ssh access control

In linux, root users are prohibited from using ssh to log on and access control over ssh. in Linux, by default, root users can log on through ssh. However, for security reasons, this permission is inappropriate because hackers may crack your root password by brute force and

Detailed SSH remote access control in LinuxOriginal: http://blog.51cto.com/dengqi/1260038SSH: is a secure channel protocol, mainly used to realize the character interface of remote login, and other functions (using TCP port number 22nd). The SSH protocol encrypts the data transmitted by both parties, including the user

password verification and private key verification are enabled, the server will give priority to key verification. SSH configuration file:By default, the configuration file of the sshd service is in/etc/ssh/sshd_config. Correct configuration items can further improve the security of sshd remote logon. The configuration file content can be divided into the following three parts: 1. Common

lifting (alias names must be in uppercase letters)Define user aliasesUser_alias Alias name = List of user namesUser_alias httpusers = Webamdin, webadmin2Define host aliasesHost_alias Alias name = List of host namesHost_alias Mypc=localhost, Host50Defining command aliasesCmnd_alias Alias name = Command ListCmnd_alias software =/bin/rpm,/usr/bin/up2date,/usr/bin/yum+++++++++++++++++++++++Use aliases to raise weightsUser alias name Host alias = command alias nameHttpusers Mypc=software,/usr/bin/sy

:deny7. Continue the "brute force" connection of the server from another terminal window.Look at the blacklist file on the server:[email protected] ~]# cat Black.txt13.26.21.27=6And look at the Hosts.deny on the server.[Email protected] ~]# Cat/etc/hosts.denySshd:13.7.3.6:denySshd:92.4.0.4:denySshd:94.10.4.2:denySshd:94.4.1.6:denySshd:11.64.11.5:denySshd:13.26.21.27:denyIP has been added to the server's Hosts.deny, and then connected to the server with the correct password, is denied:$

LINUX 6--installation SSH remote access control------------------------------------Overview----------------------------------- SSH (secure Shell) is a secure channel protocol, which is mainly used for remote login, remote replication and other functions of character interface. The

, And the refresh speed is slow. AttacK Defense methods: 1. Set firewall rules 1.iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT 2.iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT 3.iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT 2. IP address and IP address segment 1.iptables -I INPUT -s 49.116.15.23 -j DROP # Single IP Address 2.iptables -I INPUT -s 49.116.15.23/32 -j DROP # As with the previous one

then make the following edits:User host name = command file pathExample: Zhangsan rhel6=/sbin/ifconfig gives the user Zhangsan permission to perform/sbin/ifconfig Second, the key pair verification1. Turn on the key pair verification function on the server vim/etc/ssh/sshd_config edit the SSH configuration file as shown in2. On the client switch to normal user Zhangsan, create the key pair

~/.ssh, and ~/.ssh/authorized_keys for the remote host are also set to the appropriate permissions.3. Client machine test via ssh-v [email protected] No password login server,-V can debug the entire process, can be adjusted wrong.The problem that appears in 1:Ssh-copy-id:/usr/bin/