Linux云服务器SSH登录的安全加固

{"value":"Linux\u4e91\u670d\u52a1\u5668\u5e38\u7528\u7684\u767b\u5f55\u65b9\u5f0f\u662fSSH\uff0c\u5bf9\u4e8e\u5bc6\u7801\u767b\u5f55\u65b9\u5f0f\u521b\u5efa\u7684\u4e91\u670d\u52a1\u5668\uff0c\u5982\u4f55\u4fdd\u8bc1\u767b\u5f55\u5b89\u5168\u6027\u5462\uff1f\u672c\u6587\u4ee5CentOS 7.6\u4e3a\u4f8b\uff0c\u5bf9SSH\u767b\u5f55\u8fdb\u884c\u5b89\u5168\u52a0\u56fa\u3002\n\n### 1.\u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3\n\n**1.1 \u901a\u8fc7SSH\u5bc6\u7801\u65b9\u5f0f\u8fdc\u7a0b\u767b\u5f55\u4e91\u670d\u52a1\u5668\u3002**\n\n**1.2 \u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\uff0c\u4fee\u6539SSH\u767b\u5f55\u7684\u9ed8\u8ba4\u7aef\u53e3\uff0c\u6bd4\u5982\u4fee\u6539\u4e3a\u201c5000\u201d\u3002**\n\n```\nvim \/etc\/ssh\/sshd_config\n```\n\n\u6309\u201ci\u201d\u8fdb\u5165\u7f16\u8f91\u6a21\u5f0f\uff0c\u5728\u7b2c17\u884c\uff0c\u5c06\u6ce8\u91ca\u7b26\u201c#\u201d\u5220\u6389\uff0c\u4fee\u6539\u4e3a\u201cPort 5000\u201d\u3002\n\n\u4fee\u6539\u524d\uff1a\n\n\n\n\u4fee\u6539\u540e\uff1a\n\n\n\n\u6309\u201cEsc\u201d\uff0c\u8f93\u5165:wq\u4fdd\u5b58\u5e76\u9000\u51fa\u3002\n\n### 2.\u589e\u52a0\u9632\u706b\u5899\u89c4\u5219\uff1a\u5f00\u653e\u6307\u5b9a\u7aef\u53e3\n\nCentOS 7\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u7684\u9ed8\u8ba4\u9632\u706b\u5899\u662ffireware\uff0c\u800c\u4e0d\u662fiptables\u3002\u56e0\u6b64\uff0c\u5982\u679c\u7cfb\u7edf\u662f\u9ed8\u8ba4\u9632\u706b\u5899\uff0c\u5219\u4e0d\u9700\u8981\u6267\u884c\u672c\u8282\u64cd\u4f5c\uff1b\u5982\u679c\u5b89\u88c5\u8fc7iptables\uff0c\u5219\u8981\u53c2\u8003\u672c\u8282\u6307\u5bfc\u5f00\u653eSSH\u767b\u5f55\u76845000\u7aef\u53e3\u3002\n\n**2.1 \u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\uff0c\u68c0\u67e5\u662f\u5426\u5b89\u88c5\u4e86iptables\u3002service iptables status**\n\n- \u5982\u679c\u63d0\u793a\u5982\u4e0b\u7c7b\u4f3c\u4fe1\u606f\uff0c\u8868\u793a\u672a\u5b89\u88c5iptables\uff0c\u8df3\u8fc7\u672c\u8282\uff0c\u7ee7\u7eed\u6dfb\u52a0\u5b89\u5168\u7ec4\u89c4\u5219\u64cd\u4f5c\u3002\n\n\n\n- \u5982\u679c\u63d0\u793a\u5982\u4e0b\u7c7b\u4f3c\u4fe1\u606f\uff0c\u8868\u793a\u5b89\u88c5\u4e86iptables\uff0c\u5e76\u4e14\u4e3a\u201cactive\u201d\u72b6\u6001\u3002\u7ee7\u7eed\u6267\u884c\u6b65\u9aa4[2]\n\n\n\n**2.2 \u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u589e\u52a0iptables\u89c4\u5219\uff0c\u5f00\u653e5000\u7aef\u53e3\u3002**\n\n```\niptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 5000 -j ACCEPT\n```\n\n**2.3 \u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u67e5\u770biptables\u73b0\u6709\u89c4\u5219\u662f\u5426\u5df2\u5305\u542b5000\u7aef\u53e3\u3002**\n\n```\niptables -L -n\n```\n\n\n\n### 3. \u6dfb\u52a0\u5b89\u5168\u7ec4\u89c4\u5219\n\n**3.1 \u767b\u5f55\u63a7\u5236\u53f0\uff0c\u9009\u62e9\u5b89\u5168\u9632\u62a4\uff0c\u9009\u62e9\u5b89\u5168\u7ec4**\n\n**3.2 \u9009\u62e9\u4e91\u670d\u52a1\u5668\u6240\u5728\u7684\u533a\u57df\uff0c\u70b9\u51fb\u6dfb\u52a0\u5b89\u5168\u7ec4\uff0c\u4e3a\u5b89\u5168\u7ec4\u8bbe\u7f6e\u540d\u79f0\uff0c\u7136\u540e\u70b9\u51fb\u7acb\u5373\u63d0\u4ea4\u3002**\n\n\n\n\n\n**3.3 \u70b9\u51fb\u914d\u7f6e\u89c4\u5219\uff0c\u5b89\u5168\u7ec4\u9ed8\u8ba4\u662f\u6ca1\u6709\u89c4\u5219\u7684\uff0c\u4f1a\u62d2\u7edd\u6240\u6709\u8fde\u63a5\u3002**\n\n\n\n**3.4 \u6839\u636e\u56fe\u4e2d\u7684\u8bbe\u7f6e\uff0c\u8bbe\u7f6e\u5b8c\u6210\u540e\u70b9\u51fb\u7acb\u5373\u63d0\u4ea4\uff0c\u8fd9\u6837TCP\u76845000\u7aef\u53e3\u5c31\u80fd\u88ab\u8fde\u63a5**\n\n- CIDR\u4e5f\u53ef\u4ee5\u586b\u5199\u672c\u5730\u7684\u516c\u7f51IP\uff0c\u53ea\u5141\u8bb8\u672c\u5730\u8bbf\u95ee\u5bf9\u5e94\u7aef\u53e3\n \n\n**3.5 \u70b9\u51fb\u7ed1\u5b9a\u4e91\u4e3b\u673a\uff0c\u9009\u62e9\u4e91\u4e3b\u673a\uff0c\u5c06\u5bf9\u5e94\u7684\u4e91\u4e3b\u673a\u52a0\u5165\u7ed1\u5b9a\u5b89\u5168\u7ec4**\n\n\n\n\n\n\n\n### 4. \u5173\u95ed\u5bc6\u7801\u767b\u5f55\uff0c\u91c7\u7528\u5bc6\u94a5\u767b\u5f55\n\n**4.1 \u8f93\u5165\u4ee5\u4e0b\u547d\u4ee4\uff0c\u8fde\u7eed\u4e09\u6b21\u56de\u8f66\uff0c\u751f\u6210\u7684\u6587\u4ef6\u5728\/root\/.ssh\/ \u76ee\u5f55\u4e0b**\n\n```\nssh-keygen -t rsa\n```\n\n\n\n**4.2 \u8fdb\u5165\u5230\/root\/.ssh\/\u76ee\u5f55\u4e0b\uff0c\u8f93\u5165\u4ee5\u4e0b\u547d\u4ee4\uff0c\u590d\u5236\u516c\u94a5\uff0c\u8d4b\u4e88\u6587\u4ef6\u6743\u9650\uff0c\u5c06\u5c06id_rsa\u6587\u4ef6\u4e0b\u8f7d\u81f3\u672c\u5730\u5907\u7528**\n\n```\ncd root\/.ssh\/\ncat id_rsa.pub >> authorized_keys\nchmod 600 root\/.ssh\/authorized_keys\n```\n\n**4.3 \u767b\u5f55\u4e91\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\uff0c\u7f16\u8f91\u201csshd_config\u201d\u914d\u7f6e\u6587\u4ef6\uff0c\u7981\u6b62\u5bc6\u7801\u767b\u5f55\u3002**\n\n```\nvim \/etc\/ssh\/sshd_config\n```\n\n\u6309\u201ci\u201d\u8fdb\u5165\u7f16\u8f91\u6a21\u5f0f\uff0c\u5728\u6700\u540e\u51e0\u884c\u6309\u4e0b\u56fe\u8fdb\u884c\u914d\u7f6e\n\n\n\n\u53c2\u6570\u8bf4\u660e\uff1a\n\n- PermitRootLogin\uff1a\u662f\u5426\u5141\u8bb8root\u5e10\u6237\u767b\u5f55\uff0c\u914d\u7f6e\u4e3a\u201cyes\u201d\u3002\n- UseDNS\uff1a\u662f\u5426\u5141\u8bb8DNS\u89e3\u6790\uff0c\u914d\u7f6e\u4e3a\u201cno\u201d\u3002\n- PasswordAuthentication\uff1a\u662f\u5426\u5141\u8bb8\u4f7f\u7528\u5bc6\u7801\u767b\u5f55\uff0c\u914d\u7f6e\u4e3a\u201cno\u201d\u3002\n\n\u6309\u201cEsc\u201d\uff0c\u8f93\u5165**:wq**\u4fdd\u5b58\u5e76\u9000\u51fa\u3002\n\n### 5.\u91cd\u542fsshd\n**\u5b8c\u6210\u540e\uff0c\u91cd\u542fsshd**\n```\nsystemctl restart sshd**\n```\n\n**5.1 \u4ee5Xshell\u4e3a\u4f8b\uff0c\u8fdb\u884c\u8fde\u63a5**\n\n- \u9009\u62e9\u9876\u90e8\u7684\u5de5\u5177-\u7528\u6237\u79d8\u94a5\u7ba1\u7406\u8005\n\n\n\n- \u5bfc\u5165\u521a\u624d\u4e0b\u8f7d\u5230\u672c\u5730\u7684id_rsa\u6587\u4ef6\uff0c\u7136\u540e\u70b9\u51fb\u5173\u95ed\n\n\n\n- \u6253\u5f00\u4f1a\u8bdd\u5c5e\u6027\uff0c\u8bbe\u7f6e\u79d8\u94a5\n\n\n\n- \u9009\u62e9\u5bf9\u5e94\u7684\u79d8\u94a5\u70b9\u51fb\u786e\u5b9a\n\n\n\n\n- \u767b\u5f55\u6210\u529f\n\n"}