vi /etc/ssh/sshd_config # G' s0 X! a6 f7 V
% y# ]2 a: C8 ~% {6 \1.靽格寥閮 port (舐典銵憭 port)
& P- T; d8 c; CPort <port>
( Y1 n8 [, Z: N: E0 W& K. ^7 g$ ~% a# a+ _6 u3 @7 V
2.賜孵 ip (拍冽澆蝬脣/憭 IP 敶)
& c3 m+ X& g/ V( zListenAddress 192.168.1.106 d" t8 s* B2 F$ @
7 V; _" G g2 c1 E n+ c' d3.蝳甇 root 餃
; V ?+ v! R, K; u6 V! F+ ?PermitRootLogin no/ a3 ]% X+ a$ q/ L
蝞∠敹隞亙鈭箏董餃伐 su root嚗拍 sudo 撌乩4 n7 _1 \5 ~2 w0 P: Z# \
' p1 ^1 |5 y% v" o2 f" m
4.蝳甇V蝙函征撖蝣潛餃
8 Q5 J# L1 d2 |9 C6 H1 |+ Y- p- u, VPermitEmptyPasswords no
, Z* B B( _! {6 N4 r
: G8 K& h7 b) O* b5.閮望蝯孵撣唾蝢斤餃
/ n) R5 u: i5 E% zAllowUsers <user1> <user2> <user3>( I2 f: @6 ]9 o( R
AllowGroups <group>
, u9 M; e: y* h+ ADenyUsers *
9 G; N) D6 _! p% ?8 q: S; }DenyGroups no-ssh- P% N; \9 I l. \/ L
寞撖阡嚗撠澆銝撣唾閮嚗憒 Allow 頝 Deny 閰梧蝯 Deny " E0 B! Z8 |7 }8 T3 @5 c6 P
0 }- c2 y0 j$ I- X5 l7 I& p
6.撱a文蝣潛駁嚗撘瑁翰雿輻 RSA/DSA 撽霅
' n; {; e. Y% M3 s, b+ o2 @+ j. IRSAAuthentication yes
7 h. F3 P; M1 I7 s& [, P: vPubkeyAuthentication yes
, l, E. H7 F4 QAuthorizedKeysFile %h/.ssh/authorized_keys, ^0 e1 b* t: K7 M
PasswordAuthentication no7 Q! i3 h/ K. s0 n( M% K9 E
銝衣Ⅱ靽 user ~/.ssh 甈 700嚗撠閰 user public key 亙 ~/.ssh/authorized_keys 銝准Public key Y孵舀撠 ssh-keygen( J" R8 I% ^, b+ }! d' x6 e
$ n8 ?% G+ p7 J9 h- K, Z. M5 m7.閮 SSHv2
+ a- [+ a3 c7 PProtocol 2
$ c$ [' y2 e6 \1 e' T
! z6 e* ^) K. W7 \8.嗥孵雿輻刻蝢斤銝餅雿餃亥綽鋆∩誑 somebody handsomebody 銝臭蝙典蝣潛餃亦箔. U) W: v. d; Q2 f2 _, P
Match User somebody,handsomebody
9 B! ~) b& [, N% D1 \. i$ oPasswordAuthentication no雿輻 TCP wrappers 嗡皞 IP" `" ?9 Y3 w! }1 K0 h
# vim /etc/hosts.deny9 {% g4 ?$ @9 P; M
sshd: ALL
- `9 {- j, w$ h5 l# vim /etc/hosts.allow
+ a& C: e, O8 {- P a1 [sshd: 192.168.1 1.2.3.4 # 閮 192.168.1.* 1.2.3.4 蝺
9 \% `+ v; |' j4 r4 i$ ~) U1 D( g N: y% P2 g o
9.雿輻 iptables 嗡皞 IP* s; Y: c# K( r# J( |3 L7 P- p
# iptables -A INPUT -p tcp -m state --state NEW --source 1.2.3.4 --dport 22 -j ACCEPT
" w, o' p% w7 @6 F u# iptables -A INPUT -p tcp --dport 22 -j DROP
5 }! W! t* s2 t! T. l5 }- B閮剖蝡喟嚗亙璈敺賭摮嚗閬脣 iptables 閮剖
2 N" i- V$ q9 U; m" q: E# m
$ ]7 l/ ]0 d! r! k& L4 t9 q4 d10.摰
! C, S) u" x3 m" N4 B0 n雿臭誑雿輻其iptables訾嗅訕SH伐霈嗅其孵蝭批臭誑伐嗡銝賡乓雿臭誑其Y隞颱靘摮銝凋蝙 /second/minute/hour /day
: S5 k2 C2 P0 G( i, I7 P, I蝚砌靘摮嚗憒銝冽嗉撓乩航炊撖蝣潘摰銝找閮勗刻赤SSH嚗璅瘥冽嗅其批芾賢閰虫甈∠駁
" o% H( |' s! L& B" L7 t; T # iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT
8 o6 h; u) [$ m9 k; ` # iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP
3 Z: B( W8 [: X; Y: s蝚砌靘摮嚗閮剔蔭iptables芸閮曹蜓璈193.180.177.13亙訕SH嚗典閰虫甈∪仃駁詨嚗iptables閮梯府銝餅瘥閰虫甈∠駁
7 R. N' Z- F0 q3 c- m2 ` # iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT
+ q3 y% L! m: b4 M( W5 b # iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP
6 U9 g4 z: R" g5 d
9 ]& {( K2 b$ L2 p11.瑼X亦賊瑼獢甈嚗銝摰典銝閮梁餃# Q. V! I+ ^! y- Z% h2 M( V" F
StrictModes yes1 f- Q; [* ~* }4 N0 ~
鈭賊瑼獢甈閮剖交航炊嚗航賡摰冽折◢芥憒雿輻刻 ~/.ssh/authorized_keys 甈亦 666嚗航賡嗡鈭箏臭誑典董2 c! [$ f7 C3 i
! Z0 k" R8 Q9 c( u1 o12.芾雿輻刻餃交憿舐內 banner (閰梯牧頝摰冽扳隞暻潮靽...? 憭扳臭誑函冗鈭斗孵頝憯鈭箏...= =a)6 z7 \3 k9 x- [, I; \
Banner /etc/ssh/banner # 隞餅摮瑼+ f3 ]1 i% q9 j/ [) Y
0 ]' Q: ?7 G$ n0 u- b
13. su/sudo ; W8 |; R, o* _* ~ ?8 q
# vi /etc/pam.d/su0 P8 t: Z( F5 a- R
auth required /lib/security/$ISA/pam_wheel.so use_uid0 M# b& t( V* G9 t
# visudo
7 Q2 e4 Y! `5 I" I4 J7 E %wheel ALL = (ALL) ALL7 Q8 D- @, S& i. _, J3 g; ^# @+ w
# gpasswd -a user1 wheel
& H9 ]! A4 [0 _. A( ~! G7 Z r4 \8 j" H5 u! z
14. ssh 雿輻刻
, H* F) y/ V' ^! d# vi /etc/pam.d/sshd0 f+ t R* x/ @+ c8 W: _' {
auth required pam_listfile.so item=user sense=allow file=/etc/ssh_users onerr=fail
, J: b, X# Z7 ^$ w8 i+ s# echo <username> >> /etc/ssh_users
$ Y% ^8 X0 e, G15.脫迫SSH蝺暹(timeout),霈PuTTY SSH 銝港蝺5 ?8 U2 G' N; E# `: Z2 J7 Q; c
靽格/etc/ssh/sshd_config- E |9 p2 I8 L! p0 N
#TCPKeepAlive yes- h0 M% w* u/ y
#ClientAliveInterval 0
8 n& l3 q. ?$ A' a) G#ClientAliveCountMax 3
" y* l7 G0 \- ?8 ?. ? 撠#踵==>摮瑼
& e9 c: X' a4 I* A#service ssd restart ==>sshd
/ w% ^ O6 C6 @# U/ X; M 乩靘靽格 Pietty 賂脣PuTTY 蝺閮剖:. W% A3 Q" b7 O8 h
豢Connection殷撠Seconds between keepalives [0 to turn off]喲甈雿頛詨交撟曄嚗喲銝null撠隞乩蝺* o. {: _$ M8 Y7 V. @; P, {+ }
. x8 a0 ~& K7 n5 w { |
|