SSHD服务防止暴力破解

SSHD服务防止暴力破解

配置安全的SSHD服务（方法一）

(1) 密码足够的复杂，密码的长度要大于8位最好大于20位。密码的复杂度是密码要尽可能有数字、大小写字母和特殊符号混合组成。
(2) 修改默认端口号。

#端口号修改为：8888
systemctl  restart sshd
yum install nmap
nmap 127.0.0.1

Starting Nmap 6.40 ( http://nmap.org ) at 2019-05-17 22:34 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000030s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
25/tcp   open  smtp
111/tcp  open  rpcbind
631/tcp  open  ipp
6000/tcp open  X11
8888/tcp open  sun-answerbook

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

(3) 不允许root账号直接登陆，添加普通账号，授予root的权限。
思考：是否可以禁止root身份登录？
答：不行，因为有些程序需要使用root身份登录并运行。另外判断一个用户是不是超级管理员，看的是用户的ID是否为0。
(4) 不允许密码登陆，只能通过认证的密钥来登陆系统

1. 通过密钥认证实现SSHD认证
实验环境：
服务端：zmedu63 IP：192.168.0.63
客户端：zmedu64 IP：192.168.0.64
客户端生成密钥对，然后把公钥传输到服务端

[root@zmedu64 ~]# ssh -keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 		#提示输入密钥文件的保存路径，选择默认，回车继续
Enter passphrase (empty for no passphrase): 		#下面要求输入密码，这里的passphrase 密码是对生成的私钥文件(/root/.ssh/id_dsa)的保护口令，如果不设置可以回车。
Enter same passphrase again: 			#直接回车。
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
da:2c:d8:53:92:6e:ff:4a:54:14:cd:23:28:b3:bb:3b root@zmedu64
The key's randomart image is:
+--[ RSA 2048]-----+
|         .o+		|
|    	   o ... + 	|
|       +  .. .		|
|        .. .		|
|      o.S			|
|     +.B			|
|    . B.+			|
|     .E=			|
|      .ooo.		|
+--------------------+
[root@zmedu64 ~]# cd /root/.ssh/			#切换工作目录至家目录下的.ssh目录下。
[root@zmedu64 .ssh]# ls				#可查看到生成的id_rsa、id_rsa.pub文件。
id_rsa  id_rsa.pub  known_hosts

2. 发布公钥到服务端。
使用ssh-copy-id 命令将客户端生成的公钥发布到远程服务器192.168.0.63 zmedu63。

[root@zmedu64 .ssh]# ssh-copy-id -i 192.168.0.63
The authenticity of host '192.168.0.63(192.168.0.63)' can't be established.
RSA key fingerprint is d9:17:d7:db:38:7c:e8:56:9c:4b:7e:00:7f:9e:1c:74.
Are you sure you want to continue connecting (yes/no)? yes		#输入yes
Warning: Permanently added '192.168.0.64' (RSA) to the list of known hosts.
root@192.168.0.63's password: 		#输入192.168.0.63主机登录密码。
Now try logging into the machine, with "ssh '192.168.0.63'", and check in:

  .ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting
#这个时候可以通过ssh 无密钥直接登陆主机

注意：如果服务器不是监听22端口，则需要指定端口传输密钥：
[root@zmedu64 .ssh]# ssh-copy-id -i ~/.ssh/id_rsa.pub -p 222 root@192.168.0.63