vi /etc/ssh/sshd_config
3 }: u2 m- G$ D0 S
% q5 {5 `5 y) N% B5 x8 P1.靽格寥閮 port (舐典銵憭 port)
7 M4 b: ^& v. J7 u" ^! U- bPort <port>+ e+ H7 Y/ n! d% I7 F+ M6 b
7 [+ C2 y6 ?1 E" q6 w
2.賜孵 ip (拍冽澆蝬脣/憭 IP 敶) k S* J0 M' B! d+ f0 Z
ListenAddress 192.168.1.10
4 U' j% |8 i" d1 w c
7 X9 S/ V n; J- w t3.蝳甇 root 餃
! a* S5 {6 U# zPermitRootLogin no4 Z$ v1 o: D6 K- z- b
蝞∠敹隞亙鈭箏董餃伐 su root嚗拍 sudo 撌乩. G9 e7 w5 K) h* Q
& r' _( J" I2 s0 j; g
4.蝳甇V蝙函征撖蝣潛餃
1 n) o; \4 g6 N0 P+ |PermitEmptyPasswords no
9 q1 K% Q. L4 a* n3 o
& M4 T- A7 f; J- s3 t, B5.閮望蝯孵撣唾蝢斤餃9 T G% _+ M5 L( F" M6 w' [% [
AllowUsers <user1> <user2> <user3>
% { ?1 r m+ @% A$ tAllowGroups <group>
! L6 Q, L* {/ T7 o7 ]3 lDenyUsers *; }! F+ O9 T$ b+ K/ Q* Z
DenyGroups no-ssh5 f) _" a2 M O) ? l
寞撖阡嚗撠澆銝撣唾閮嚗憒 Allow 頝 Deny 閰梧蝯 Deny
: `) Y/ V9 _; A
* t0 Y( l/ \/ ?1 I* X8 i) T6 h8 X4 x6.撱a文蝣潛駁嚗撘瑁翰雿輻 RSA/DSA 撽霅
0 [" v9 m0 Z# C9 I5 t# p8 pRSAAuthentication yes) s3 }& A' `1 _/ v& V
PubkeyAuthentication yes( `) o v3 J/ ?% |* M7 `7 q5 c
AuthorizedKeysFile %h/.ssh/authorized_keys
$ O$ k; b+ H& U# j, MPasswordAuthentication no
: w& L& X! `7 I* n銝衣Ⅱ靽 user ~/.ssh 甈 700嚗撠閰 user public key 亙 ~/.ssh/authorized_keys 銝准Public key Y孵舀撠 ssh-keygen
$ ~9 s, X" i! s5 Z- J7 F2 J
w! y: l5 Z0 b0 J/ X7.閮 SSHv2
& A6 f8 C: i: z- y4 c& ]Protocol 2+ x I( {3 G* g$ T+ W9 j/ |8 u0 A5 T
- ]4 c% W+ t- F# a; u8 p8.嗥孵雿輻刻蝢斤銝餅雿餃亥綽鋆∩誑 somebody handsomebody 銝臭蝙典蝣潛餃亦箔
# Z- @, Y6 N K0 I2 d7 oMatch User somebody,handsomebody( D# ^+ [* r' Y9 O: Z) w
PasswordAuthentication no雿輻 TCP wrappers 嗡皞 IP
9 }- O" r' e+ ]3 x: q# o3 Y# vim /etc/hosts.deny
# \8 L) L" V& [3 Qsshd: ALL
- _% w. @+ ]7 h7 a# vim /etc/hosts.allow
& k4 f3 {5 ^0 u6 usshd: 192.168.1 1.2.3.4 # 閮 192.168.1.* 1.2.3.4 蝺' P! e2 Q! }% D" L% t4 J* N
0 A/ x" L' w8 R2 b! F: l; E0 `
9.雿輻 iptables 嗡皞 IP) [' F7 _- d5 T% M5 B5 q
# iptables -A INPUT -p tcp -m state --state NEW --source 1.2.3.4 --dport 22 -j ACCEPT
" F0 H+ x+ e8 }! Q# iptables -A INPUT -p tcp --dport 22 -j DROP& v/ a5 U+ r/ O: Q$ X
閮剖蝡喟嚗亙璈敺賭摮嚗閬脣 iptables 閮剖; E6 X* I7 P. g7 t8 W
5 p7 O# K" X4 B# C D1 X10.摰
$ y6 V" ~+ I* g% u- L雿臭誑雿輻其iptables訾嗅訕SH伐霈嗅其孵蝭批臭誑伐嗡銝賡乓雿臭誑其Y隞颱靘摮銝凋蝙 /second/minute/hour /day
6 C2 D* o% w$ K7 g) d9 p蝚砌靘摮嚗憒銝冽嗉撓乩航炊撖蝣潘摰銝找閮勗刻赤SSH嚗璅瘥冽嗅其批芾賢閰虫甈∠駁( n6 ]; v6 s0 \$ r6 k) O9 P
# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT1 N& V# i$ ]8 Q" F. }
# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP
B5 h# `& e( \: c, B蝚砌靘摮嚗閮剔蔭iptables芸閮曹蜓璈193.180.177.13亙訕SH嚗典閰虫甈∪仃駁詨嚗iptables閮梯府銝餅瘥閰虫甈∠駁) g/ D6 R. |- g" r% T
# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT1 T* p7 ?4 c( w- E! X
# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP7 t' O' v0 v! C# X7 z3 ]
& E% Q9 [$ w- r, Y11.瑼X亦賊瑼獢甈嚗銝摰典銝閮梁餃
& I! o2 ?# M! v! Z o5 V. q/ o# wStrictModes yes: O) E) X, G2 y+ Y+ O2 w
鈭賊瑼獢甈閮剖交航炊嚗航賡摰冽折◢芥憒雿輻刻 ~/.ssh/authorized_keys 甈亦 666嚗航賡嗡鈭箏臭誑典董* |6 g3 Y/ l6 D. O& C. f5 c `
: L* c+ Y: ^/ T1 Y/ D12.芾雿輻刻餃交憿舐內 banner (閰梯牧頝摰冽扳隞暻潮靽...? 憭扳臭誑函冗鈭斗孵頝憯鈭箏...= =a)
0 G% f, z/ _1 wBanner /etc/ssh/banner # 隞餅摮瑼
! I5 i! N/ V0 o& a) h; c4 q( S# @5 ?0 [1 e- W' ~. S
13. su/sudo 9 a- o1 Y C$ r. J
# vi /etc/pam.d/su0 b/ B/ N! o5 y4 x
auth required /lib/security/$ISA/pam_wheel.so use_uid
; L* t- T6 H9 m0 J# visudo9 r, L' L/ T+ i' m% V
%wheel ALL = (ALL) ALL
) L! v* z% E9 p& u# q' ?# gpasswd -a user1 wheel
! k; \% V: \9 o# O# M, O
1 }9 o0 ~5 y9 f0 e14. ssh 雿輻刻
. [" K0 p' o N# vi /etc/pam.d/sshd
3 r3 r2 p/ f; Y9 _6 ` auth required pam_listfile.so item=user sense=allow file=/etc/ssh_users onerr=fail' `; P: p$ _: q6 Y3 o T+ k
# echo <username> >> /etc/ssh_users
' o4 o/ L. c$ r) H0 ~) S3 {15.脫迫SSH蝺暹(timeout),霈PuTTY SSH 銝港蝺# a+ @- j2 c# t+ U
靽格/etc/ssh/sshd_config
" H# M: F. W! @6 q+ H; K+ z#TCPKeepAlive yes3 w( N: L0 W+ M; c2 [
#ClientAliveInterval 0
' r9 `3 Q7 G6 l+ z#ClientAliveCountMax 3; E- k. B& `; i7 @! O
撠#踵==>摮瑼" D) I0 Y/ f1 S5 i
#service ssd restart ==>sshd7 n1 d! w/ ?8 m+ ^% P, g) z
乩靘靽格 Pietty 賂脣PuTTY 蝺閮剖:# |( q4 ~3 J& _
豢Connection殷撠Seconds between keepalives [0 to turn off]喲甈雿頛詨交撟曄嚗喲銝null撠隞乩蝺
3 ~& D6 h+ H l* k! z1 x! ?
$ H# B) W0 P" e; u ?% d |
|