RH124-09 OpenSSH服务配置与安全

首页 > 代码库 > RH124-09 OpenSSH服务配置与安全

RH124-09 OpenSSH服务配置与安全

2024-09-30 06:53:39 251人阅读

第九章 OpenSSH服务配置与安全

9.1 通过ssh访问远程命令

OpenSSH提供一个安全的远程shell,用于管理远程Linux、unix系统.

OpenSSH使用非对称加密手段加密保护通信数据.

$ ssh remotehost

$ ssh remoteuser@remotehost 或 ssh -l remoteuser remotehost

$ ssh remoteuset@remotehost remote-command

$ w -f

相关文件:

客户端会首次登陆远程机器的时候,会把远程机器的公钥保存在~/.ssh/know_hosts,以后每次登陆到某服务器的时候,都会对比远程机器的公钥和存在在本机的该服务器公钥是否相同,如果不相同就会终止连接,防止黑客伪装服务器.

服务端把相关的公钥和私钥存在/etc/ssh/*key*中

9.2 配置ssh的密钥验证

默认情况下,通过ssh登陆到远程的系统,需要提供远程系统上的帐号与密码,但为了降低密码泄露的机率和提高登陆的方便性,可以使用基于密钥的验证.

1) 客户端生成密钥对

$ shh-keygen -t rsa

一路回车,不需要输入任何东西

2) 客户端把公钥发送给远程的系统

$ ssh-copy-id -i ~/.ssh/id_rsa.pub server0

$ ssh-copy-id -i ~/.ssh/id_rsa.pub root@server0

3) 登陆

$ ssh server0

结果: 免去密码验证,直接登陆到远程的系统

9.3 自定义优化ssh的服务配置

如何找到sshd服务的配置文件?

需要了解的一些安全选项:

PermitRootLogin yes|no 是否允许root通过ssh登陆到本机

PermitRootLogin without-password 只允许root通过密钥验证的手段ssh登陆到本机，对其他用户不生效

PasswordAuthentication yes|no 默认是yes,允许通过ssh密码验证的方式登陆到本机.如果设定为no,那么只能通过密钥验证的手段登陆，针对所有用户。

笔记：

9.1

方法1：首次登陆要求保存远端发过来的公钥

[root@desktop0 ~]# ssh server0 用server0登陆

root@server0‘s password:

Last login: Sat Jun 3 10:43:43 2017 from desktop0.example.com

[root@server0 ~]#

[root@desktop0 ~]# host server0 登陆前提是可以解析到这个IP地址

server0.example.com has address 172.25.0.11

[root@desktop0 ~]# ssh 172.25.0.11 也可以直接登陆IP地址

root@172.25.0.11‘s password:

Last login: Sat Jun 3 10:44:08 2017 from desktop0.example.com

[root@server0 ~]#

方法2：

[root@server0 ~]# ssh student@server0

The authenticity of host ‘server0 (172.25.0.11)‘ can‘t be established.

ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added ‘server0,172.25.0.11‘ (ECDSA) to the list of known hosts.

student@server0‘s password:

Last login: Thu May 11 11:57:56 2017

[student@server0 ~]$

[root@server0 ~]# ssh root@server0

root@server0‘s password:

Last login: Sat Jun 3 10:45:43 2017 from desktop0.example.com

[root@server0 ~]#

方法3：

[root@server0 ~]# ssh 172.25.0.11 -l root -l就是-login

root@172.25.0.11‘s password:

Last login: Sat Jun 3 10:49:27 2017 from server0.example.com

[root@server0 ~]#

[root@server0 ~]# ssh server0 -l student

student@server0‘s password:

Last login: Sat Jun 3 10:48:49 2017 from server0.example.com

[student@server0 ~]$

只需要远程过去输出一条命令过来，如取名字，如关机

[root@server0 ~]# ssh root@server0 hostname

root@server0‘s password:

server0.example.com

[root@server0 ~]#

[root@server0 ~]# w -f 可以看到哪些登陆到本机：0代表是图形界面

11:01:53 up 23 min, 3 users, load average: 0.00, 0.02, 0.08

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

root pts/0 desktop0.example 10:45 1.00s 0.24s 0.16s ssh root@server

root pts/1 server0.example. 10:49 1.00s 0.15s 0.02s w -f

[root@server0 ~]#

[student@desktop0 Desktop]$ ssh root@server0

The authenticity of host ‘server0 (172.25.0.11)‘ can‘t be established.

ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added ‘server0,172.25.0.11‘ (ECDSA) to the list of known hosts.

root@server0‘s password:

Last login: Sat Jun 3 10:50:21 2017 from server0.example.com

[root@server0 ~]# ls /etc/ssh/*key* server0存放的公钥

/etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_rsa_key

/etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_rsa_key.pub

[root@server0 ~]#

[root@server0 ~]# cat /etc/ssh/ssh_host_ecdsa_key.pub

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHX+o9KAnlfw2dE7CsmM4hqfv1udM79a5NWC2BuWlmfKSwfYLptPQMJF8bnqaz0EjDlxCxRu/aito+GphPLzp/k=

[root@server0 ~]# logout

Connection to server0 closed.

[student@desktop0 Desktop]$ grep server0 ~/.ssh/known_hosts 本机存放公钥的地方

server0,172.25.0.11 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHX+o9KAnlfw2dE7CsmM4hqfv1udM79a5NWC2BuWlmfKSwfYLptPQMJF8bnqaz0EjDlxCxRu/aito+GphPLzp/k=

[student@desktop0 Desktop]$

9.2 演示整个过程

[student@desktop0 Desktop]$ :> ~/.ssh/known_hosts 清空

[student@desktop0 Desktop]$ cat ~/.ssh/known_hosts

[student@desktop0 Desktop]$ ssh-keygen -t rsa

Generating public/private rsa key pair.

Enter file in which to save the key (/home/student/.ssh/id_rsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /home/student/.ssh/id_rsa.

Your public key has been saved in /home/student/.ssh/id_rsa.pub.

The key fingerprint is:

65:09:74:d4:45:2b:86:7d:11:6e:96:0a:2d:b9:ce:81 student@desktop0.example.com

The key‘s randomart image is:

+--[ RSA 2048]----+

| .o.o. o=. |

| o *.. + |

| O = B |

| + = * |

| E o . |

| o . |

| o |

| |

+-----------------+

[student@desktop0 Desktop]$

[student@desktop0 Desktop]$ ls /home/student/.ssh/

authorized_keys id_rsa id_rsa.pub known_hosts

[student@desktop0 Desktop]$

ssh-copy-id -i ~/.ssh/id/id_rsa.pub server0 这样登陆就可以保存用户名和密码，下次就不用输入了

[student@desktop0 Desktop]$ ssh-copy-id -i ~/.ssh/id_rsa.pub root@server0

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

root@server0‘s password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh ‘root@server0‘"

and check to make sure that only the key(s) you wanted were added.

[student@desktop0 Desktop]$ ssh root@server0

Last login: Sat Jun 3 11:10:04 2017 from desktop0.example.com

[root@server0 ~]#

[root@server0 ~]# cat /root/.ssh/authorized_keys 存放在这里！！

9.3

改SSH配置

[root@server0 Desktop]# vim /etc/ssh/sshd_config

第48排，

#PermitRootLogin no

[root@server0 Desktop]# systemctl restart sshd 重启生效 /实验未做成功生产中会把管理员用户名码禁掉。

清空后再次用desk登陆server，提示不行

[root@desktop0 Desktop]# :> ~/.ssh/known_hosts

[root@desktop0 Desktop]# ssh root@server0

The authenticity of host ‘server0 (172.25.0.11)‘ can‘t be established.

ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added ‘server0,172.25.0.11‘ (ECDSA) to the list of known hosts.

Last login: Sat Jun 3 12:09:25 2017 from desktop0.example.com

[root@server0 ~]#

9.3总结

改都是在这个文件内vim /etc/ssh/sshd_config

PermitRootLogin yes|no 是否允许root通过ssh登陆到本机

PermitRootLogin without-password 只允许root通过密钥验证的手段ssh登陆到本机，对其他用户不生效

PasswordAuthentication yes|no 默认是yes,允许通过ssh密码验证的方式登陆到本机.如果设定为no,那么只能通过密钥验证的手段登陆，针对所有用户。

本文出自 “HCIE_38xx” 博客，谢绝转载！

RH124-09 OpenSSH服务配置与安全

声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉：投诉/举报工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。

联系
我们

首页 > 代码库 > RH124-09 OpenSSH服务配置与安全

RH124-09 OpenSSH服务配置与安全

看完仍有疑问？有类似问题直接问程序猿