码迷,mamicode.com
首页 > 系统相关 > 详细

linux运维配置讲解--sshd-config

时间:2018-07-29 13:09:02      阅读:247      评论:0      收藏:0      [点我收藏+]

标签:mon   tab   rda   长度   bashrc   ted   check   int   modifier   

文件配置:
1, /etc/ssh/sshd_config
  ssh配置文件
2, /etc/shadow
  密码文件
3, /etc/sudoers
  授权用户管理文件
4, /etc/issue
  系统信息文件,可删除
5,/etc/issue.net
  远程登入欢迎信息需要更改
6, /etc/redhat-release
  操作系统和版本信息最好更改
7, /etc/motd
  文件的系统公告,登入系统会显示在用户的终端
8, Control - Alt - Delete
  组合键重启系统快捷键更改位置:
    centos5.X:/etc/inittab
    centos6.X:/etc/init/Control-alt-delete.con 下更改
9, 文件 /etc/ssh/sshd_config 配置详情:
  Port 22 :Port用来设置sshd监听的端口
  Protocol 2 :设置使用ssh协议的版本为SSH1或者SSH2 SSH1有版本漏洞所以设置2
  ListenAddress 0.0.0.0 用来设置ssh服务绑定的IP地址
  HostKey /etc/ssh/ssh_host_dsa_key 用来设置 服务器密钥文件的路径
  KeyRegenerationInterval 1h 用来设置在多久后系统治冻生成服务器的密钥,重新生成密钥放置利用盗用密钥解密被截获的信息
  ServerKeyBits 1024 密钥的长度
  SyslogFacility AUTHPRIV 设定记录来自shh消息的时候是否给出facility code
  LogLevel INFO 记录ssh日志消息级别
  LoginGraceTime 2m 用户登入失败,切断连接等待时间
  PermitRootLogin yes 设置不能root远程登入服务器
  strictModes yes 接受ssh登入之前检查用户根权限
  RSAAuthentication yes 是否设置RSA密钥验证
  PubkeyAuthentication yes 设置是否公钥验证
  AuthorizedKeysFile .ssh/authorized_keys 设置公钥验证文件路径
  AuthorizedKeysCommand none
  AuthorizedKeysCommandRunAs nobody
  
  For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  RhostsRSAAuthentication no
  similar for protocol version 2
  HostbasedAuthentication no
    Change to yes if you don‘t trust ~/.ssh/known_hosts for
    RhostsRSAAuthentication and HostbasedAuthentication
    IgnoreUserKnownHosts no ssh进行安全验证时候是否忽略用户“$HOME/.SSH/known_hosts”
  Don‘t read the user‘s ~/.rhosts and ~/.shosts files
  IgnoreRhosts yes 设置验证时候是否使用“~/rhosts” "~/shorts" 文件
  To disable tunneled clear text passwords, change to no here!
  PasswordAuthentication yes 时候开启密码验证
    PermitEmptyPasswords no 设置是否允许空口令帐号登入系统
  PasswordAuthentication yes

  Change to no to disable s/key passwords
  ChallengeResponseAuthentication yes 禁用 s/key 密码
  ChallengeResponseAuthentication no

  Kerberos options
  KerberosAuthentication no
  KerberosOrLocalPasswd yes
  KerberosTicketCleanup yes
  KerberosGetAFSToken no
  KerberosUseKuserok yes

  GSSAPI options
  GSSAPIAuthentication no
  GSSAPIAuthentication yes
    GSSAPICleanupCredentials yes
  GSSAPICleanupCredentials yes
  GSSAPIStrictAcceptorCheck yes
  GSSAPIKeyExchange no

  Set this to ‘yes‘ to enable PAM authentication, account processing,
  and session processing. If this is enabled, PAM authentication will
  be allowed through the ChallengeResponseAuthentication and
  PasswordAuthentication. Depending on your PAM configuration,
  PAM authentication via ChallengeResponseAuthentication may bypass
    the setting of "PermitRootLogin without-password".
  If you just want the PAM account and session checks to run without
  PAM authentication, then enable this but set PasswordAuthentication
  and ChallengeResponseAuthentication to ‘no‘.
  UsePAM no 不通过PAM验证
  UsePAM yes

  Accept locale-related environment variables
  AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
  AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
  AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
  AcceptEnv XMODIFIERS

  AllowAgentForwarding yes
  AllowTcpForwarding yes
  GatewayPorts no
  X11Forwarding no
  X11Forwarding yes 设置是否允许X11转发
  X11DisplayOffset 10
  X11UseLocalhost yes
  PrintMotd yes 设置ssd 是否在用户登入的时候显示”/etc/motd“
  PrintLastLog yes 是否显示上次的登录信息
  TCPKeepAlive yes防止死链接
  UseLogin no
  UsePrivilegeSeparation yes
  PermitUserEnvironment no
  Compression delayed
  ClientAliveInterval 0
  ClientAliveCountMax 3
  ShowPatchLevel no
  UseDNS yes
  PidFile /var/run/sshd.pid
  MaxStartups 10:30:100 设置允许几个尚未登入的联机
  PermitTunnel no
  ChrootDirectory none

  no default banner path
  Banner none

  override default of no subsystems
  Subsystem sftp /usr/libexec/openssh/sftp-server
  
  Example of overriding settings on a per-user basis
  Match User anoncvs
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand cvs server
10, /etc/bashrc
    用户环境变量
11,/etc/profile
  系统变量
12, /etc/host.allow && /etc/host.deny
  主要参数
  service:代理服务器名
  hosts 主机名或者ip地址
  action 动作
  ALL 所有服务器或者ip
  all Except除去

 

linux运维配置讲解--sshd-config

标签:mon   tab   rda   长度   bashrc   ted   check   int   modifier   

原文地址:https://www.cnblogs.com/kingle-study/p/9384677.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!