#ssh與sftp的端口分離的搭建方法
#sshd.service
1.#判斷狀態(tài)
#sftp存活依賴(lài)于ssh的是否正常啟動(dòng)，ssh必須先啟動(dòng)
[root@ecs-75912 ~]# systemctl status ?sshd.service
2.#拷貝文件sftp的文件
2.1#sshd.service ?內(nèi)容（一部分的liunx7用的是sshd.sokcet,可以在目錄下加入這個(gè)文件）
/usr/lib/systemd/system/sshd.service
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target
[Service]
EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config
#EnvironmentFile=-/etc/sysconfig/sshd
#ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s
[Install]
WantedBy=multi-user.target? ? ? ? ? ? ?
#拷貝建立軟連接
[root@ecs-75912~]#cp?/usr/lib/systemd/system/sshd.service ?/etc/systemd/system/sftpd.service
[root@ecs-75912 ~]# cat /etc/systemd/system/sftpd.service
[root@ecs-75912 ~]# cp /etc/pam.d/sshd ?/etc/pam.d/sftpd
[root@ecs-75912 ~]# cp /etc/ssh/sshd_config ?/etc/ssh/sftpd_config
[root@ecs-75912 ~]# ln -sf ?/usr/sbin/service ?/usr/sbin/rcsftpd
[root@ecs-75912 ~]# ln -sf ?/usr/sbin/sshd ?/usr/sbin/sftpd
[root@ecs-75912 ~]# cp /etc/sysconfig/sshd ?/etc/sysconfig/sftp
[root@ecs-75912 ~]# cp /var/run/sshd.pid ?/var/run/sftpd.pid
3.清空/var/run/目錄下的sftp.pid文件內(nèi)容
#>/var/run/sftpd.pid
4.#修改好復(fù)制好的文件
vim /etc/systemd/system/sftpd.service
[Unit]
#Description=OpenSSH server daemon
#修改
Description=sftpd server daemon
#添加
Type=notify
EnvironmentFile=/etc/sysconfig/sftp
ExecStart=/usr/sbin/sftpd -f /etc/ssh/sftpd_config
5.#修改sftp.service
#添加
Port 8022
#修改
PidFile /var/run/sftp.pid
#注釋掉這一行
#Subsystem ?????sftp ???/usr/libexec/openssh/sftp-server
#將PermitRootLogin從yes?改為no
PermitRootLogin no
#添加
PasswordAuthentication yes
UseDNS no
Subsystem sftp internal-sftp
Match User sftpuser
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
6.#專(zhuān)用sftp的專(zhuān)用賬戶(hù)
#useradd ?jsyhsftp
#passwd jsyhsftp
# usermod -s /bin/false jsyhsftp
7.#禁用seliunx
[root@ecs-75912 ~]# setenforce? 0
setenforce: SELinux is disabled
[root@ecs-75912~]#
sed?-i "s/^SELINUX\=enforcing/SELINUX\=disabled/g" /etc/selinux/config
8#啟動(dòng)
[root@ecs-75912 ~]# systemctl daemon-reload
[root@ecs-75912 ~]# systemctl start sftpd
9#測(cè)試
[root@ecs-75912 ~]# sftp -P 8022 sftpuser@localhost
The authenticity of host '[localhost]:8022 ([::1]:8022)' can't be established.
ECDSA key fingerprint is SHA256:mM+2QZCucOtVZo+kwhTWgHvdrVeCmbZdu2mHVMmI8KA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:8022' (ECDSA) to the list of known hosts.
sftpuser@localhost's password:
Connected to sftpuser@localhost.
sftp>
10#開(kāi)機(jī)自動(dòng)啟動(dòng)（需要關(guān)機(jī)重啟）
[root@ecs-75912 ~]# systemctl enable?sshd.service
[root@ecs-75912 ~]# systemctl enable?sftpd.service
