鏄ㄥぉ鏉ュ叕鍙哥櫥闄嗘椂鍙戠幇錛屽叕鍙稿睆钄戒簡22绔彛錛屾棤濂堬紝鍥炲鎶婄鍙ｆ敼鎺夊惂銆?br /> 欏轟究灝嗛粯璁ゅ彧鑳絩askey鐧婚檰鏂瑰紡錛屾敼鎺夛紝閲嶆柊閰嶇疆ssh涓涓嬨?br />
# 1. 鍏充簬 SSH Server 鐨勬暣浣撹瀹氾紝鍖呭惈浣跨敤鐨?nbsp;port 鍟︼紝浠ュ強浣跨敤鐨勫瘑鐮佹紨綆楁柟寮?/span>Port 22銆銆銆銆銆銆銆銆銆銆# SSH 棰勮浣跨敤 22 榪欎釜 port錛屾偍涔熷彲浠ヤ嬌鐢ㄥ鐨?nbsp;port 錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 浜﹀嵆閲嶅浣跨敤 port 榪欎釜璁懼畾欏圭洰鍗沖彲錛?/span>Protocol 2,1銆銆銆銆銆銆銆 # 閫夋嫨鐨?nbsp;SSH 鍗忚鐗堟湰錛屽彲浠ユ槸 1 涔熷彲浠ユ槸 2 錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 濡傛灉瑕佸悓鏃舵敮鎸佷袱鑰咃紝灝卞繀欏昏浣跨敤 2,1 榪欎釜鍒嗛殧浜嗭紒#ListenAddress 0.0.0.0銆銆 # 鐩戝惉鐨勪富鏈洪傞厤鍗★紒涓句釜渚嬪瓙鏉ヨ錛屽鏋滄偍鏈変袱涓?nbsp;IP錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鍒嗗埆鏄?nbsp;192.168.0.100 鍙?nbsp;192.168.2.20 錛岄偅涔堝彧鎯寵銆銆銆銆銆銆銆銆銆銆銆銆銆 # 寮鏀?nbsp;192.168.0.100 鏃訛紝灝卞彲浠ュ啓濡傚悓涓嬮潰鐨勬牱寮忥細ListenAddress 192.168.0.100 # 鍙洃鍚潵鑷?nbsp;192.168.0.100 榪欎釜 IP 鐨凷SH鑱旀満銆?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 濡傛灉涓嶄嬌鐢ㄨ瀹氱殑璇濓紝鍒欓璁炬墍鏈夋帴鍙ｅ潎鎺ュ彈 SSHPidFile /var/run/sshd.pid銆銆銆銆銆銆# 鍙互鏀劇疆 SSHD 榪欎釜 PID 鐨勬。妗堬紒宸﹀垪涓洪粯璁ゅ?/span>LoginGraceTime 600銆銆銆銆 # 褰撲嬌鐢ㄨ呰繛涓?nbsp;SSH server 涔嬪悗錛屼細鍑虹幇杈撳叆瀵嗙爜鐨勭敾闈紝銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鍦ㄨ鐢婚潰涓紝鍦ㄥ涔呮椂闂村唴娌℃湁鎴愬姛榪炰笂 SSH server 錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 灝辨柇綰匡紒鏃墮棿涓虹錛?/span>Compression yes銆銆銆銆銆銆# 鏄惁鍙互浣跨敤鍘嬬緝鎸囦護錛熷綋鐒跺彲浠ュ暟錛?br />
銆# 2. 璇存槑涓繪満鐨?nbsp;Private Key 鏀劇疆鐨勬。妗堬紝棰勮浣跨敤涓嬮潰鐨勬。妗堝嵆鍙紒HostKey /etc/ssh/ssh_host_key銆銆銆銆# SSH version 1 浣跨敤鐨勭閽?/span>HostKey /etc/ssh/ssh_host_rsa_key銆銆# SSH version 2 浣跨敤鐨?nbsp;RSA 縐侀挜HostKey /etc/ssh/ssh_host_dsa_key銆銆# SSH version 2 浣跨敤鐨?nbsp;DSA 縐侀挜# 2.1 鍏充簬 version 1 鐨勪竴浜涜瀹氾紒KeyRegenerationInterval 3600銆 銆銆銆# 鐢卞墠闈㈣仈鏈虹殑璇存槑鍙互鐭ラ亾錛?nbsp;version 1 浼氫嬌鐢?nbsp;銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # server 鐨?nbsp;Public Key 錛岄偅涔堝鏋滆繖涓?nbsp;Public 銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # Key 琚伔鐨勮瘽錛屽矀涓嶅畬铔嬶紵鎵浠ラ渶瑕佹瘡闅斾竴孌墊椂闂?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鏉ラ噸鏂板緩绔嬩竴嬈★紒榪欓噷鐨勬椂闂翠負縐掞紒ServerKeyBits 768 銆銆銆銆銆銆銆銆銆 # 娌￠敊錛佽繖涓氨鏄?nbsp;Server key 鐨勯暱搴︼紒# 3. 鍏充簬鐧誨綍鏂囦歡鐨勮鎭暟鎹斁緗笌 daemon 鐨勫悕縐幫紒SyslogFacility AUTH銆銆銆銆銆銆銆銆銆# 褰撴湁浜轟嬌鐢?nbsp;SSH 鐧誨叆緋葷粺鐨勬椂鍊欙紝SSH浼氳褰曡祫銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 璁紝榪欎釜淇℃伅瑕佽褰曞湪浠涔?nbsp;daemon name 搴曚笅錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 棰勮鏄互 AUTH 鏉ヨ瀹氱殑錛屽嵆鏄?nbsp;/var/log/secure銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 閲岄潰錛佷粈涔堬紵蹇樿浜嗭紒鍥炲埌 Linux 鍩虹鍘葷炕涓涓?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鍏跺畠鍙敤鐨?nbsp;daemon name 涓猴細DAEMON,USER,AUTH,銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # LOCAL0,LOCAL1,LOCAL2,LOCAL3,LOCAL4,LOCAL5,LogLevel INFO銆銆銆銆銆銆銆銆銆銆銆銆# 鐧誨綍璁板綍鐨勭瓑綰э紒鍢垮樋錛佷換浣曡鎭紒銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鍚屾牱鐨勶紝蹇樿浜嗗氨鍥炲幓鍙傝冿紒# 4. 瀹夊叏璁懼畾欏圭洰錛佹瀬閲嶈錛?br />
# 4.1 鐧誨叆璁懼畾閮ㄥ垎PermitRootLogin no銆銆 銆銆# 鏄惁鍏佽 root 鐧誨叆錛侀璁炬槸鍏佽鐨勶紝浣嗘槸寤鴻璁懼畾鎴?nbsp;no錛?/span>UserLogin no銆銆銆銆銆銆銆 # 鍦?nbsp;SSH 搴曚笅鏈潵灝變笉鎺ュ彈 login 榪欎釜紼嬪簭鐨勭櫥鍏ワ紒StrictModes yes銆銆銆銆銆銆# 褰撲嬌鐢ㄨ呯殑 host key 鏀瑰彉涔嬪悗錛孲erver 灝變笉鎺ュ彈鑱旀満錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鍙互鎶墊尅閮ㄥ垎鐨勬湪椹▼搴忥紒#RSAAuthentication yes銆銆 # 鏄惁浣跨敤綰殑 RSA 璁よ瘉錛侊紵浠呴拡瀵?nbsp;version 1 錛?/span>PubkeyAuthentication yes銆 # 鏄惁鍏佽 Public Key 錛熷綋鐒跺厑璁稿暒錛佸彧鏈?nbsp;version 2AuthorizedKeysFile .ssh/authorized_keys銆銆銆銆銆銆銆銆銆銆銆銆銆 # 涓婇潰榪欎釜鍦ㄨ瀹氳嫢瑕佷嬌鐢ㄤ笉闇瑕佸瘑鐮佺櫥鍏ョ殑璐﹀彿鏃訛紝閭ｄ箞閭ｄ釜銆銆銆銆銆銆銆銆銆銆銆銆銆 # 璐﹀彿鐨勫瓨鏀炬。妗堟墍鍦ㄦ。鍚嶏紒# 4.2 璁よ瘉閮ㄥ垎RhostsAuthentication no銆銆# 鏈満緋葷粺涓嶆浣跨敤 .rhosts 錛屽洜涓轟粎浣跨敤 .rhosts 澶?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 涓嶅畨鍏ㄤ簡錛屾墍浠ヨ繖閲屼竴瀹氳璁懼畾涓?nbsp;no 錛?/span>IgnoreRhosts yes銆銆銆銆銆 # 鏄惁鍙栨秷浣跨敤 ~/.ssh/.rhosts 鏉ュ仛涓鴻璇侊紒褰撶劧鏄紒RhostsRSAAuthentication no # 榪欎釜閫夐」鏄笓闂ㄧ粰 version 1 鐢ㄧ殑錛屼嬌鐢?nbsp;rhosts 妗ｆ鍦?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # /etc/hosts.equiv閰嶅悎 RSA 婕旂畻鏂瑰紡鏉ヨ繘琛岃璇侊紒涓嶈浣跨敤HostbasedAuthentication no # 榪欎釜欏圭洰涓庝笂闈㈢殑欏圭洰綾諱技錛屼笉榪囨槸緇?nbsp;version 2 浣跨敤鐨勶紒IgnoreUserKnownHosts no銆銆# 鏄惁蹇界暐瀹剁洰褰曞唴鐨?nbsp;~/.ssh/known_hosts 榪欎釜妗ｆ鎵璁板綍銆銆銆銆銆銆銆銆銆銆銆銆銆 # 鐨勪富鏈哄唴瀹癸紵褰撶劧涓嶈蹇界暐錛屾墍浠ヨ繖閲屽氨鏄?nbsp;no 鍟︼紒PasswordAuthentication yes # 瀵嗙爜楠岃瘉褰撶劧鏄渶瑕佺殑錛佹墍浠ヨ繖閲屽啓 yes 鍟幫紒PermitEmptyPasswords no銆銆# 鑻ヤ笂闈㈤偅涓欏瑰鏋滆瀹氫負 yes 鐨勮瘽錛岃繖涓欏瑰氨鏈濂借瀹?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆 # 涓?nbsp;no 錛岃繖涓」鐩湪鏄惁鍏佽浠ョ┖鐨勫瘑鐮佺櫥鍏ワ紒褰撶劧涓嶈錛?/span>ChallengeResponseAuthentication yes # 鎸戞垬浠諱綍鐨勫瘑鐮佽璇侊紒鎵浠ワ紝浠諱綍 login.conf 銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 瑙勫畾鐨勮璇佹柟寮忥紝鍧囧彲閫傜敤錛?br />
#PAMAuthenticationViaKbdInt yes # 鏄惁鍚敤鍏跺畠鐨?nbsp;PAM 妯″潡錛佸惎鐢ㄨ繖涓ā鍧楀皢浼?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆銆 # 瀵艱嚧 PasswordAuthentication 璁懼畾澶辨晥錛?br />
銆# 4.3 涓?nbsp;Kerberos 鏈夊叧鐨勫弬鏁拌瀹氾紒鍥犱負鎴戜滑娌℃湁 Kerberos 涓繪満錛屾墍浠ュ簳涓嬩笉鐢ㄨ瀹氾紒#KerberosAuthentication no#KerberosOrLocalPasswd yes#KerberosTicketCleanup yes#KerberosTgtPassing no銆# 4.4 搴曚笅鏄湁鍏沖湪 X-Window 搴曚笅浣跨敤鐨勭浉鍏寵瀹氾紒X11Forwarding yes#X11DisplayOffset 10#X11UseLocalhost yes# 4.5 鐧誨叆鍚庣殑欏圭洰錛?/span>PrintMotd no # 鐧誨叆鍚庢槸鍚︽樉紺哄嚭涓浜涗俊鎭憿錛熶緥濡備笂嬈＄櫥鍏ョ殑鏃墮棿銆佸湴鐐圭瓑銆銆銆銆銆銆銆銆銆銆銆銆銆# 絳夛紝棰勮鏄?nbsp;yes 錛屼絾鏄紝濡傛灉涓轟簡瀹夊叏錛屽彲浠ヨ冭檻鏀逛負 no 錛?/span>PrintLastLog yes銆銆銆銆銆# 鏄劇ず涓婃鐧誨叆鐨勪俊鎭紒鍙互鍟婏紒棰勮涔熸槸 yes 錛?/span>KeepAlive yes銆銆銆銆銆銆 # 涓鑸岃█錛屽鏋滆瀹氳繖欏圭洰鐨勮瘽錛岄偅涔?nbsp;SSH Server 浼氫紶閫?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆# KeepAlive 鐨勮鎭粰 Client 绔紝浠ョ‘淇濅袱鑰呯殑鑱旀満姝ｅ父錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆# 鍦ㄨ繖涓儏鍐典笅錛屼換浣曚竴绔鎺夊悗錛?nbsp;SSH 鍙互绔嬪埢鐭ラ亾錛佽屼笉浼?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆# 鏈夊兊灝哥▼搴忕殑鍙戠敓錛?/span>UsePrivilegeSeparation yes # 浣跨敤鑰呯殑鏉冮檺璁懼畾欏圭洰錛佸氨璁懼畾涓?nbsp;yes 鍚э紒MaxStartups 10銆銆銆銆銆銆# 鍚屾椂鍏佽鍑犱釜灝氭湭鐧誨叆鐨勮仈鏈虹敾闈紵褰撴垜浠繛涓?nbsp;SSH 錛?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆# 浣嗘槸灝氭湭杈撳叆瀵嗙爜鏃訛紝榪欎釜鏃跺欏氨鏄垜浠墍璋撶殑鑱旀満鐢婚潰鍟︼紒銆銆銆銆銆銆銆銆銆銆銆銆銆# 鍦ㄨ繖涓仈鏈虹敾闈腑錛屼負浜嗕繚鎶や富鏈猴紝鎵浠ラ渶瑕佽瀹氭渶澶у鹼紝銆銆銆銆銆銆銆銆銆銆銆銆銆# 棰勮鏈澶氬崄涓仈鏈虹敾闈紝鑰屽凡緇忓緩绔嬭仈鏈虹殑涓嶈綆楀湪榪欏崄涓綋涓?br />
# 4.6 鍏充簬浣跨敤鑰呮姷鎸＄殑璁懼畾欏圭洰錛?/span>DenyUsers *銆銆銆銆銆銆銆 # 璁懼畾鍙楁姷鎸＄殑浣跨敤鑰呭悕縐幫紝濡傛灉鏄叏閮ㄧ殑浣跨敤鑰咃紝閭ｅ氨鏄叏閮?br />
銆銆銆銆銆銆銆銆銆銆銆銆銆# 鎸″惂錛佽嫢鏄儴鍒嗕嬌鐢ㄨ咃紝鍙互灝嗚璐﹀彿濉叆錛佷緥濡備笅鍒楋紒DenyUsers testDenyGroups test銆銆銆銆銆 # 涓?nbsp;DenyUsers 鐩稿悓錛佷粎鎶墊尅鍑犱釜緹ょ粍鑰屽凡錛?br />
# 5. 鍏充簬 SFTP 鏈嶅姟鐨勮瀹氶」鐩紒Subsystem sftp /usr/lib/ssh/sftp-server寮曠敤鑷細http://doc.licess.org/openssh/sshd_config.html
]]>