SSH Server Configuration

Basically, all the detailed settings of the sshd server are placed in/Etc/ssh/sshd_configInside! However, the preset settings for each Linux distribution are not the same, so it is necessary to understand the meaning of the entire set value! Note that, in the preset file,As long as it is the preset value that appears and is annotated (add # before the set value), it is the "Default Value !』You can modify it based on it.

[Root @ WWW ~] # Vim/etc/ssh/sshd_config  #  1. The overall settings of the SSH server include the port used and the password calculation method used.  #  Port 22  #  SSH uses the 22 port by default, or multiple ports, that is, the port setting item is reused!  #  For example, if you want to open sshd in 22 and 443, add one more line: "port 443 』 #  Then Restart sshd! However, it is not recommended to modify the port number!  Protocol 2 #  The selected SSH protocol version can be 1 or 2, and centos 5.x supports only V2 by default.  #  To support earlier versions of V1, you must use "protocol.  #  Listenaddress 0.0.0.0  #  Host adapter of the listener! For example, if you have two IP addresses: 192.168.1.100 and  #  192.168.100.254. If you only want 192.168.1.100 to listen to sshd, write as follows:  # The default value of "listenaddress 192.168.1.100" is the SSH requirement for listening to all interfaces.  #  Pidfile/var/run/sshd. PID  #  You can store the sshd PID file! The above is the default value.  #  Logingracetime 2 m  #  After the user connects to the SSH server, the user enters the password,  #  How long will it take to force a disconnection if the SSH server is not connected successfully! If no unit exists, the default time is second!  #  Compression delayed  # Specifies when to start transmission in compressed data mode. Yes, NO and the data is compressed (delayed) only after login)  #  2. Describe the files placed by the private key of the host. You can use the following files by default!  #  Hostkey/etc/ssh/ssh_host_key # private key used by SSH version 1  #  Hostkey/etc/ssh/ssh_host_rsa_key # RSA private key used by SSH Version 2  #  Hostkey/etc/ssh/ssh_host_dsa_key # DSA private key used by SSH Version 2  #  Remember what we talked about in the host's SSH online process. Here is the host key ~  # 3. Information about the logon file is stored with the daemon name!  Syslogfacility authpriv  #  When someone uses SSH to log on to the system, SSH will record the information, which is the daemon name  #  Bottom? The default value is set by auth, that is, in/var/log/secure! What? Forgot!  #  Go back to the Linux basics. Other available daemon names are daemon, user, auth,  #  Local0, local1, local2, local3, local4, local5,  #  Loglevel info  # Logon record level! Hey! Any message! Similarly, if you forget it, go back to the reference!  #  4. Security Settings! Very important!  #  4.1 Logon Settings  #  Permitrootlogin Yes  #  Allow root login! The default value is allowed, but it is recommended to set it to no!  #  Strictmodes Yes  #  Whether to have sshd check the permission data of the user's home directory or related files,  #  This is to worry that users may set the permissions of some important files incorrectly, which may cause some problems. #  For example, the user's ~. When the ssh/permission is set incorrectly, users are not allowed to log on in some special circumstances.  #  Pubkeyauthentication Yes  #  Authorizedkeysfile. Ssh/authorized_keys  #  Whether to allow users to log on to the pair key system on their own, only for version 2.  #  The self-made public key data is stored in. Ssh/authorized_keys in the user's home directory.  Passwordauthentication Yes  #  Password verification is required! So here, write yes!  # Permitemptypasswords No  #  If the above item is set to yes, it is better to set it to No,  #  Whether an empty password is allowed to log on to this project! Of course not!  #  4.2 Certification  #  RhostsAuthentication No  #  The local system does not use. rhosts, because it is too insecure to use. rhosts only, so it must be set to no  #  IgnoreRhosts Yes  #  Cancel use ~ /. Ssh/. rhosts for authentication! Of course! #  RhostsRSAAuthentication no #  #  This option is specifically used for Version 1. Use the rhosts File in/etc/hosts. equiv  #  Use the RSA Algorithm for authentication! Don't use it!  #  Hostbasedauthentication No  #  This project is similar to the above project, but it is for version 2!  #  Ignoreuserknownhosts No  #  Ignore ~ in the Home Directory ~ /. Ssh/known_hosts the host content recorded in this file? #  Of course, do not ignore it, so here is no!  Challengeresponseauthentication No  #  Allow any password authentication! Therefore, any authentication method specified by login. conf can be applied!  #  However, we prefer to use the PAM module to manage authentication, so this option can be set to no!  Usepam Yes  #  Using Pam to manage user authentication has many advantages that can be recorded and managed.  #  Therefore, we recommend that you use usepam and set challengeresponseauthentication to No.  # 4.3 Kerberos-related parameter settings! Because we do not have a Kerberos host, we do not need to set it below!  #  Kerberosauthentication No  #  Kerberosorlocalpasswd Yes  #  Restore osticketcleanup Yes  #  KerberosTgtPassing No  #  The following figure shows the settings used under X-window!  X11forwarding Yes  #  X11displayoffset 10 #  X11uselocalhost Yes  #  More importantly, the x11forwarding project allows window data to be transmitted through the SSH channel!  #  Later in this chapter, we will discuss more advanced SSH usage methods.  #  4.5 after login, the following items are displayed:  #  Printmotd Yes  #  Is there any information displayed after login? For example, the time and location of the Last login are set to yes.  #  That is, print the content of the/etc/motd file. However, you can change it to no for security purposes!  # Printlastlog Yes  #  Displays the information of the last logon! Yes! Yes, too!  #  Tcpkeepalive Yes  #  When the connection is established, the server will always send TCP packets to the client to determine whether the correct method is always online.  #  However, if the intermediate router temporarily stops the service for several seconds during the online operation, it will also interrupt the online operation!  #  In this case, SSH can immediately know when any end is dead! No botnetsProgramOccurred!  #  But if your network or router is often unstable, you can set it to no!  Useprivilegeseparation Yes #  Whether a program with lower permissions provides user operations. We know that sshd is started at port 22,  #  Therefore, the started program belongs to the root identity. After student logs in, this setting value  #  Sshd will generate a sshd program belonging to the sudent for use, which is safer for the system.  Maxstartups 10 #  How many online images are allowed at the same time? When we connect to SSH without entering the password,  #  This is what we call online images! To protect the host,  #  Therefore, you need to set the maximum value. A maximum of ten online images can be preset, but those that have already been established online are not counted in these 10 images.  # 4.6 set items for user resistance: Denyusers * #  Set the name of the user to be blocked. If it is all users, it is all blocked!  #  For some users, enter this account! For example!  Denyusers testdenygroups Test  #  Same as denyusers! Only a few groups are supported!  #  5. About SFTP and other configuration items! Subsystem SFTP/usr/lib/ssh/SFTP- Server  #  Usedns Yes  # Generally, in order to determine whether the client source is normal and valid, DNS is used to check the host name of the client.  #  However, if you are connecting to the Intranet, setting this item to no will make the online connection faster. 

The preset sshd service is safe, but it is not enough!We recommend that you (1) cancel the root logon permission; (2) set the SSH version to 2.. Set other values according to your preferences. It is generally not recommended to make any changes! In addition, if you have modified the file above (/etc/ssh/sshd_config), you must restart the sshd daemon once! That is:

 
/Etc/init. d/sshd restart