\u4f5c\u4e3a\u8fd0\u7ef4\u65b0\u624b\u7b2c\u4e00\u6b21\u63a5\u89e6 CentOS \u670d\u52a1\u5668\u65f6，\u88ab SSH \u914d\u7f6e\u641e\u5f97\u7126\u5934\u70c2\u989d！\u6574\u7406\u4e86\u4ece\u5b89\u88c5\u5230\u9ad8\u7ea7\u5b89\u5168\u8bbe\u7f6e\u7684\u5168\u6d41\u7a0b，\u9644\u8d85\u8be6\u7ec6\u547d\u4ee4\u548c\u907f\u5751\u6307\u5357，\u624b\u628a\u624b\u6559\u4f60\u641e\u5b9a\u8fdc\u7a0b\u8fde\u63a5👇<\/p>\n
SSH（Secure Shell）：Linux \u670d\u52a1\u5668\u6700\u5e38\u7528\u7684\u8fdc\u7a0b\u7ba1\u7406\u534f\u8bae，\u901a\u8fc7\u52a0\u5bc6\u4f20\u8f93\u9632\u6b62\u6570\u636e\u7a83\u542c\u3002\u5b83\u91c7\u7528\u975e\u5bf9\u79f0\u52a0\u5bc6\u6280\u672f，\u5728\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u5efa\u7acb\u5b89\u5168\u901a\u9053，\u53ef\u4ee5\u6709\u6548\u9632\u6b62\u4e2d\u95f4\u4eba\u653b\u51fb\u3002SSH \u534f\u8bae\u7531\u82ac\u5170\u5b66\u8005 Tatu Yl\u00f6nen \u4e8e 1995 \u5e74\u8bbe\u8ba1，\u662f\u76ee\u524d\u6700\u5b89\u5168\u7684\u8fdc\u7a0b\u767b\u5f55\u65b9\u5f0f\u4e4b\u4e00\u3002<\/p>\n
\u9ed8\u8ba4\u7aef\u53e3：22（\u5efa\u8bae\u4fee\u6539\u4e3a\u975e\u9ed8\u8ba4\u7aef\u53e3\u63d0\u9ad8\u5b89\u5168\u6027）\u3002\u5e38\u89c1\u7684\u66ff\u4ee3\u7aef\u53e3\u6709：2222\u30013333\u30014444 \u7b49，\u4f46\u907f\u514d\u4f7f\u7528\u5e38\u89c1\u670d\u52a1\u7aef\u53e3（\u5982 80\u3001443）\u3002\u7aef\u53e3\u53f7\u8303\u56f4\u5e94\u5728 1024-49151 \u4e4b\u95f4，\u4f4e\u4e8e 1024 \u7684\u7aef\u53e3\u901a\u5e38\u4e3a\u7cfb\u7edf\u4fdd\u7559\u7aef\u53e3\u3002<\/p>\n
\u4e24\u79cd\u8ba4\u8bc1\u65b9\u5f0f： \u2705 \u5bc6\u7801\u8ba4\u8bc1（\u9002\u5408\u65b0\u624b）：\u7b80\u5355\u6613\u7528，\u4f46\u5b89\u5168\u6027\u8f83\u4f4e，\u5bb9\u6613\u53d7\u5230\u66b4\u529b\u7834\u89e3\u653b\u51fb \u2705 \u5bc6\u94a5\u8ba4\u8bc1（\u66f4\u5b89\u5168，\u63a8\u8350\u751f\u4ea7\u73af\u5883）：\u91c7\u7528\u975e\u5bf9\u79f0\u52a0\u5bc6，\u5b89\u5168\u6027\u9ad8，\u907f\u514d\u4e86\u5bc6\u7801\u6cc4\u9732\u98ce\u9669<\/p>\n
# \u67e5\u770bSSH\u670d\u52a1\u72b6\u6001
\nsystemctl status sshd
\n# \u82e5\u663e\u793a"active (running)"\u5219\u5df2\u5b89\u88c5，\u5426\u5219\u6267\u884c\u5b89\u88c5\u547d\u4ee4
\n# \u4e5f\u53ef\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u68c0\u67e5\u5b89\u88c5\u5305
\nrpm -qa | grep openssh-server<\/p>\n
# CentOS 7\/8\u5b89\u88c5\u547d\u4ee4\u76f8\u540c
\nyum install openssh-server openssh-clients -y
\n# \u5b89\u88c5\u5b8c\u6210\u540e，\u53ef\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u67e5\u770b\u7248\u672c
\nssh -V<\/p>\n
\u5b89\u88c5\u5b8c\u6210\u540e，\u7cfb\u7edf\u4f1a\u81ea\u52a8\u521b\u5efa\u4ee5\u4e0b\u91cd\u8981\u6587\u4ef6：<\/p>\n
# \u542f\u52a8SSH\u670d\u52a1
\nsystemctl start sshd
\n# \u8bbe\u7f6e\u5f00\u673a\u81ea\u542f\u52a8
\nsystemctl enable sshd
\n# \u9a8c\u8bc1\u670d\u52a1\u72b6\u6001
\nsystemctl is-enabled sshd<\/p>\n
# \u57fa\u672c\u8fde\u63a5\u683c\u5f0f：ssh \u7528\u6237\u540d@\u670d\u52a1\u5668IP -p \u7aef\u53e3（\u9ed8\u8ba422\u53ef\u7701\u7565）
\nssh admin@192.168.1.100<\/p>\n
# \u8fde\u63a5\u7aef\u53e3\u4e3a2222\u7684\u670d\u52a1\u5668
\nssh user@server.com -p 2222<\/p>\n
# \u4f7f\u7528\u7279\u5b9a\u79c1\u94a5\u8fde\u63a5
\nssh -i ~\/.ssh\/custom_key.pem user@server.com<\/p>\n
# \u8be6\u7ec6\u8f93\u51fa\u6a21\u5f0f（\u8c03\u8bd5\u7528）
\nssh -v user@server.com<\/p>\n
cd \/etc\/ssh\/
\n# \u5148\u5907\u4efd\u539f\u914d\u7f6e\u6587\u4ef6（\u9632\u6b62\u6539\u5d29）
\ncp sshd_config sshd_config.bak
\n# \u8bbe\u7f6e\u914d\u7f6e\u6587\u4ef6\u6743\u9650（\u4ec5root\u53ef\u5199）
\nchmod 600 sshd_config<\/p>\n
vim sshd_config<\/p>\n
\u63a8\u8350\u4fee\u6539\u9879（\u53d6\u6d88\u6ce8\u91ca\u5e76\u4fee\u6539）：<\/p>\n
# \u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3（\u907f\u514d\u88ab\u66b4\u529b\u7834\u89e3）
\nPort 2222<\/p>\n
# \u7981\u6b62root\u7528\u6237\u76f4\u63a5\u767b\u5f55（\u63d0\u9ad8\u5b89\u5168\u6027）
\nPermitRootLogin no<\/p>\n
# \u542f\u7528\u5bc6\u94a5\u8ba4\u8bc1（\u66f4\u5b89\u5168）
\nPubkeyAuthentication yes<\/p>\n
# \u7981\u6b62\u5bc6\u7801\u8ba4\u8bc1（\u914d\u5408\u5bc6\u94a5\u8ba4\u8bc1\u4f7f\u7528）
\nPasswordAuthentication no<\/p>\n
# \u9650\u5236\u53ef\u767b\u5f55\u7528\u6237（\u591a\u4e2a\u7528\u6237\u7528\u7a7a\u683c\u5206\u9694）
\nAllowUsers admin devops backup<\/p>\n
# \u9650\u5236\u6700\u5927\u5c1d\u8bd5\u6b21\u6570（\u9632\u66b4\u529b\u7834\u89e3）
\nMaxAuthTries 3<\/p>\n
# \u8bbe\u7f6e\u7a7a\u95f2\u8d85\u65f6\u65f6\u95f4（\u5355\u4f4d\u79d2）
\nClientAliveInterval 300
\nClientAliveCountMax 0<\/p>\n
# \u7981\u7528DNS\u53cd\u5411\u89e3\u6790（\u52a0\u5feb\u8fde\u63a5\u901f\u5ea6）
\nUseDNS no<\/p>\n
# \u9650\u5236\u534f\u8bae\u7248\u672c（\u7981\u7528\u4e0d\u5b89\u5168\u7684SSHv1）
\nProtocol 2<\/p>\n
# \u9650\u5236\u540c\u65f6\u4f1a\u8bdd\u6570
\nMaxSessions 5<\/p>\n
# \u7981\u7528X11\u8f6c\u53d1（\u9664\u975e\u9700\u8981）
\nX11Forwarding no<\/p>\n
# \u68c0\u67e5\u914d\u7f6e\u8bed\u6cd5\u662f\u5426\u6b63\u786e
\nsshd -t
\n# \u91cd\u542f\u670d\u52a1
\nsystemctl restart sshd
\n# \u67e5\u770b\u670d\u52a1\u72b6\u6001
\nsystemctl status sshd<\/p>\n
# \u751f\u6210RSA\u5bc6\u94a5\u5bf9（\u63a8\u83504096\u4f4d）
\nssh-keygen -t rsa -b 4096 -C "your_email@example.com"
\n# \u6216\u8005\u751f\u6210\u66f4\u5b89\u5168\u7684Ed25519\u5bc6\u94a5
\nssh-keygen -t ed25519 -a 100<\/p>\n
# \u751f\u6210\u8fc7\u7a0b\u4e2d\u4f1a\u63d0\u793a：
\n# \u5bc6\u94a5\u4fdd\u5b58\u8def\u5f84（\u9ed8\u8ba4~\/.ssh\/id_rsa）
\n# \u8bbe\u7f6e\u5bc6\u94a5\u5bc6\u7801（\u53ef\u9009\u4f46\u63a8\u8350）
\n# \u786e\u8ba4\u5bc6\u94a5\u5bc6\u7801<\/p>\n
# \u751f\u6210\u540e\u4f1a\u5728~\/.ssh\u76ee\u5f55\u4e0b\u4ea7\u751f：
\n# id_rsa（\u79c1\u94a5，\u5fc5\u987b\u4fdd\u5bc6）
\n# id_rsa.pub（\u516c\u94a5，\u53ef\u516c\u5f00）
\n# \u82e5\u6307\u5b9a\u4e86\u5176\u4ed6\u540d\u79f0，\u5982custom_key，\u5219\u751f\u6210custom_key\u548ccustom_key.pub<\/p>\n
# \u8bbe\u7f6e\u79c1\u94a5\u6743\u9650
\nchmod 600 ~\/.ssh\/id_rsa<\/p>\n
# \u65b9\u6cd5\u4e00：\u4f7f\u7528ssh-copy-id\u81ea\u52a8\u4e0a\u4f20
\n# \u683c\u5f0f：ssh-copy-id -p \u7aef\u53e3 \u7528\u6237\u540d@\u670d\u52a1\u5668IP
\nssh-copy-id -p 2222 admin@192.168.1.100
\n# \u8f93\u5165\u5bc6\u7801\u540e\u81ea\u52a8\u5c06\u516c\u94a5\u6dfb\u52a0\u5230\u670d\u52a1\u5668~\/.ssh\/authorized_keys<\/p>\n
# \u65b9\u6cd5\u4e8c：\u624b\u52a8\u4e0a\u4f20（\u5f53ssh-copy-id\u4e0d\u53ef\u7528\u65f6）
\n# 1. \u5c06\u516c\u94a5\u5185\u5bb9\u590d\u5236\u5230\u526a\u8d34\u677f
\ncat ~\/.ssh\/id_rsa.pub | pbcopy # Mac
\ncat ~\/.ssh\/id_rsa.pub | xclip -selection clipboard # Linux<\/p>\n
# 2. \u767b\u5f55\u670d\u52a1\u5668，\u7f16\u8f91authorized_keys\u6587\u4ef6
\nmkdir -p ~\/.ssh
\nchmod 700 ~\/.ssh
\ntouch ~\/.ssh\/authorized_keys
\nchmod 600 ~\/.ssh\/authorized_keys
\nvim ~\/.ssh\/authorized_keys
\n# \u7c98\u8d34\u516c\u94a5\u5185\u5bb9\u5e76\u4fdd\u5b58<\/p>\n
ssh admin@192.168.1.100 -p 2222
\n# \u82e5\u8bbe\u7f6e\u4e86\u5bc6\u94a5\u5bc6\u7801，\u5219\u9700\u8981\u8f93\u5165\u5bc6\u94a5\u5bc6\u7801
\n# \u65e0\u9700\u8f93\u5165\u670d\u52a1\u5668\u7528\u6237\u5bc6\u7801\u5373\u914d\u7f6e\u6210\u529f<\/p>\n
# 1. \u68c0\u67e5\u670d\u52a1\u5668SSH\u670d\u52a1\u662f\u5426\u542f\u52a8
\nsystemctl status sshd<\/p>\n
# 2. \u68c0\u67e5\u9632\u706b\u5899\u662f\u5426\u653e\u884c\u7aef\u53e3
\nfirewall-cmd –list-all
\n# \u6216\u8005
\niptables -L -n<\/p>\n
# \u653e\u884c\u7aef\u53e3\u793a\u4f8b（\u4ee52222\u4e3a\u4f8b）
\nfirewall-cmd –permanent –add-port=2222\/tcp
\nfirewall-cmd –reload<\/p>\n
# 3. \u68c0\u67e5SELinux\u662f\u5426\u963b\u6b62SSH
\nsestatus
\n# \u4e34\u65f6\u5173\u95edSELinux（\u6d4b\u8bd5\u7528）
\nsetenforce 0
\n# \u6c38\u4e45\u5173\u95ed（\u4e0d\u63a8\u8350\u751f\u4ea7\u73af\u5883）
\nvim \/etc\/selinux\/config
\n# \u4fee\u6539SELINUX=disabled<\/p>\n
# 4. \u68c0\u67e5\u7f51\u7edc\u8fde\u901a\u6027
\nping 192.168.1.100
\ntraceroute 192.168.1.100
\ntelnet 192.168.1.100 2222<\/p>\n
# 5. \u68c0\u67e5\u7aef\u53e3\u662f\u5426\u76d1\u542c
\nnetstat -tulnp | grep ssh
\nss -tulnp | grep ssh<\/p>\n
# 1. \u68c0\u67e5sshd_config\u914d\u7f6e
\ngrep PasswordAuthentication \/etc\/ssh\/sshd_config<\/p>\n
# 2. \u68c0\u67e5\u7528\u6237\u5bc6\u7801\u662f\u5426\u6b63\u786e
\npasswd admin<\/p>\n
# 3. \u68c0\u67e5PAM\u6a21\u5757\u9650\u5236
\nvim \/etc\/pam.d\/sshd<\/p>\n
# 4. \u68c0\u67e5\u7528\u6237shell\u662f\u5426\u88ab\u7981\u7528
\nvim \/etc\/passwd
\n# \u786e\u4fdd\u7528\u6237shell\u4e3a\/bin\/bash\u6216\/bin\/sh<\/p>\n
# 5. \u68c0\u67e5\u7528\u6237\u662f\u5426\u88ab\u9501\u5b9a
\npasswd -S admin<\/p>\n
# 6. \u67e5\u770b\u8be6\u7ec6\u65e5\u5fd7
\njournalctl -xe
\ntail -f \/var\/log\/secure<\/p>\n
# \u4f7f\u7528firewalld\u9650\u5236IP\u8bbf\u95ee
\nfirewall-cmd –permanent –add-rich-rule="rule family='ipv4' source address='192.168.1.10' port protocol='tcp' port='2222' accept"
\nfirewall-cmd –permanent –add-rich-rule="rule family='ipv4' source address='10.0.0.0\/24' port protocol='tcp' port='2222' accept"
\nfirewall-cmd –permanent –remove-service=ssh
\nfirewall-cmd –reload<\/p>\n
# \u6216\u8005\u4f7f\u7528iptables
\niptables -A INPUT -p tcp –dport 2222 -s 192.168.1.10 -j ACCEPT
\niptables -A INPUT -p tcp –dport 2222 -j DROP
\nservice iptables save<\/p>\n
# \u5728\/etc\/hosts.allow\u6dfb\u52a0\u5141\u8bb8\u7684IP
\necho "sshd: 192.168.1.0\/24" >> \/etc\/hosts.allow
\necho "sshd: 10.0.0.5" >> \/etc\/hosts.allow<\/p>\n
# \u5728\/etc\/hosts.deny\u6dfb\u52a0\u62d2\u7edd\u7684IP
\necho "sshd: ALL" >> \/etc\/hosts.deny<\/p>\n
# \u68c0\u67e5\u914d\u7f6e\u662f\u5426\u751f\u6548
\ntcpdchk<\/p>\n
# \u5b89\u88c5fail2ban
\nyum install epel-release -y
\nyum install fail2ban -y
\nsystemctl start fail2ban
\nsystemctl enable fail2ban<\/p>\n
# \u914d\u7f6efail2ban
\nvim \/etc\/fail2ban\/jail.local<\/p>\n
\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9：<\/p>\n
[sshd]
\nenabled = true
\nport = 2222
\nfilter = sshd
\nlogpath = \/var\/log\/secure
\nmaxretry = 3
\nfindtime = 300
\nbantime = 3600
\nignoreip = 127.0.0.1 192.168.1.0\/24<\/p>\n
\u91cd\u542f\u670d\u52a1：<\/p>\n
systemctl restart fail2ban
\n# \u67e5\u770b\u88abban\u7684IP
\nfail2ban-client status sshd<\/p>\n
\u914d\u7f6e\u524d\u5148\u5907\u4efd：<\/p>\n
cp \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.bak<\/p>\n<\/li>\n
\u751f\u4ea7\u73af\u5883\u5b89\u5168\u89c4\u8303：<\/p>\n
\u7aef\u53e3\u4fee\u6539\u6ce8\u610f\u4e8b\u9879：<\/p>\n
\u5bc6\u94a5\u7ba1\u7406：<\/p>\n
\u5176\u4ed6\u5efa\u8bae：<\/p>\n
| \u67e5\u770b SSH \u72b6\u6001<\/td>\n | systemctl status sshd<\/td>\n<\/tr>\n |
| \u91cd\u542f SSH \u670d\u52a1<\/td>\n | systemctl restart sshd<\/td>\n<\/tr>\n |
| \u67e5\u770b SSH \u65e5\u5fd7<\/td>\n | tail -f \/var\/log\/secure \u6216 journalctl -u sshd<\/td>\n<\/tr>\n |
| \u751f\u6210\u5bc6\u94a5\u5bf9<\/td>\n | ssh-keygen -t rsa -b 4096<\/td>\n<\/tr>\n |
| \u4e0a\u4f20\u516c\u94a5<\/td>\n | ssh-copy-id -p 2222 user@server<\/td>\n<\/tr>\n |
| \u6d4b\u8bd5\u5bc6\u94a5\u767b\u5f55<\/td>\n | ssh -p 2222 -i ~\/.ssh\/id_rsa user@server<\/td>\n<\/tr>\n |
| \u67e5\u770b\u5f53\u524d\u767b\u5f55\u7528\u6237<\/td>\n | who \u6216 w<\/td>\n<\/tr>\n |
| \u67e5\u770b\u767b\u5f55\u5386\u53f2<\/td>\n | last \u548c lastb<\/td>\n<\/tr>\n |
| \u67e5\u770bSSH\u8fde\u63a5<\/td>\n | `netstat -tnpa<\/td>\n<\/tr>\n |
| \u68c0\u67e5SSH\u914d\u7f6e<\/td>\n | sshd -t<\/td>\n<\/tr>\n |
| \u67e5\u770bSSH\u7248\u672c<\/td>\n | ssh -V<\/td>\n<\/tr>\n |
| \u5f3a\u5236\u65ad\u5f00SSH\u4f1a\u8bdd<\/td>\n | pkill -9 -t pts\/0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u638c\u63e1\u8fd9\u4e9b\u6280\u80fd\u540e，\u518d\u4e5f\u4e0d\u7528\u6015\u670d\u52a1\u5668\u8fdc\u7a0b\u7ba1\u7406\u5566！\u8bb0\u5f97\u6536\u85cf\u8fd9\u7bc7\u6559\u7a0b，\u914d\u7f6e\u65f6\u9047\u5230\u95ee\u9898\u53ef\u4ee5\u968f\u65f6\u5bf9\u7167～ \u4f60\u4eec\u5728\u914d\u7f6e SSH \u65f6\u9047\u5230\u8fc7\u54ea\u4e9b\u5947\u8469\u95ee\u9898？\u8bc4\u8bba\u533a\u4e00\u8d77\u4ea4\u6d41\u5440～<\/p>\n","protected":false},"excerpt":{"rendered":" \u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.6k\u6b21\uff0c\u70b9\u8d5e33\u6b21\uff0c\u6536\u85cf18\u6b21\u3002\u672c\u6587\u63d0\u4f9b\u4ece\u5165\u95e8\u5230\u8fdb\u9636\u7684CentOS\u670d\u52a1\u5668SSH\u914d\u7f6e\u5168\u6d41\u7a0b\uff0c\u5305\u542b\uff1a1\ufe0f\u20e3SSH\u670d\u52a1\u5b89\u88c5\u4e0e\u542f\u52a8\uff08yum\u5b89\u88c5+systemctl\u7ba1\u7406\uff09\uff1b2\ufe0f\u20e3Windows\/Mac\u8fde\u63a5\u65b9\u6cd5\uff08PuTTY\/\u7ec8\u7aef\u547d\u4ee4\uff09\uff1b3\ufe0f\u20e3\u5173\u952e\u5b89\u5168\u914d\u7f6e\uff08\u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3\u3001\u7981\u7528root\u767b\u5f55\u3001\u5bc6\u94a5\u8ba4\u8bc1\uff09\uff1b4\ufe0f\u20e3\u5e38\u89c1\u6545\u969c\u6392\u67e5\uff08\u8fde\u63a5\u62d2\u7edd\/\u767b\u5f55\u5931\u8d25\uff09\uff1b5\ufe0f\u20e3\u8fdb\u9636\u9632\u62a4\uff08IP\u9650\u5236\u3001fail2ban\u9632\u66b4\u7834\uff09\u3002\u7279\u522b\u5f3a\u8c03\u751f\u4ea7\u73af\u5883\u5fc5\u987b\u4f7f\u7528\u5bc6\u94a5\u8ba4\u8bc1\uff0c\u5e76\u7ed9\u51fa\u914d\u7f6e\u6587\u4ef6\u4fee\u6539\u793a\u4f8b\u3001\u5bc6\u94a5\u751f\u6210\u547d\u4ee4\u53ca\u6743\u9650\u8bbe\u7f6e\u8981\u70b9\u3002\u9644\u5b9e\u7528\u547d\u4ee4\u901f\u67e5\u8868\u548c\u65e5\u5fd7\u67e5\u770b\u6280\u5de7\uff0c\u9002\u5408\u8fd0\u7ef4\u65b0\u624b\u5feb\u901f\u638c\u63e1\u5b89\u5168\u8fdc\u7a0b\u7ba1\u7406\u3002_centos ssh<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[59,77,43,44],"topic":[],"class_list":["post-47700","post","type-post","status-publish","format-standard","hentry","category-server","tag-centos","tag-ssh","tag-43","tag-44"],"yoast_head":"\n |