It is estimated that it was attacked. After a holiday, ssh could not be connected. The remote connection prompt "Network refused" is displayed. You can only go to the data center to check the details. First, you can use the following methods:
In Linux, the default port 22 of SSH is modified as follows:
No 1:
01 if you want to change the SSH default port (22), you only need to modify port 22 in/etc/ssh/sshd_config. Here, change 22 to the port you want to set, but do not set the same port as the existing port to avoid unknown consequences.
02 if you want to restrict the SSH Login IP address, you can do the following:
First: Modify/etc/hosts. Deny and add sshd: All
Then, modify:/etc/hosts. Allow and set sshd: 192.168.0.241 as follows:
In this way, only the IP address 192.168.0.241 can be bound to log on to the Linux machine through SSH. Of course, as a server, I do not install gnome or Kde, and many things do not, which increases the security factor.
No 2:
First, modify the configuration file.
VI/etc/ssh/sshd_config
Find the section # port 22, which indicates that port 22 is used by default and changed to the following:
Port 22
Port 2222
Save and exit
Run/etc/init. d/sshd restart
In this way, the ssh port will work on both 22 and 999.
Now edit the firewall configuration: VI/etc/sysconfig/iptables
Port 999 is enabled.
Run/etc/init. d/iptables restart
Now, use the SSH tool to connect to port 999 to test whether the connection is successful. If the connection is successful, edit the settings of sshd_config again and delete port22.
The reason for setting two ports first and then disabling one after the test is successful is to prevent unknown situations such as disconnection, network disconnection, and misoperation during the conf modification process, you can also connect to the debugging through another port to avoid the need to send people to the data center if the connection fails, making the problem more complicated and troublesome.
I used the second method, and then restarted. The result is unfortunately failed, and the prompt is:
Start: sshd: Missing Privilege Separation Directory:/var/empty/sshd [failed]
The prompt probably means the permission issue.
Check the permission of the empty folder in/var/empty and set it
Root @ localhost> # chown root. Root/var/empty
Change the permission Representation
Drwxr-XR-x 2 root Root empty
(The article on the network prompts that there should be nothing in the emtpy folder, so) I think there is no problem now, restart
Root @ localhost> #/etc/init. d/sshd restart
As a result, the startup fails. Find the/var/empty folder, and only the X. PID file is displayed, but no sshd is displayed.
Root @ localhost> # mkdir sshd
Restart the sshd service to solve the problem.
Root @ localhost> # NMAP-V target.example.com
Check whether the ssh port is enabled on the local port.
I was depressed for a long time, and I still couldn't find it on the Internet. Sometimes I caught a glimpse of a question and no answer. Why is the sshd service suddenly stopped? The specific reason is still being verified. If anyone knows, please reply to me. Thank you very much!
