In the remote management of the Linux system is basically used to SSH, the reason is simple: Telnet, FTP and other transmission methods are in clear text transmission of user authentication information, is inherently unsafe, there is the risk of network eavesdropping. Secure Shell is now more reliable and is a protocol designed to provide security for Telnet sessions and other network services. The SSH protocol can effectively prevent the information leakage in the remote management process, through SSH can encrypt all the transmitted data, also can prevent DNS spoofing and IP spoofing.
Ssh_config and Sshd_config are both configuration files for the SSH server, the difference being that the former is a client-side configuration file, and the latter is a configuration file for the service end. Two profiles allow you to change the way the client program runs by setting different options. Listed below are two of the most important keywords in the configuration file, each behavior "keyword & value" form, where "keywords" is ignored case. 1. Edit the/etc/ssh/ssh_config file
# Site-wide defaults for various options
Host *
Forwardagent No
ForwardX11 No
Rhostsauthentication No
Rhostsrsaauthentication No
Rsaauthentication Yes
Passwordauthentication Yes
Fallbacktorsh No
Usersh No
Batchmode No
Checkhostip Yes
Stricthostkeychecking No
Identityfile ~/.ssh/identity
Port 22
Cipher Blowfish
Escapechar ~ |
The above option parameters are explained on a case-by-case basis:
# Site-wide defaults for various options
With "#" indicates that the sentence is not annotated, the sentence is not part of the original configuration file, intended to indicate that the following options are the system's initial default options. Note that there are also many options in the actual configuration file preceded by a "#" comment, although the indication does not work, in fact, this is the system default initialization settings.
Host *
"Host" is valid only for computers that match the following string, and "*" indicates all computers. As you can see from the front of the item format, this is a global-like option that indicates that the options below indent apply to this setting, and you can specify that a computer replaces the * number so that the following options are only available for that machine.
Forwardagent No
"Forwardagent" Sets whether the connection is forwarded to the remote computer through the authentication agent (if present).
ForwardX11 No
"ForwardX11" sets whether the X11 connection is automatically redirected to a secure channel and display set.
Rhostsauthentication No
The "rhostsauthentication" setting uses rhosts-based security authentication.
Rhostsrsaauthentication No
The "rhostsrsaauthentication" setting uses rhosts-based security authentication with the RSA algorithm.
rsaauthentication Yes
The "rsaauthentication" setting uses the RSA algorithm for security verification.
passwordauthentication Yes
The "passwordauthentication" Setting uses password authentication.
Fallbacktorsh No
"Fallbacktorsh" Setting this option should be set to "no" if an error with SSH connection is automatically using RSH because RSH is not secure.
Usersh No
The "Usersh" setting uses "Rlogin/rsh" on this computer for the same reason that is set to "no".
Batchmode No
"Batchmode": Batch mode, generally set to "no", if set to "yes", interactive input password prompt will be banned, this option is useful for script files and batch processing tasks.
Checkhostip Yes
"Checkhostip" sets whether SSH views the IP address of the host connected to the server to prevent DNS spoofing. The recommended setting is "yes".
stricthostkeychecking No
"Stricthostkeychecking" If set to "Yes", SSH will not automatically add the computer's key to the "$HOME/.ssh/known_hosts" file, and once the computer's key has changed, refused to connect.
Identityfile ~/.ssh/identity
The "Identityfile" setting reads the user's RSA Security authentication identity.
Port 22
"Port" sets the port to connect to the remote host, and the SSH default port is 22.
Cipher Blowfish
"Cipher" Set the encryption key, Blowfish can be set freely.
Escapechar ~
"Escapechar" sets the escape character. 2. Edit the/etc/ssh/sshd_config file:
# This is the SSH server systemwide configuration file.
Port 22
ListenAddress 192.168.1.1
Hostkey/etc/ssh/ssh_host_key
Serverkeybits 1024
Logingracetime 600
Keyregenerationinterval 3600
Permitrootlogin No
Ignorerhosts Yes
Ignoreuserknownhosts Yes
Strictmodes Yes
X11forwarding No
PRINTMOTD Yes
Syslogfacility AUTH
LogLevel INFO
Rhostsauthentication No
Rhostsrsaauthentication No
Rsaauthentication Yes
Passwordauthentication Yes
Permitemptypasswords No
Allowusers Admin |
The following line shows the option settings above:
Port 22
"Port" sets the port number of the sshd listener.
listenaddress 192.168.1.1
"ListenAddress" sets the IP address of the SSHD server binding.
Hostkey/etc/ssh/ssh_host_key
"Hostkey" Sets the file that contains the computer's private key.
serverkeybits 1024
"Serverkeybits" defines the number of bits of the server key.
Logingracetime 600
"Logingracetime" Sets the time, in seconds, that the server waits before disconnecting the connection if the user cannot log on successfully.
Keyregenerationinterval 3600
"Keyregenerationinterval" sets the number of seconds after which the server's key is automatically regenerated (if the key is used). The rekey is regenerated to prevent the intercepted information from being decrypted with the stolen key.
Permitrootlogin No
The "Permitrootlogin" setting allows root login via SSH. This option should be set to "no" from a security standpoint.
ignorerhosts Yes
The "ignorerhosts" setting verifies whether the "rhosts" and "shosts" files are used.
ignoreuserknownhosts Yes
"Ignoreuserknownhosts" sets whether SSH daemon ignores the user's "$HOME/.ssh/known_hosts" when Rhostsrsaauthentication security authentication is performed
Strictmodes Yes
"Strictmodes" Sets whether SSH checks the permissions and ownership of the user home directory and the rhosts file before receiving the logon request. This is usually necessary because novices often set their own directories and files to anyone with write access.
x11forwarding No
The "x11forwarding" setting allows X11 forwarding.
PRINTMOTD Yes
"PRINTMOTD" Sets whether sshd displays the information in "/ETC/MOTD" when the user logs in.
syslogfacility AUTH
"Syslogfacility" sets whether "facility code" is given when recording messages from Sshd.
LogLevel INFO
The "LogLevel" setting records the level of the SSHD log message. Info is a good choice. See the man help page for sshd for more information.
Rhostsauthentication No
The "rhostsauthentication" setting is sufficient for security verification only with rhosts or "/etc/hosts.equiv".
Rhostsrsaauthentication No
The "Rhostsrsa" setting allows for security verification with RSA or "/etc/hosts.equiv" with rhosts.
rsaauthentication Yes
The "rsaauthentication" setting allows only RSA security authentication.
passwordauthentication Yes
The "passwordauthentication" setting allows password validation.
Permitemptypasswords No
The "Permitemptypasswords" setting allows you to log in with an account with a blank password.
allowusers Admin
The "Allowusers" can be followed by any number of user names that match the string, separated by spaces. The host name can be a domain name or an IP address.
Linux ssh_config and Sshd_config configuration files
