Security Enhancement measure using Openssh to build a security network (1)

Implementation steps:
On each server
1. install the software package:

openssh-3.4pl-sol7-sparc-localopenssl-0.96d-sol7-sparc-localzlib-1.1.4-sol7-sparc-localprngd-0.0.25-sol7-sparc-localegd-0.8-sol7-sparc-local

2. Install the prngd and sshd startup scripts

::::::::::::::S98prngd::::::::::::::#!/bin/shpid=`/usr/bin/ps -e | /usr/bin/grep prngd | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'`case $1 in'start')/usr/local/sbin/prngd /var/spool/prngd/pool;;'stop')if [ "${pid}" != "" ]then/usr/bin/kill ${pid}fi;;*)echo "usage: /etc/init.d/prngd {start|stop}";;esac::::::::::::::S98sshd::::::::::::::#!/bin/shpid=`/usr/bin/ps -e | /usr/bin/grep sshd | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'`case $1 in'start')/usr/local/sbin/sshd;;'stop')if [ "${pid}" != "" ]then/usr/bin/kill ${pid}fi;;*)echo "usage: /etc/init.d/sshd {start|stop}";;esac

3. Use prngd to generate Pseudo-Random Initial Seeds

cat /var/log/syslog /var/adm/messages > /usr/local/etc/prngd/prngd-seedmkdir /var/spool/prngd/etc/rc2.d/S98prngd start

Check whether prngd works properly:/usr/local/bin/egc. pl/var/spool/prngd/pool get
Shown as: 9151 bits of entropy in pool
4. added the sshd user

mkdir /var/emptychown root /var/emptychgrp sys /var/emptychmod 755 /var/emptygroupadd sshduseradd –g sshd –c ‘sshd privsep’ –d /var/empty –s /bin/false sshd

5. Modify the tcpd control file/etc/hosts. allow and/etc/hosts. deny.
ALL: n. n # logon Host IP Address
6. Create a host key pair on the server

Ssh-keygen-t rsa1-f/usr/local/etc/ssh_host_key-N "" ssh-keygen-t dsa-f/usr/local/etc/ssh_host_dsa_key-N "" ssh-keygen-t rsa-f/usr/local/etc/ssh_host_rsa_key-N "" Start sshd: /etc/rc2.d/S98sshd start

7. Disable the original telnet and ftp services
Modify the/etc/inetd. conf file and kill-HUP <inetd pid> to disable telnet and ftp services.
8. perform the following tests on the client
UNIX client:
Ssh [-l username] [-p port] Sftp [-l username] [-p port] WINDOWS: Client
Securecrt 3.4.5 // In session configuration, authentication uses the password method
Securefx2.0.3
The above is the default installation, that is, SSH password verification.
In order to ensure the security of the only Login server, and not to restart the process after the sshd configuration is modified, it will cause the problem of Logon management failure. continue to use the telnet and ftp services, in combination with the SSHD key verification method, and in/etc/hosts. make the following settings in the allow file:

################# internal network ######################ALL:n.n.n.n #operator1ALL:n.n.n.n #operator2################## out network ###########################sshd: ALL #RSA auth

In this way, the administrator can easily log on to the host using the company's fixed IP address. If the IP address is not fixed at home or on a business trip, you can log on through sshd key verification.