Linux controls sshd Remote Access

Linux controls sshd Remote Access
Test environment: linux centos6.5 1. hosts. allow file configuration: Modify/etc/hosts. allow file # hosts. allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # sshd: 210.13.218. *: allowsshd: 222.77.15. *: The preceding allow statement allows two ip segments 210 and 222 to connect to the sshd service. deny files can be used together), of course, ": allow" can be omitted completely. Of course, if the administrator is concentrated on an IP address, it is easy to write all: 218.24.129.110 // he means to accept all requests from the ip address 110! 2. hosts. deny file configuration/etc/hosts. deny file, which is a denial of service list with the following content: # hosts. deny This file describes the names of the hosts which are # * not * allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts. deny and hosts. allow. in particle # you shoshould know that NFS uses portmap! Sshd: all: deny Note: sshd: all: deny indicates that all sshd remote connections are rejected.: Deny can be omitted. Therefore, when hosts. allow conflicts with host. deny, the hosts. allow setting prevails. The modification takes effect immediately. 3. Expansion: 1. prohibit all ip addresses from accessing the linux ssh function in/etc/hosts. add a row named sshd: all: deny 2. prohibit an ip address (192.168.11.112) from accessing the ssh function in/etc/hosts. add a row of sshd: 192.168.11.112 3. in the/etc/hosts. deny and/etc/hosts. allow also has the sshd: 192.168.11.112 rule, then 192.168.11.112 can access the host's ssh service summary: This method can be used to control some unauthorized access, but it is not a permanent method! When we look at service logs, we may see a lot of scan records, instead of directly targeting the root user. controlling your access list is very helpful!