first, close the SSH password login
First of all, you need to have your own SSH Key, if you use Windows system, you can use Putty under the PUTTYGEN. EXE generates a private key and a public key.
The first step is to run PUTTYGEN. Exe
In general, we choose the default RSA encryption, the default 1024-bit encryption is sufficient, if you want to secure points, you can choose 2048 or 4,096-bit encryption, red circle:
The second step, click Generate, then the mouse to move around in the blank space
When the progress bar is full, create your SSH Key:
If you want to be more secure, you can set the key Passphrase, which is the password, this password and root password is different, once someone gets your key, without the password he will not be able to load your key.
The third step, click Save Public Key to store your keys, the entire file as follows
----BEGIN SSH2 public KEY----Comment: "showfom-rsa-key-20130701" aaaab3nzac1yc2eaaaabjqaaaqeana/ d52ftz1ynjxnwajauhxrdpcwar8zfwldwhemt64zqtxrz65krxeshfrvnd8xn1gktuqiqmu/d5ffheajfbjosw/n+mz58irzuxdbe34y/nxy1/ iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+ hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+ s3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq==----END SSH2 public KEY----
One of the middle so long a string, is your public key, you can put in the server ~/.ssh/authorized_keys, we should take the following format:
Ssh-rsa aaaab3nzac1yc2eaaaabjqaaaqeana/d52ftz1ynjxnwajauhxrdpcwar8zfwldwhemt64zqtxrz65krxeshfrvnd8xn1gktuqiqmu/ d5ffheajfbjosw/n+mz58irzuxdbe34y/nxy1/iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+ hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+ s3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq== showfom-rsa-key-20130701
Where Ssh-rsa is the type of encryption, showfom-rsa-key-20130701 is a description and can be any text, such as Showfom-notebook
Fourth step, click Save Private key to generate the private key for Putty, here we save as SHOWFOM.PPK, the entire file as follows
Putty-user-key-file-2: Ssh-rsaencryption:nonecomment:showfompublic-lines: 4aaaab3nzac1yc2eaaaabjqaaaibtill54roaeekv95vkr6iez9y0d1ipnnqeyk+ eyhptc7jvtmfl0oiho9s2uqquangmlmzljhxrj3cpz1vzinpfqvtgwykwpepgckgi7/ itpnuuz6tkguei5ryaetfgkwf13qc5s8dwlk2fgv7dy5gbsozmhztc+ztl9jpnnca5nw==private-lines:8aaaagewly9tssiciztupywe/ eegd+kh/pbpsunug6mnoaen8ocd5ctsz2ki9lukwgspx0j8f+kmuzu62eikhalgzz+ Nvyklche7qfo2aymcuniuym0mgdn5gjxubfduvvtjiaywd282yo0xtjpwn0djf3jmmsrw6pwmwaa6r6palkantaaaaqqclyrycu3eu0gcgw9g2mvlizohokyp l2e6hjfpqhvsze6akuzptf/dgmkbfy6dh//0zsohue2jngnsalqygbvt/ Aaaaqqcargnl76exhtr28try2pong8ij3yn9mczyg3sdsv8fegakryz8t5b6xzuf9uyvz1lia10i7ulz63s2hvczuxthaaaaqd+ Auxn8fuaylroh8ztm14fyy7grwdn7y7+etz8nuvdlvzp9svpd4v5ti9lpqjtiucp0eelcd5i7zxyv2oheu78=private-mac: ce0968aff198e2c2550704625b23ba7575e6b260
This showfom.ppk you need to pass the Putty directory under the pageant. EXE, so you can login to your VPS without having to enter the root password.
SSH keys for PS:WINSCP and Putty are generic and only need to be imported once.
But Putty Private Key is not standard, can only be used for Putty or WinSCP, if you use Xshell 4, you need to convert to RSA file, can be in PUTTYGEN. EXE in the menu above the Conversions > Export OpenSSH Key mode conversion.
Fifth step, import your Linux VPS or server
If you are local to a Linux desktop environment, it can be done with a simple command:
Ssh-copy-id-i ~/.ssh/id_rsa.pub [email protected]
But most of the users are still Windows users, so I suggest two more simple ways
1. Put your own public key on the https://launchpad.net/website and get an address like Https://launchpad.net/~showfom/+sshkeys, then import your key via the following command
Curl Https://launchpad.net/~showfom/+sshkeys > ~/.ssh/authorized_keys
If you do not have an. SSH directory, you can create a new
mkdir. SSH
2, can also write directly to the Authorized_keys file
Cat >>/root/.ssh/authorized_keys<<eofssh-rsa aaaab3nzac1yc2eaaaabjqaaaqeana/ d52ftz1ynjxnwajauhxrdpcwar8zfwldwhemt64zqtxrz65krxeshfrvnd8xn1gktuqiqmu/d5ffheajfbjosw/n+mz58irzuxdbe34y/nxy1/ iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+ hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+ s3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq== Showfom-rsa-key-20130701eof
In some service providers of the CentOS system, due to the open SELinux, the default is to prohibit the. SSH directory permissions, you can use the following command to remove the limit:
Restorecon-r-v/root/.ssh
If you encounter Authorized_keys permissions issues, you can use the following command to resolve:
Chattr-i Authorized_keys
You can then reboot to open an SSH window and test if you don't need to enter a password to log in with Root.
Sixth step, close SSH password login
To edit an SSH configuration file:
Vim/etc/ssh/sshd_config
Found it
#PasswordAuthentication Yes
And instead
Passwordauthentication No
Save, exit, restart SSH service
Under Ubuntu:
/etc/init.d/ssh restart
Under CentOS:
Service sshd Restart
OK, so prohibit SSH password landing is done, this step refused 90% of the intrusion risk, of course, your own private key must be preserved, otherwise stolen but do not need a password to be able to enter your server OH.
Second, install the CSF Firewall shield attempt to invade the server's IP
The CSF firewall is simple to install, with a few commands to handle:
RM-FV csf.tgzwget http://www.configserver.com/free/csf.tgztar-xzf csf.tgzcd csfsh install.sh
Then run perl/usr/local/csf/bin/csftest.pl to detect if the installation was successful
To prevent the system from mistakenly masking the local IP, you can modify the/etc/csf/csf.allow and/etc/csf/csf.ignore files to add the whitelist IP you need, and then restart the read configuration file with the Csf-r command.
Third, use iptables only to open the regular port
Generally we only need to open 22, 53, 80, 443 these three common open ports, you can use the following command
Empty iptables Default Rule
Iptables-f
Allow 22 ports to enter and return
Iptables-a input-p TCP--dport 22-j acceptiptables-a output-p TCP--sport 22-m State--state established-j ACCEPT
Allow 53 ports, typically used as DNS service
Iptables-a output-p UDP--dport 53-j acceptiptables-a input-p UDP--sport 53-j ACCEPT
Allow native access to native
Iptables-a input-s 127.0.0.1-d 127.0.0.1-j acceptiptables-a output-s 127.0.0.1-d 127.0.0.1-j ACCEPT
Allows all IP access to 80 and 443 ports, typically for HTTP and HTTPS purposes
Iptables-a input-p tcp-s 0/0--dport 80-j acceptiptables-a output-p TCP--sport 80-m State--state established-j A Cceptiptables-a input-p tcp-s 0/0--dport 443-j acceptiptables-a output-p TCP--sport 443-m State--state ESTABLISH Ed-j ACCEPT
Save Configuration
Iptables-save >/etc/sysconfig/iptables
Reload Iptables
Iptables-l
Iv. Install the Fail2ban Shield and report the IP that scanned the SSH port
There are a lot of energetic guys will scan ssh password all day, of course, directly close SSH password login can prevent, but in order to give them a lesson, can install Fail2ban, shielding, but also can automatically write a report letter to the ISP IP.
Installation under CentOS:
Import Epel Source:
CentOS 6.x 32-bit:
RPM-UVH http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
CentOS 6.x 64-bit:
RPM-UVH http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
Installing Fail2ban
Yum-y Install Fail2bancp/etc/fail2ban/jail.conf/etc/fail2ban/jail.localservice Fail2ban start
Ubuntu/debian under Installation:
Apt-get Install Fail2ban-y
By looking /var/log/fail2ban.log
at the file, you'll know what excess-energy guys are scanning your SSH all day.
Postscript
Because a lot of recent customers VPS or server was hacked, the reason is to use a very simple root password, so consider selling rogue VPS, directly to do a shielded password system, users buy the time to submit their own SSH key, or the system assigned you an SSH key, so it will be more secure 。 The foreign Amazon EC2, Digitalocean, and hpcloud all have the means to import their SSH Key and shield the password by default, which greatly increases the security.
Reprint Please specify: Tsutenkaku tower? Simple security settings After purchasing a Linux VPS server
Simple security settings After purchasing a Linux VPS server