Go Cento limit SSH login times

In the company's internal website level assessment needs, is gradually strengthening the system security protection.

Device default 3 authentication failed to automatically exit and end the session; Network logon connection Timeout auto exit time 5 minutes;

The first method: verified.

1.ssh time-out setting # cd/etc/profile.d/#创建两个空白文件autologout. CSH, autologout.sh to save tmout configuration
# Touch Autologout.csh
# Touch Autologout.sh
# vi autologout.sh #编辑autologout. SH

# auto out in 5 minutes    tmout=300            # timeout, unit s   readonly tmout      # set tmout variable read   -only export Tmout        # setting up the  environment Tmout

# vi autologout.csh #编辑autologout. CSH

Set-r Autologout 2  

# chmod +x autologout.* #可执行权限, in fact, a single to u+x on the line.

Disconnect the client and log in to the terminal for 5 minutes without using SSH to automatically disconnect.

2. SSH Authentication number limit:

/etc/ssh/sshd_config

Maxauthtries=3 This is only over 3 authentication errors disconnected.

The second method: (There is still a problem in the test)

Principle: Through the System Pam authentication realizes.

1. Back up the/etc/pam.d/system_auth file, change:

#%pam-1.0#This file is auto-generated. #User changes'll be destroyed the next time Authconfig is run. Auth required pam_env.so auth required pam_unix.so Nullok try_first_pass change the original sufficient to Req Uired#Auth requisite pam_succeed_if.so uid >= quiet comment off this lineAuth Required pam_tally.so deny=3 unlock_time=300add a row, fail more than 3 times limit 5 minutes after logging in#Auth required pam_deny.so comment off this lineAccount required pam_unix.so account sufficient pam_succeed_if.so UID <500Quiet account required pam_permit.so account required pam_tally2.so add a line password requisit E pam_cracklib.so Try_first_pass Retry=3Password sufficient pam_unix.so MD5 shadow Nullok try_first_pass use_authtok password required Pam_den y.so Session OPTIONAL Pam_keyinit.so REVOKE session required pam_limits.so session [Success=1default=ignore] pam_succeed_if.so ServiceinchCrond Quiet Use_uid session required pam_unix.so

2. Recommended Sshtest account for password error login verification. View Tail/var/log/secure |grep sshtest Records:

 for sshtest from 192.168.40.130 Port 5399515:21:17 SN524 sshd[4900]: pam_tally (sshd:auth): User Ssht EST (503) Tally 7, deny 3 for the sshtest from 192.168.40.130 Port 5399522 15: 22:05 SN524 sshd[4906]: Pam_unix (Sshd:auth): Authentication failure; Logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.40.130  user=sshtest

The account is locked, unable to log on, wait 5 minutes before you can log in again.

3, prohibit the root through SSH remote login vi/etc/ssh/sshd_config find Permitrootlogin, will change the following yes to No, the previous comment # canceled, so root can not telnet! You can log in with a regular account and use the command SU root to switch to the root account when you use root ===================================================================== ==4, restricting the user's SSH access assumes that we only Root,user1 and User2 users can use the system via SSH, add vi/etc/ssh/sshd_configallowusers to the Sshd_config configuration file Rootuser1user2=======================================================================5, Configure idle time-out interval the user can log on to the server via SSH, and you can set an idle time-out interval. Open the Sshd_config configuration file, set as follows. Vi/etc/ssh/sshd_configclientaliveinterval 600ClientAliveCountMax 0 The above example sets the idle time-out interval to 600 seconds, or 10 minutes, after this time, Idle users will be kicked out automatically (can be understood as log out/logout). =======================================================================6, limit only one IP to telnet to server Vi/etc/hosts.deny # Add Sshd:allvi/etc/hosts.allow #在其中进行如下设置: sshd:192.168.1.1 # (only allow 192.168.1.1 this IP Telnet server) and finally restart the SSH service:/etc/init.d/ sshd restart

Go Cento limit SSH login times