Centos server ssh Security Settings

Centos server ssh Security Settings

The Internet is very dangerous. As the door to the server, ssh must be well configured for security. I have tested that A VPS enables the ssh service to listen to the default port 22. A few days later, the secure diary split up more than 10, the following figure shows the IP addresses that failed malicious logon in the last few hours:

It's really a terrible Number of times. There are too many people who suffer. If the password is cracked, please refer to the Shell script that uses iptables to automatically seal IP addresses.

1. Change the default port

There are a lot of software on the Internet for port 22 scanning, so it will not be accidentally hurt.

[Plain] view plaincopy

1. Sed-I's/# Port22/Port33333/G'/etc/ssh/sshd_config # Change ssh port to 3333

2. Disable root Login

Create a common user logon. After logon, You Can su-transfer to the root account, so that malicious users cannot guess the user name.

[Plain] view plaincopy

1. Useraddonovps # create a user name
2. Passwdonovps # Set the password
3. Sed-I's/# PermitRootLoginyes/PermitRootLoginno/G'/etc/ssh/sshd_config # prohibit root Login
4. Servicesshdrestart # restart the ssh service to take effect

3. Limit the number of Logon failures and lock them

[Plain] view plaincopy

1. Vim/etc/pam. d/login

Add under # % PAM-1.0:

Auth required pam_tally2.so deny = 5 unlock_time = 180 #5 logon failures lock 180 seconds, excluding root

Auth required pam_tally2.so deny = 5 unlock_time = 180 even_deny_root root_unlock_time = 180 # contains root

4. allow specific users to log on

Edit the ssh configuration file:

[Plain] view plaincopy

1. Vim/etc/ssh/sshd_config

Allow Users user # All Users are allowed by default. Multiple Users are separated by spaces, and specific Users can be refused to log on.

Deny Users user

5. Set the number of repeated verifications. The default value is 3:

MaxAuthTries 0 # Disconnect if one error occurs

6. directly use Iptables to close the ssh port

Set the key to open the door for the ssh server. All the other keys are on the cloud...

Generally, these settings are sufficient. You can also Disable password and use the key to log on. Different client methods are different. Write them later.