SSH的一些安全小技巧

《SSH的一些安全小技巧》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、SSH的一些安全小技巧前言关于ssh的好处,相信不用我多说了吧?簡而言之,之前的rpccommand于telnet都全可用ssh代替.比方如下的這些常見功能:-远程登录 sshuser@remote.machine-远程执行 sshuser@remote.machine'command...'-远程复制 scpuser@remote.machine:/remote/path/local/path scp/local/pathuser@remote.machine:/remote/path-Xforward ssh-Xu

2、ser@remote.machine xcommand...-Tunnel/Portforward ssh-L1234:remote.machine:4321user@remote.machine ssh-R1234:local.machine:4321user@remote.machine ssh-L1234:other.machine:4321user@remote.machine至於详细的用法,我這就不說了.请读者自行研究吧.我这里要说的,是针对ssh服务为大家介绍一些安全技巧,希望大家用得更安心些实例(以Red

3、Hat9为例)轉往client端:$ssh-keygen-trsa+按三下enter完成﹔不需設密碼，除非您會用ssh-agent.$scp~/.ssh/id_rsa.pubuser1@server.machine:id_rsa.pub+若是windowsclient,可用puttygen.exe產生publickey, 然後複制到server端後修改之,使其內容成為單一一行.+如果server端已經禁止密碼登入,那請用其它放法復製publickkey.登入server端:§1)禁止root登錄§#vi/etc/ssh

4、/sshd_configPermitRootLoginno§§2)廢除密碼登錄,強迫使用RSA驗證(假設ssh帳戶為user1)§#vi/etc/ssh/sshd_configRSAAuthenticationyesPubkeyAuthenticationyesAuthorizedKeysFile.ssh/authorized_keysPasswordAuthenticationno#servicesshdrestart#su-user1$mkdir~/.ssh2>/dev/null$chmod700~/.ssh$to

5、uch~/.ssh/authorized_keys$chmod644~/.ssh/authorized_keys$cat~/id_rsa.pub>>~/.ssh/authorized_keys$rm~/id_rsa.pub$exit§§3)限制su/sudo名單:§#vi/etc/pam.d/suauthrequired/lib/security/$ISA/pam_wheel.souse_uid#visudo%wheelALL=(ALL)ALL#gpasswd-auser1wheel§§4)限制ssh使用者名單§#vi

6、/etc/pam.d/sshdauthrequiredpam_listfile.soitem=usersense=allowfile=/etc/ssh_usersonerr=fail#echouser1>>/etc/ssh_users§§5)封鎖ssh連線並改用web控管清單§#iptables-IINPUT-ptcp--dport22-jDROP#mkdir/var/www/html/ssh_open#cat>/var/www/html/ssh_open/.htaccess<

7、"AuthUserFile/var/www/html/ssh_open/.htpasswdAuthTypebasicrequirevalid-userEND#htpasswd-c/var/www/html/ssh_open/.htpasswduser1§(最好還將SSL設起來,或只限https連線更佳,我這裡略過SSL設定,請讀者自補.)(如需控制連線來源,那請再補Allow/Deny項目,也請讀者自補.)#cat>/var/www/html/ssh_open/ssh_open.php<

8、thforiplist$dir_path="."; //Setfilenameforiplist$ip_list="ssh_open.txt"; //Getclientip$user_ip=$_SERVER['REMOTE_ADDR']; //allowspecifyingipifneeded if(@$_GET['myip']