SSHD服务搭建

2023-08-09 18:39:34

SSH协议：安全外壳协议。为Secure Shell 缩写。SSH为建立在应用层和传输层基础上的安全协议。

 
1、检查SSH服务端安装情况
  1. [root@rhel6_84 ~]# rpm -qpi /mnt/Packages/openssh-server-5.3p1-94.el6.x86_64.rpm #rpm -qpi packetname 查看安装包的内容
  2. ~]# rpm -qa |grep openssh #检查ssh安装情况。如果没有使用rpm安装一遍。
  3. openssh-5.3p1-94.el6.x86_64
  4. openssh-clients-5.3p1-94.el6.x86_64
  5. openssh-askpass-5.3p1-94.el6.x86_64
  6. openssh-server-5.3p1-94.el6.x86_64
 
2、启动SSHD服务
  1. [root@rhel-6 ~]# service sshd start
  2. [root@rhel-6 ~]# /etc/init.d/sshd start #绝对路径方式启动
  3. [root@rhel-6 ~]# chkconfig sshd on #设置sshd服务开机自启 on自启 off关闭自启
    [root@rhel-6 ~]# chkconfig --list sshd #检查开机自启情况
    sshd 0:关闭 1:关闭 2:启用 3:启用 4:启用 5:启用 6:关闭
 
3、客户端保存的密钥
  1. [~]# cat .ssh/known_hosts #查看本机保存的服务端的密钥。
  2. 192.168.3.81 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCzit8dq4s0xZCk1Gme5GJfYaWZzYHW37KHMfpaU7Fc2/npmJpHpufXGiYR+h9bAR6DBJvDzp5Mr/nmoaOxLb9WH4dsD9ZyLVTLzp3gaFpk9Fc7B8VRznIgveRYmIue146DoU3+Hjt7DWA19Cg4vxGZih/RekhmUgwEbKmxoC1KW6Qm6Aqd+F5oNIdign8KtFaIMzE4cNcL6YEb1wdYTk3fdUWhUip0Fir3sej9zjrGdCCA3HPxuPbsPE+3yaQ975yfelKRHI/DUpsKegQHK88RtfElLnDOVgle/yne8vsvDgnB1JYKZTGu8XuHG+vGwQAR+E2AelQcQDVFZ0+eJ+T
 
4、SSHD服务配置文件
  1. [root@rhel6_84 ~]# cp /etc/ssh/sshd_config{,.back} #修改前备份此配置文件
  2. [root@rhel6_84 ~]# ls /etc/ssh/
    moduli ssh_config sshd_config sshd_config.back ssh_host_dsa_key
  3. [root@rhel6_84 ~]# cat -n /etc/ssh/sshd_config
  4. #Port 22 #端口，默认是22，最好修改为其它
  5. [root@rhel6_84 ~]# netstat -anptu |grep ssh #修改好后，查看ssh服务是否正常监听新端口（222）
    tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 2597/sshd
    tcp 0 0 0.0.0.0: 0.0.0.0:* LISTEN 2765/sshd
    tcp 0 52 192.168.3.84:22 192.168.3.130:57537 ESTABLISHED 2597/sshd
    tcp 0 0 ::1:6010 :::* LISTEN 2597/sshd
    tcp 0 0 :::222 :::* LISTEN 2765/sshd
 
5、新端口ssh连接
  1. root@192.168.3.84 #加上-p参数 指定222端口 连接新服务器
 
6、SSHD配置文件详解
  1. # $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
  2. # This is the sshd server system-wide configuration file. See
  3. # sshd_config(5) for more information.
  4. # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin #ssh所执行的bash目录
  5. # The strategy used for options in the default sshd_config shipped with
  6. # OpenSSH is to specify options with their default value where
  7. # possible, but leave them commented. Uncommented options change a
  8. # default value.
  9. Port222 #ssh服务端口号
  10. #AddressFamily any
  11. #ListenAddress 0.0.0.0
  12. #ListenAddress ::
  13. # Disable legacy (protocol version 1) support in the server for new
  14. # installations. In future the default will change to require explicit
  15. # activation of protocol 1
  17. # HostKey for protocol version 1
  18. #HostKey /etc/ssh/ssh_host_key
  19. # HostKeys for protocol version 2
  20. #HostKey /etc/ssh/ssh_host_rsa_key
  21. #HostKey /etc/ssh/ssh_host_dsa_key
  22. # default value.
  24. #AddressFamily any
  25. #ListenAddress 0.0.0.0
  26. #ListenAddress :: #指定只监听的IP地址，设置只允许此IP登陆
  27. # Disable legacy (protocol version 1) support in the server for new
  28. # installations. In future the default will change to require explicit
  29. # activation of protocol 1
  31. # HostKey for protocol version 1
  32. #HostKey /etc/ssh/ssh_host_key
  33. # HostKeys for protocol version 2
  34. #HostKey /etc/ssh/ssh_host_rsa_key
  35. #HostKey /etc/ssh/ssh_host_dsa_key
  36. # Lifetime and size of ephemeral version 1 server key
  37. #KeyRegenerationInterval 1h
  38. #ServerKeyBits 1024 #定义密钥长度，默认长度1024
  39. # Logging
  40. # obsoletes QuietMode and FascistLogging
  41. #SyslogFacility AUTH
  42. SyslogFacility AUTHPRIV
  43. #LogLevel INFO
  44. # Authentication:
  45. #LoginGraceTime 2m #连接断开前等待时间
  46. #PermitRootLogin yes #禁止root用户登陆
  47. #StrictModes yes
  48. #MaxAuthTries 6
  49. #MaxSessions 10
  50. #RSAAuthentication yes
  51. #PubkeyAuthentication yes
  52. #AuthorizedKeysFile .ssh/authorized_keys
  53. #AuthorizedKeysCommand none
  54. #AuthorizedKeysCommandRunAs nobody
  55. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  56. #RhostsRSAAuthentication no
  57. # similar for protocol version 2
  58. #HostbasedAuthentication no
  59. # Change to yes if you don't trust ~/.ssh/known_hosts for
  60. # RhostsRSAAuthentication and HostbasedAuthentication
  61. #IgnoreUserKnownHosts no
  62. # Don't read the user's ~/.rhosts and ~/.shosts files
  63. #IgnoreRhosts yes
  64. # To disable tunneled clear text passwords, change to no here!
  65. #PasswordAuthentication yes
  66. #PermitEmptyPasswords no
  67. PasswordAuthentication yes #是否允许使用账号和密码登陆，改为no将不允许使用账号和密码登陆，可使用私钥登陆。
  68. # Change to no to disable s/key passwords
  69. #ChallengeResponseAuthentication yes
  70. ChallengeResponseAuthentication no
  71. # Kerberos options
  72. #KerberosAuthentication no
  73. #KerberosOrLocalPasswd yes
  74. #KerberosTicketCleanup yes
  75. #KerberosGetAFSToken no
  76. #KerberosUseKuserok yes
  77. # GSSAPI options
  78. #GSSAPIAuthentication no
  79. GSSAPIAuthentication yes
  80. #GSSAPICleanupCredentials yes
  81. GSSAPICleanupCredentials yes
  82. #GSSAPIStrictAcceptorCheck yes
  83. #GSSAPIKeyExchange no
  84. # Set this to 'yes' to enable PAM authentication, account processing,
  85. # and session processing. If this is enabled, PAM authentication will
  86. # be allowed through the ChallengeResponseAuthentication and
  87. # PasswordAuthentication. Depending on your PAM configuration,
  88. # PAM authentication via ChallengeResponseAuthentication may bypass
  89. # the setting of "PermitRootLogin without-password".
  90. # If you just want the PAM account and session checks to run without
  91. # PAM authentication, then enable this but set PasswordAuthentication
  92. # and ChallengeResponseAuthentication to 'no'.
  93. #UsePAM no
  94. UsePAM yes
  95. # Accept locale-related environment variables
  96. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
  97. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
  98. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
  99. AcceptEnv XMODIFIERS
  100. #AllowAgentForwarding yes
  101. #AllowTcpForwarding yes
  102. #GatewayPorts no
  103. #X11Forwarding no
  104. X11Forwarding yes
  105. #X11DisplayOffset 10
  106. #X11UseLocalhost yes
  107. #PrintMotd yes #是否打印 /etc/motd 连接时显示的信息
  108. #PrintLastLog yes #是否显示上次登陆信息
  109. #TCPKeepAlive yes
  110. #UseLogin no
  111. #UsePrivilegeSeparation yes #是否允许低权限用户产生新连接进程，no表示如何用户都是用root权限运行ssh
  112. #PermitUserEnvironment no
  113. #Compression delayed
  114. #ClientAliveInterval 0
  115. #ClientAliveCountMax 3
  116. #ShowPatchLevel no
  117. #UseDNS yes #是否启用DNS验证，外网需要启用
  118. #PidFile /var/run/sshd.pid #存放服务进程ID
  119. #MaxStartups 10:30:100
  120. #PermitTunnel no
  121. #ChrootDirectory none
  122. # no default banner path
  123. #Banner none
  124. # override default of no subsystems
  125. Subsystem sftp /usr/libexec/openssh/sftp-server
  126. # Example of overriding settings on a per-user basis
  127. #Match User anoncvs
  128. # X11Forwarding no
  129. # AllowTcpForwarding no
  130. # ForceCommand cvs server
 
 
上一篇：CMS漏洞


下一篇：原生JavaScript运动功能系列（二）：缓冲运动