阿雷克西斯吉内特:SSH安全加固

#1: Disable OpenSSH Server (关闭ssh server,如果不能SSH，就直接关掉)

#2: Only Use SSH Protocol 2 (使用sshv2 版本)
Protocol 2

#3: Limit Users’ SSH Access(限制用户登入)
AllowUsers root vivek jerry  (允许root vivek jerry)
DenyUsers saroj anjali foo   (拒绝 saroj anjali foo)

#4: Configure Idle Log Out Timeout Interval(配置空闲时间)
ClientAliveInterval 300
ClientAliveCountMax 0

#5: Disable .rhosts Files (关闭.rhosts文件)
IgnoreRhosts yes

#6: Disable Host-Based Authentication （关闭基本主机的认证)
To disable host-based authentication, update sshd_config with the following option:
HostbasedAuthentication no

#7: Disable root Login via SSH (限制root用户登录)
PermitRootLogin no

#8: Enable a Warning Banner (设置用户警告信息)
Set a warning banner by updating sshd_config with the following line:
Banner /etc/issue

#9: Firewall SSH Port # 22 (防火墙上过滤ssh端口)

#10: Change SSH Port and Limit IP Binding (改变ssh端口和限制IP登陆)
Port 300
ListenAddress 192.168.1.5
ListenAddress 202.54.1.5
A better approach to use proactive approaches scripts such as fail2ban or denyhosts (see below).

#11: Use Strong SSH Passwords and Passphrase (使用强健的主机密码,不用说也知道)

#12: Use Public Key Based Authentication  (基于公私钥来认证的东西)
Use public/private key pair with password protection for the private key. See how to use RSA and DSA key based authentication. Never ever use passphrase free key (passphrase key less) login.

#13: Use Keychain Based Authentication (这个我还真没有用过)

#14: Chroot SSHD (Lock Down Users To Their Home Directories) (类似于chroot的配置了)

#15: Use TCP Wrappers (使用TCP Wrappers 大家应该很熟悉的)
sshd : 192.168.1.2 172.16.23.12

#16: Disable Empty Passwords  (关闭空密码命令选项)
PermitEmptyPasswords no

#17: Thwart SSH Crackers (Brute Force Attack)(防止暴力破解的N多软件)

#18: Rate-limit Incoming Port # 22 Connections (限制22端口连接)

#19: Use Port Knocking (这是个好软件呀)

#20: Use Log Analyzer (使用日志分析工具)
LogLevel INFO

#21: Patch OpenSSH and Operating Systems (最重要的一条，及时更新补丁和操作系统)

PS: 对于ssh 端口更改，有可能selinux会影响，直接开启再关闭，应该就可以了。为防止发生事故，可以在保留22 port的情况下进行多端口开放尝试。在基本公私钥认证的方式中，使用putty(windows 平台) 生在的公钥时，在使用命令 serverssh-keygen -if test.pub(putty 生在的公钥) >opssh.pub(linux认识的公钥) 去转换一下，否则会出现server _refused_our_key

发表于t00ls
翻译:slip2008
转自网络安全攻防研究室www.91ri.org