Centos SSH installation and configuration

Sshlinux
SSH is short for Secure Shell, developed by the Network Working Group of IETF. SSH is a security protocol built on the application layer and transport layer.

Traditional network service programs, such as FTP, pop, and telnet, are inherently insecure because they transmit data, user accounts, and user passwords in plaintext over the network, attackers are vulnerable to man-in-the-middle attacks. There is another person or a machine impersonating a Real Server to receive data from the user to the server, and then impersonating the user to pass the data to the Real Server.

SSH is a reliable protocol designed for remote logon sessions and other network services. The SSH protocol can effectively prevent information leakage during Remote Management. SSH can be used to encrypt all transmitted data and prevent DNS Spoofing and IP spoofing.

System and version: centos release 5.3 (final)

Install SSH

    yum install ssh

Start SSH

    service sshd start

Set startup

    chkconfig sshd on

Modify ssh-related configuration files

First, modify the SSH configuration file. As follows:

    [[email protected] ~]# vi /etc/ssh/sshd_config

Using VI to open the SSH configuration file


# Protocol locate this row and delete the line header "#". Then, delete ", 1" at the end of the line, and only allow connections in SSH2 mode.
Bytes
The Protocol 2 protocol changes to this status after modification. Only SSH2 is used.

# Serverkeybits 768 rows find this line, remove "#" at the beginning of the line, and change 768 to 1024
Bytes
Changed serverkeybits 1024 bytes to this status, and changed the serverkey strength to 1024 bits.

# Permitrootlogin Yes locate this line, remove "#" at the beginning of the line, and change "yes" to "no ".
Bytes
Permitrootlogin no logs is changed to this status and cannot be logged on using root.

# Passwordauthentication Yes locate this line and change Yes to no
Bytes
Passwordauthentication No. login is changed to this status, and password-based logon is not allowed.

# Permitemptypasswords no longer find this row and delete the line header "#". Empty Password Logon is not allowed.
Bytes
Permitemptypasswords No. Changed to this status. Do not log on with a blank password.

Save and exit. (The command for saving and exiting VI is ZZ)

Because we only want to make the SSH service more convenient for the management system, we only allow the Intranet client to log on to the server through SSH without Remotely Managing the system over the Internet, to minimize unsafe factors. The setting method is as follows:

    [[email protected] ~]# vi /etc/hosts.deny

Modify the blocking rule and add corresponding lines at the end of the text.


#
# Hosts. deny this file describes the names of the hosts which are
# ** Not * allowed to use the local Inet services, as decided
# By the '/usr/sbin/tcpd' server.
#
# The Portmap line is redundant, but it is left to remind you that
# The New Secure Portmap uses hosts. Deny and hosts. Allow. In particle
# You shoshould know that NFS uses Portmap!
Sshd: all clients add this line to shield all SSH connection requests.

    [[email protected] ~]# vi /etc/hosts.allow

Allow rules to be modified, and add corresponding lines at the end of the text

#
# Hosts. Allow this file describes the names of the hosts which are
# Allowed to use the local Inet services, as decided
# By the '/usr/sbin/tcpd' server.
#

Sshd: 192.168.0. Allow add this line, only allow SSH connection requests from the Intranet



Restart SSH
After modifying the SSH configuration file, you must restart the SSH service to make the new settings take effect.

    [[email protected] ~]# /etc/rc.d/init.d/sshd restart

Restart the SSH server


Stopping sshd: [OK]
Starting sshd: [OK] the restart SSH server is successfully restarted.

At this time, on the remote terminal (Personal PC, etc.), you cannot log on to the server by using the SSH client software with a normal password. In order for the customer to log on to the server, we will create a public key and private key for SSH to log on to the SSH server as a "key" for the client.

Establishment of the public key and private key of SSH2
Logon is a general user who establishes a public key and a private key based on this user. (The following uses the centospub user as an example)

    [[email protected] ~]# su – centospub

Login: centospub


[Centospub @ sample ~] $ Ssh-keygen-t rsa keystore creates a public key and a private key
Generating public/private RSA key pair.
Enter file in which to save the key (/home/KAZ/. Ssh/id_rsa): the name of the keystore key file. Press enter by default.
Created directory '/home/KAZ/. Ssh'
Enter passphrase (empty for no passphrase): enter your password
Enter same passphrase again: enter the password again
Your identification has been saved in/home/KAZ/. Ssh/id_rsa.
Your public key has been saved in/home/KAZ/. Ssh/id_rsa.pub.
The key fingerprint is:
TF: RS: E3: 7 S: 28: 59: 5 S: 93: Fe: 33: 84: 01: CJ: 65: 3B: 8e [email protected]

Then confirm the establishment of the public key and the key, and some processing corresponding to the client.

    [[email protected] ~]$ cd ~/.ssh

Secret to enter the directory of the user's SSH configuration file

    [[email protected] .ssh]$ ls -l

Listing objects
Total 16
-RW --- 1 centospub 951 Sep 4 id_rsa keys confirm that the private key has been created
-RW-r-1 centospub 241 Sep 4 id_rsa.pub secret confirm that the public key has been created

    [[email protected] .ssh]$ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

The contents of the ← Public Key are output to the corresponding file.

         [[email protected] .ssh]$ rm -f ~/.ssh/id_rsa.pub

← Delete the original public key file

    [[email protected] .ssh]$ chmod 400 ~/.ssh/authorized_keys　

Secret sets the attribute of the new public key file to 400

Then, the private key is securely transferred to the PC on which you want to connect to the server through SSH. The following uses a 3.5-inch disk as the media:

 

   [email protected] .ssh]$ exit 　

Quit)

    [[email protected] ~]# mount /mnt/floppy/

← Attach a floppy disk drive

 

   [[email protected] ~]# mv /home/centospub/.ssh/id_rsa /mnt/floppy/

← Move the created private key to a floppy disk

    [[email protected] ~]# umount /mnt/floppy/

← Detach a floppy disk drive

Centos SSH installation and configuration