telnet

telnet: 23/tcp

明文

C/S:

默認(rèn)：禁止管理直接登錄

總結(jié)：

telnet

telnet-server

xinetd

ssh

ssh: secure shell, 22/tcp

sshv1, sshv2

sshv1基于CRC-32做MAC汹忠，不安全；

sshv2基于雙方主機(jī)的協(xié)商選擇使用最安全的MAC方式

加密機(jī)制及MAC機(jī)制由雙方協(xié)商選定航徙；

基于DH實(shí)現(xiàn)密鑰交換，基于RSA或DSA實(shí)現(xiàn)身份認(rèn)證慢显；

客戶(hù)端通過(guò)檢查服務(wù)器端的主機(jī)密鑰來(lái)判斷是否能夠繼續(xù)通信裆蒸；

OpenSSH 是一組用于安全地訪問(wèn)遠(yuǎn)程計(jì)算機(jī)的連接工具。 它可以作為 rlogin婆排、 rsh rcp 以及 telnet 的直接替代品使用荒椭。 更進(jìn)一步谐鼎， 其他任何 TCP/IP 連接都可以通過(guò) SSH 安全地進(jìn)行隧道/轉(zhuǎn)發(fā)。 OpenSSH 對(duì)所有的傳輸進(jìn)行加密趣惠， 從而有效地阻止了竊聽(tīng)狸棍、 連接劫持， 以及其他網(wǎng)絡(luò)級(jí)的攻擊味悄。OpenSSH 由 OpenBSD project 維護(hù)草戈。

登錄過(guò)程和使用 rlogin 或 telnet 建立的會(huì)話非常類(lèi)似。 在連接時(shí)侍瑟， SSH 會(huì)利用一個(gè)密鑰指紋系統(tǒng)來(lái)驗(yàn)證服務(wù)器的真實(shí)性唐片。 只有在第一次連接時(shí)丙猬， 用戶(hù)會(huì)被要求輸入 yes。 之后的連接將會(huì)驗(yàn)證預(yù)先保存下來(lái)的密鑰指紋费韭。 如果保存的指紋與登錄時(shí)接收到的不符茧球， 則將會(huì)給出警告。 指紋保存在 ~/.ssh/known_hosts 中星持， 對(duì)于 SSH v2 指紋抢埋， 則是 ~/.ssh/known_hosts2。

默認(rèn)情況下督暂， 較新版本的 OpenSSH 只接受 SSH v2 連接揪垄。 如果能用版本 2 則客戶(hù)程序會(huì)自動(dòng)使用， 否則它會(huì)返回使用版本 1 的模式逻翁。 此外饥努， 也可以通過(guò)命令行參數(shù) -1 或 -2 來(lái)相應(yīng)地強(qiáng)制使用版本 1 或 2。 保持客戶(hù)端的版本 1 能力是為了考慮較早版本的兼容性卢未。

openssh:

C/S

S: sshd

C: ssh

windows客戶(hù)端：

putty肪凛，xshell，securecrt辽社，sshshellclient

openssh的客戶(hù)端組件：

ssh: 配置/etc/ssh/ssh_config

ssh [username@]host [COMMAND]

ssh -l username host [COMMAND]

-p PORT

scp: 利用ssh協(xié)議在主機(jī)之間實(shí)現(xiàn)安全文件傳輸?shù)墓ぞ?/p>

scp SRC1... DEST

分兩種情形：

1、源文件在本機(jī)翘鸭，目標(biāo)為遠(yuǎn)程

# scp /path/to/somefile... USERNAME@HOST:/path/to/somewhere

[root@coffee zzz]# scp /zzz/manpages-zh-1.5.2.tar.bz2 root@192.168.0.151:/test

root@192.168.0.151's password:

manpages-zh-1.5.2.tar.bz2?

2滴铅、源文件在遠(yuǎn)程，本地為目標(biāo)

# scp USERNAME@HOST:/path/to/somewhere /path/to/somewhere

[root@coffee zzz]# scp root@192.168.0.151:/test/zhang /zzz

root@192.168.0.151's password:

zhang?

-r: 復(fù)制目錄時(shí)使用

-p: 保持源文件的元數(shù)據(jù)信息就乓，包括mode和timestamp

-q: 靜默模式

-p PORT: 指定ssh協(xié)議監(jiān)聽(tīng)的端口

sftp: 基于ssh的ftp服務(wù)

用法：sftp USERNAME@HOST

openssh的服務(wù)器端：sshd

配置文件：/etc/ssh/sshd_config

服務(wù)腳本：/etc/rc.d/init.d/sshd

腳本配置文件：/etc/sysconfig/sshd

配置參數(shù)：

# man sshd_config

經(jīng)常需要修改的參數(shù)：

Port: 修改默認(rèn)監(jiān)聽(tīng)的端口

ListenAddress

sshd認(rèn)證方式：

1汉匙、基于口令的認(rèn)證；

2生蚁、基于密鑰的認(rèn)證噩翠；

# ssh-keygen -t rsa

默認(rèn)密鑰為id_rsa, id_rsa.pub

-f /path/to/somefile: 密鑰文件保存位置

-P '': 指定oldpassword

# ssh-copy-id -i .ssh/id_rsa.pub USERNAME@HOST

[root@coffee ~]# ssh root@192.168.0.151?????????????????????????????????????? 用root身份連接到151主機(jī) exit為退出

root@192.168.0.151's password:

Last login: Tue Jun 18 05:06:03 2019 from 192.168.0.161

[root@coffee ~]# exit

logout

Connection to 192.168.0.151 closed.

[root@coffee ~]#

[root@coffee ~]# ssh root@192.168.0.151 'uname -r'????????????????????????????????? 用root身份到151主機(jī)上執(zhí)行uname命令后返回

root@192.168.0.151's password:

2.6.32-754.14.2.el6.x86_64

[root@coffee ~]# uname -r

3.10.0-957.12.2.el7.x86_64

最佳實(shí)踐：

1、不要使用默認(rèn)的22號(hào)端口邦投；

2伤锚、不要使用protocol 1;

3、限制可登錄的用戶(hù)

白名單：

AllowUsers user1 user2 ...

AllowGroups grp1 grp2...

黑名單：

DenyUsers

DenyGroups

4志衣、設(shè)定空閑會(huì)話超時(shí)時(shí)長(zhǎng)

ClientAliveInterval 300

ClientAliveCountMax 0

5屯援、利用防火墻設(shè)置ssh訪問(wèn)策略；

6念脯、僅監(jiān)聽(tīng)在特定的IP地址狞洋，而非本機(jī)所有的IP地址；

7绿店、使用強(qiáng)密碼策略

# tr -dc A-Za-z0-9_ < /dev/urandom | head -c 30 | xargs

8吉懊、使用基于密鑰的認(rèn)證庐橙；

9、禁止使用空密碼借嗽；

10态鳖、禁止root用戶(hù)直接登錄；

11淹魄、限制ssh的訪問(wèn)頻度

12郁惜、做好日志，經(jīng)常分析甲锡；

總結(jié)：

ssh: /etc/ssh/ssh_config

sshd: /etc/ssh/sshd_config

ssh, scp, sftp

lastb: 最近失敗登錄的嘗試

dropbear

客戶(hù)端配置文件

[root@coffee zzz]# vim /etc/ssh/ssh_config

#? Tunnel no

#? Protocol 2? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 協(xié)議版本

#? Cipher 3des? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 對(duì)稱(chēng)加密

#? Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc? 所有加密方式

#? MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160? ? ? 消息摘認(rèn)證

#? EscapeChar ~

#? Tunnel no

#? TunnelDevice any:any

#? PermitLocalCommand no

#? VisualHostKey no

#? ProxyCommand ssh -q -W %h:%p gateway.example.com

#? RekeyLimit 1G 1h

#

# Uncomment this if you want to use .local domain

# Host *.local

#? CheckHostIP no

上面的為默認(rèn)值兆蕉，把要啟用的選項(xiàng)，可以寫(xiě)到下面

Host *

? ? ? ? GSSAPIAuthentication yes

# If this option is set to yes then remote X11 clients will have full access

# to the original X11 display. As virtually no X11 client supports the untrusted

# mode correctly we set this to yes.

服務(wù)器端

修改22端口時(shí)關(guān)閉 selinux 和防火墻

[root@coffee ~]# getenforce

Enforcing

[root@coffee ~]# setenforce 0

[root@coffee ~]# service iptables stop

[root@coffee .ssh]# rpm -q openssh???????????????????????????????? ? ? ? ?? 檢查服務(wù)器端是否安裝

/var/log/secure ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?? 日志保存位置缤沦，root才能查看 ????

[root@coffee ~]# vim /etc/ssh/sshd_config

#? ? ? $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.? See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.? Uncommented options change a

# default value.

#Port 22?????????????????????????????????????????????????????? 監(jiān)聽(tīng)端口 建議修改

#AddressFamily any????????????????????????????????????? "any"(默認(rèn))虎韵、"inet"(僅IPv4)、"inet6"(僅IPv6)缸废。

#ListenAddress 0.0.0.0??????????????????????????????????? 監(jiān)聽(tīng)ipv4本機(jī)所以網(wǎng)絡(luò)地址

#ListenAddress ::???????????????????????????????????????????? 監(jiān)聽(tīng)ipv6的本機(jī)所有網(wǎng)絡(luò)地址

# Disable legacy (protocol version 1) support in the server for new

# installations. In future the default will change to require explicit

# activation of protocol 1

Protocol 2

# HostKey for protocol version 1

#HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key

#KeyRegenerationInterval 1h???????????????????? 秘鑰有效時(shí)間1小時(shí)

#ServerKeyBits 1024?????????????????????????????????? 主機(jī)秘鑰長(zhǎng)度

# Logging

# obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

SyslogFacility AUTHPRIV?????????????????????? 日志記錄方式

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m????????????????????????????? 登錄超時(shí)時(shí)間2分鐘

#PermitRootLogin yes?????????????????????? 是否允許管理員登錄 建議關(guān)閉

#StrictModes yes?????????????????????????????

#MaxAuthTries 6????????????????? 密碼允許錯(cuò)誤次數(shù)

#MaxSessions 10???????????????? 最多允許同時(shí)登錄數(shù)量

#RSAAuthentication yes

#PubkeyAuthentication yes

#AuthorizedKeysFile? ? .ssh/authorized_keys

#AuthorizedKeysCommand none

#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#RhostsRSAAuthentication no

# similar for protocol version 2

#HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

#PasswordAuthentication yes

#PermitEmptyPasswords no

PasswordAuthentication yes??????????????????? 是否允許密碼登錄? 建議關(guān)閉

# Change to no to disable s/key passwords

#ChallengeResponseAuthentication yes

ChallengeResponseAuthentication no

# Kerberos options???????????????? 大公司統(tǒng)一賬號(hào)認(rèn)證

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

#KerberosUseKuserok yes

# GSSAPI options

#GSSAPIAuthentication no

GSSAPIAuthentication yes

#GSSAPICleanupCredentials yes

GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.? Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

#UsePAM no

UsePAM yes

# Accept locale-related environment variables

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT

AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE

AcceptEnv XMODIFIERS

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

#X11Forwarding no

X11Forwarding yes????????? X11圖形轉(zhuǎn)發(fā)? 建議開(kāi)啟

#X11DisplayOffset 10

#X11UseLocalhost yes

#PrintMotd yes

#PrintLastLog yes

#TCPKeepAlive yes

#UseLogin no

#UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#ShowPatchLevel no

#UseDNS yes?????? 是否連接成功后反解析DNS? 建議關(guān)閉不然卡很久

#PidFile /var/run/sshd.pid

#MaxStartups 10:30:100

#PermitTunnel no

#ChrootDirectory none

# no default banner path

#Banner none

# override default of no subsystems

Subsystem? ? ? sftp? ? /usr/libexec/openssh/sftp-server???? 是否開(kāi)啟sftp連接

# Example of overriding settings on a per-user basis

#Match User anoncvs

#? ? ? X11Forwarding no

#? ? ? AllowTcpForwarding no

#? ? ? ForceCommand cvs server

???

生成秘鑰對(duì)

[root@coffee .ssh]# ssh-keygen -t rsa??????????????????????????????????????? 在客戶(hù)端生成包蓝。拷貝

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa):?????????????????????? 保存位置

Enter passphrase (empty for no passphrase):?????????????????????????????????? 私鑰是否加密企量，直接回車(chē)不用加密

Enter same passphrase again:

Your identification has been saved in /root/.ssh/id_rsa.

Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:

SHA256:UTyhCttSN+sw2zUezSH0LaukS0ix0zRULLfgI6NILTs root@coffee

The key's randomart image is:

+---[RSA 2048]----+

|? ? ? ? .+=.? ? |

|? ? ? .o+=. .? |

|? .. o.B+.o+ .? |

|? o .=oBo=.+ +? |

| . +o.OoS.= +? ? |

|? E .o O = +? ? |

|? .? o = o? ? ? |

|? ? ? . .? ? ? |

|? ? ? ? .? ? ? ? |

+----[SHA256]-----+

[root@coffee .ssh]# ls

id_rsa? id_rsa.pub? known_hosts???????????????????? id_rsa為私鑰???? id_rsa.pub為公鑰

[root@coffee .ssh]#?

[root@coffee .ssh]# ssh-copy-id -i id_rsa.pub root@192.168.0.151?????????? 把公鑰拷貝到需要連接的主機(jī)上

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

root@192.168.0.151's password:

Number of key(s) added: 1

Now try logging into the machine, with:? "ssh 'root@192.168.0.151'"

and check to make sure that only the key(s) you wanted were added.

默認(rèn)為對(duì)方主機(jī)的~/.ssh/authorized_keys 文件