) v/ g1 d( j
PasswordAuthentication no
/ L. P7 p( c4 x: I銝衣Ⅱ靽 user ~/.ssh 甈 700嚗撠閰 user public key 亙 ~/.ssh/authorized_keys 銝准Public key Y孵舀撠 ssh-keygen- h1 A: \7 j& N- r) z1 Q( r$ f* C

8 X( ?5 p' ~8 W4 X) P7.閮 SSHv2# N$ o) G, C/ z4 S
Protocol 2
& w4 G3 a& ?1 D, z  z
0 g. w1 D+ [$ N5 E! M1 V8.嗥孵雿輻刻蝢斤銝餅雿餃亥綽鋆∩誑 somebody handsomebody 銝臭蝙典蝣潛餃亦箔
+ b* n6 @/ r( f8 [: Z8 OMatch User somebody,handsomebody
* N$ ]' L0 Q* UPasswordAuthentication no雿輻 TCP wrappers 嗡皞 IP
0 p0 l; p) D* p8 Z* c8 o# vim /etc/hosts.deny) Q1 V/ S3 v  N2 v; i$ E9 F
sshd: ALL
9 j" w9 c! `3 X+ O, A9 m# vim /etc/hosts.allow
5 A1 q0 u# _/ z. \1 Z# Osshd: 192.168.1 1.2.3.4 # 閮 192.168.1.* 1.2.3.4 蝺3 x4 S  ]; U, A4 Y9 o( Z9 H7 Y
. |/ k$ c* N3 ?8 H& q% x0 s+ E7 n) `
9.雿輻 iptables 嗡皞 IP
) \1 q( H6 H+ o' I# iptables -A INPUT -p tcp -m state --state NEW --source 1.2.3.4 --dport 22 -j ACCEPT
% z; ]$ K$ \- S& F8 Z# iptables -A INPUT -p tcp --dport 22 -j DROP# t; `( Q1 p) p4 q/ r
閮剖蝡喟嚗亙璈敺賭摮嚗閬脣 iptables 閮剖
5 `5 T7 x9 {' p. W* ~
# z9 F1 H0 v. y& y) c: u5 w10.摰* B* D. O/ G4 u( e" D
雿臭誑雿輻其iptables訾嗅訕SH伐霈嗅其孵蝭批臭誑伐嗡銝賡乓雿臭誑其Y隞颱靘摮銝凋蝙 /second/minute/hour /day
! I$ S: [' L4 \5 F9 k! B* {( Y蝚砌靘摮嚗憒銝冽嗉撓乩航炊撖蝣潘摰銝找閮勗刻赤SSH嚗璅瘥冽嗅其批芾賢閰虫甈∠駁
* }) h2 Y6 m( Y& D  # iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT
' f& Q. S$ ^1 X  K7 T  # iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP5 I- \) b; u  n' |; c
蝚砌靘摮嚗閮剔蔭iptables芸閮曹蜓璈193.180.177.13亙訕SH嚗典閰虫甈∪仃駁詨嚗iptables閮梯府銝餅瘥閰虫甈∠駁1 p9 t4 T% r5 D' t5 }& b8 J+ t
  # iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT% z# ?7 v3 u& j3 s! u
  # iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP
% w" _6 H+ c' `4 q% h! d& |7 d, B# p- i  [+ T0 D7 ]) D, `
11.瑼X亦賊瑼獢甈嚗銝摰典銝閮梁餃) x, J; J) V1 h, g4 u7 E& o# n
StrictModes yes
/ @; d8 n/ b# Q+ @5 K4 ?  c  u+ t鈭賊瑼獢甈閮剖交航炊嚗航賡摰冽折◢芥憒雿輻刻 ~/.ssh/authorized_keys 甈亦 666嚗航賡嗡鈭箏臭誑典董
1 M7 J  r9 [8 f6 H% j
% y8 U" Q$ P" Y, Z' E12.芾雿輻刻餃交憿舐內 banner (閰梯牧頝摰冽扳隞暻潮靽...? 憭扳臭誑函冗鈭斗孵頝憯鈭箏...= =a)# m  ]5 {0 F) K% A7 h* u
Banner /etc/ssh/banner # 隞餅摮瑼
- Z( L' L  P5 s
) Y2 _# `9 C3 H2 D% ~. F13. su/sudo
7 i. H/ ]" i1 B' i' R5 Y# vi /etc/pam.d/su0 \9 D9 M' ]5 D1 H5 K5 h3 d
    auth       required     /lib/security/$ISA/pam_wheel.so use_uid" r/ g; r7 z( d- N- s: L
# visudo
$ k% z8 k9 T% P+ I; J; U/ v    %wheel  ALL = (ALL) ALL
& U# p6 C8 j; Y! n1 r; ?# gpasswd -a user1 wheel: `. ~( |" l/ w/ K$ `
( n4 ?( T& s# u0 ^
14. ssh 雿輻刻
. z/ z( B8 o5 n4 R3 ?9 G* X3 ]# vi /etc/pam.d/sshd
9 W7 G4 f" B5 @0 v! I7 J9 a+ Q7 @    auth required pam_listfile.so item=user sense=allow file=/etc/ssh_users onerr=fail& A  i8 w% p4 w% L; P" w
# echo <username> >> /etc/ssh_users/ W" T$ p6 q0 X7 b2 Z/ ?
15.脫迫SSH蝺暹(timeout),霈PuTTY SSH 銝港蝺! `# R/ u: b9 K( Y8 s
    靽格/etc/ssh/sshd_config; e4 i8 q6 s# c2 @. l( E
#TCPKeepAlive yes# C1 Z" s; P, N% Q. j4 F5 G
#ClientAliveInterval 03 u8 M- h0 O- G8 h/ P+ I
#ClientAliveCountMax 3

3 g2 p/ L' B+ n" h! d1 b" F+ k
     撠#踵==>摮瑼8 ?3 t8 I$ u& ^0 V2 f
#service ssd restart ==>sshd
# y2 t7 v8 ?, w5 e2 \6 a    乩靘靽格 Pietty 賂脣PuTTY 蝺閮剖:) `0 n9 t/ A* g
    豢Connection殷撠Seconds between keepalives [0 to turn off]喲甈雿頛詨交撟曄嚗喲銝null撠隞乩蝺
4 d" R2 q- N' f# W
( A" y  {, f$ o' D( Y6 {. X) Q* c

雿輻券

祉蝛閬

BT蝳

砍憛批捆靘餉衣雯頝臬批捆蝝颲行粹嗥蝬脩嚗摰撟湔遛嚗嚗甇脖誑銝嗅啣摰嗆摰撟湧翩鈭箏ㄚ孵舫脣伐銝憿亙祉璇甈橘芣遛18甇 雓蝯脣亦閬賬粹脩芣遛18甇脖芣撟渡雯閬賜雯頝臭嗥批捆鞈閮嚗撱箄降典舫脰蝬脰楝批捆蝝蝯蝜ICRA蝝摰鋆閮剖 (粹蝯行霅 祉蝬脣銝蝝瘛函隢憯啣嚗祉閮剜蝞∠)

QQ|撠暺撅||52AV璈A

GMT+8, 2024-11-6 09:30 , Processed in 0.057381 second(s), 19 queries .

蝯∠.撱

52avtv@gmail.com | QQ:2405733034     since 2015-01

鋆貉憒 敹恍敺 餈銵