Server security specifications and server specifications

Server security specifications and server specifications

Ssh login verification: public key and Google Authentication

Server Configuration File

Port 3208 Protocol 2 ListenAddress already exists when there is no # Whether to automatically destroy the user creden cache after the user logs out. yesUsePAM yesAcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME when using LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENTAcceptEnv LC_IDENTIFICATION LC_ALLX11Forwarding noUseDNS noClientAliveInterval 60 Subsystem sftp/usr/libexec/openssh/sftp-server

　　

Client configuration file

Port 3208Protocol 2ListenAddress ipSyslogFacility AUTHPRIVPermitRootLogin noPermitEmptyPasswords noPasswordAuthentication yesChallengeResponseAuthentication noGSSAPIAuthentication noGSSAPICleanupCredentials yesUsePAM yesAcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGESAcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENTAcceptEnv LC_IDENTIFICATION LC_ALLX11Forwarding noUseDNS noClientAliveInterval 60Subsystem       sftp    /usr/libexec/openssh/sftp-server

　　

1. Generate public and private keys

Ssh-keygen-t rsaGenerating public/private rsa key pair. enter file in which to save the key (/home/client /. ssh/id_rsa): # Press enter to create directory '/home/client /. ssh '. enter passphrase (empty for no passphrase): # Press Enter to Enter same passphrase again: # Press Enter here to go to Your identification has been saved in/home/client /. ssh/id_rsa.Your public key has been saved in/home/client /. ssh/id_rsa.pub.

　　

2. append the public key file to./ssh/authorized_keys in the user directory on the server. The. ssh directory permission must be 0700

cat id_rsa.pub >> authorized_keyschmod 600 authorized_keys

　　

3. logon without a password on the server and client

Scp. /id_rsa.pub sweet@192.168.1.101:/home/sweet /. ssh/authorized_keys # note that the authorized_keys permission of the target machine is-rw-r --. If you do not need to execute chmod 644 authorized_keys to modify the File Permission

　　

Google validators

Install GOOGLE-AUTHENTICATOR validators 1. install epel source rpm-ivh plugin install-y git qrencode3. install the Development Kit tool yum groupinstall-y "Development Tools" pam-devel4. install google-authenticatorgit clone https://github.com/google/google-authenticator.gitcd google-authenticator/libpam/sh bootstrap. sh. /configure & make installcp-v/usr/local/lib/s Ecurity/pam_google_authenticator.so/lib64/security/5. generate a count-based authentication token (time error can be ignored) google-authenticator (n, y) 6. modify the ssh pam settings # modify PAMvi/etc/pam. d/sshdauth required pam_google_authenticator.so # modify the SSH configuration ChallengeResponseAuthentication yesUsePAM yesservice sshd restart to modify the ssh Authentication Mode and change it to keyboard interaction. Note: The emergency verification code should be recorded here to prevent login failure after verification is broken. You can also download the ssh Public Key for backup login.