Small and Medium-Sized Enterprise Server ssh Management

Source: Internet
Author: User
Tags ssh port

The manager asked me to plan the company's ssh management for the ssh Management of Small and Medium-Sized Enterprise Servers. I used to use passwords. Now I want to use keys, which are easy to manage and secure. So I have the following plan: 1. expose the ssh service of server Pb1 to the public network as the stepping stone, and change the ssh port to 288882. the Pb1 authentication method is changed to the key authentication method, and password authentication is disabled. for other servers such as server 1, except for the Pb1 Server ip address, ssh is allowed. Password Authentication is disabled. The default port is 22. generate an ssh key pair on Pb1 and upload the user's public key to other servers. To connect to other servers, you must first connect to Pb1 and then jump to pb1. see

Operation Procedure: Take the user root as an example. Assume that Pb1: server1: and other users perform the same operations on 1. generate a key pair in xshell in tools. The steps are not detailed. Copy the public key to the Pb1 root directory. mkdir ~ in authorized_keys under ssh ~ /. Ssh vi ~ /. Ssh/authorized_keys ssh-dss logs/SafTyWZgH41gP9U/sfqns1_n4xrdohnda0cgzo/0y0OLP + BoG/samples + samples/logs/h4lzV4q9pqN3FkyS/logs D + iEfw5qawYDG8H1XD2/release + 3r7 + IU3Yvvya0P24TZPNhuiwIlU/w ==## this is generated by xshell and copied 2. edit/etc/ssh/sshd_config in Pb1 and change the port to 28888. Disable password authentication in code authentication vi/etc/ssh/sshd_configPort 28888 PasswordAuthentication no Service sshd restart 3. connect to Pb1 to test whether ssh 4 can be normally connected. generate password on Pb1 Key pair, and copy it to the server 1 ssh-keygen-t rsa-P ""-f ~ /. Ssh/id_rsa ssh-copy-id-I ~ /. Ssh/ ssh-copy-id-I ~ /. Ssh/ other server IP address 5. connect to server1 on Pb1 and test whether the connection is successful. ssh 6. disable server1 .. add iptables for Password Authentication in serverN and test vi/etc/ssh/sshd_config PasswordAuthentication no service sshd restart iptables-a input-p tcp-s again! -- dport 22-j DROP or vi/etc/hosts. allow sshd: vi/etc/hosts. deny sshd: ALL to prevent other servers from being normally connected after pb1 fails, it is recommended to set another server that is not in the same network or region for backup. Pb1 Script :#! /Bin/bash # Author: LaoGuang # Script Name: Pb. sh # # Description: # Set ssh Middle Server serverip = "" # one or some ip port = 28888 # Modify port and Authenticationsed-I's /#\? Port. */Port 28888/'/etc/ssh/sshd_config sed-I's/PasswordAuthentication yes/PasswordAuthentication no/'/etc/ssh/sshd_config service sshd restart &>/dev/null # Transfer keyif! [-E ~ /. Ssh/] & [-e ~ /. Ssh/id_rsa]; then ssh-keygen-t rsa-P ""-f ~ /. Ssh/id_rsa &>/dev/null fi for I in $ serverip do ssh-copy-id-I ~ /. Ssh/ $ I &>/dev/null # This is actually not well written. There are also ssh $ I "echo: $ I success" done Server script :#! /Bin/bash # Author: LaoGuang # Script Name: server. sh # # Description: # Set ssh Servers sed-I's/PasswordAuthentication yes/PasswordAuthentication no/'/etc/ssh/sshd_config service sshd restart &>/dev/null iptables-A INPUT-p tcp- s! -- dport 22-j DROP

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.