Ara girman tsaro akan GNU / Linux

Sannu abokai daga DesdeLinux, abin da aka yi alkawari bashi ne kuma ga post game da yadda ake kara kariyar tsarin Linux kuma tsaya haka lafiya daga masu yin kutse da kuma kare bayanai a kan sabobinku, na PC ko na laptops !!!!

Comenzando

Kasa2ban: aikace-aikace ne wanda aka rubuta a Python don hana kutse cikin tsarin, wanda yake aiki ta hanyar hukuntawa ko toshe hanyoyin sadarwa masu nisa waɗanda suke ƙoƙari samun damar karfi.

Shigarwa:

Fedora, RHEL, CentOS:

yum install fail2ban

Debian, Ubuntu:

apt-get install fail2ban

Kafa:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local nano /etc/fail2ban/jail.local

A bangaren da ake kira [DEFAULT] mun damu kuma mun gyara #bantime = 3600 mun barshi kamar haka:

#bantime = 3600 bantime = 604800

A bangaren [sshd] mun gabatar da kunna = gaskiya barin sa kamar haka:

# kunnawa = gaskiya an kunna = gaskiya

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Mun fara sabis:

Fedora, RHEL, CentOS:

systemctl kunna fail2ban.service systemctl fara fail2ban.service

Debian, Ubuntu:

sabis ya kasa2ban farawa

Karyatawa samun tushen ta amfani da ssh:

Don kare injin mu zamu karyata ssh ta hanyar mai amfani dashi. Don yin wannan, muna shirya fayil ɗin / sauransu / ssh / sshd_config kamar haka:

cp sshd_config sshd_config.bck nano / sauransu / ssh / sshd_config

Ba mu da damuwa kuma mun canza

# Yarjejeniyar 2 Yarjejeniyar 2

Ba mu da damuwa kuma mun canza

#PermitRootLogin eh PermitRootLogin ba

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Mun fara sabis:

Fedora, RHEL, CentOS:

systemctl kunna sshd.service systemctl fara sshd.service

Debian, Ubuntu:

service sshd fara

Denin hana samun damar zuwa sabar ssh ta amfani da kalmar wucewa kuma ba da izinin ssh kawai tare da mabuɗan RSA

Idan muna son haɗawa da PC1 zuwa Server1, abu na farko da zamuyi shine samar da maɓallin mu akan PC1. Tare da mai amfani da mu kuma ba tare da tushen akan PC1 ba muna aiwatarwa:

ssh-keygen -t rsa -b 8192 (wannan yana haifar da maɓallin da ya fi tsaro tunda ana amfani da mabuɗan daga 1024 zuwa 2048)

Da zarar mun sami kalmar sirri, sai mu loda ta a Server1:

ssh-copy-id mai amfani @ server_ip

Da zarar an gama wannan, za mu haɗi zuwa Server1 ɗinmu kuma gyara Nano / sauransu / ssh / sshd_config fayil tare da izinin izini:

mai amfani ssh @ Server1 nano / sauransu / ssh / sshd_config

Mun canza layin da yake cewa #PasswordAuthentication ae ga wannan:

#PasswordAuthentication eh
Kalmar wucewaAuttawa babu

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Mun sake farawa sabis na ssh:

Fedora, RHEL, CentOS:

systemctl sake farawa sshd.service

Debian, Ubuntu:

service sshd sake kunnawa

Canja tashar sauraran ssh

Bugu da ƙari muna gyara / sauransu / ssh / sshd_config kuma a cikin ɓangaren da yake magana game da tashar jiragen ruwa mun bar shi kamar haka:

# Port 22 Port 2000 (ko wani lambar da ta fi 2000. A cikin misalanmu za mu yi amfani da wannan.)

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Mun sake farawa sabis na ssh:

Fedora, RHEL, CentOS:

systemctl sake farawa sshd.service

Debian, Ubuntu:

service sshd sake kunnawa

Idan sunyi amfani da fail2ban ya zama dole a canza tsari dangane da sshd daidaita tashar jiragen ruwa.

nano /etc/fail2ban/jail.local

[sshd]
port    = ssh, 2000

[sshd-ddos]
port    = ssh, 2000

[dropbear]
port    = ssh, 2000

[selinux-ssh]
port    = ssh, 2000

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Muna sabunta sabis ɗin:

Fedora, RHEL, CentOS:

systemctl sake kunnawa fail2ban.service

Debian, Ubuntu:

Sabis ya kasa2ban sake farawa

Firewall

Fedora, RHEL, CentOS:

Selinux da Iptables suna aiki da tsoho a kan waɗannan tsarin kuma ina ba da shawarar ku ci gaba ta wannan hanyar. Yadda ake bude tashar jiragen ruwa da kayan kwalliya? Bari mu ga yadda za a buɗe sabon tashar 2000 ta tashar ssh da muka canza a baya:

Buɗe:

Nano / sauransu / sysconfig / iptables

kuma muna gyara layin da yake magana akan tsoffin tashar tashar ssh 22 kuma muka barshi kamar haka:

# -A jihar INPUT -m - jiha NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state - state NEW -m tcp --dport 2000 -j ACCEPT

Muna adanawa tare da CTRL + O kuma muna rufe tare da CTRL + X

Mun sake kunna sabis:

systemctl sake kunnawa iptables

Debian, Ubuntu:

A cikin Debian ko Ubuntu da abubuwan banbanci muna da katangar UFW wanda zai sauƙaƙa mana rayuwa tunda tana kula da Netfilter cikin sauƙi.

Shigarwa:

apt-samun shigar ufw ufw kunna

Don ganin matsayin buɗe tashoshin jiragen ruwa da muke aiwatarwa:

Matsayi ufw

Don buɗe tashar jiragen ruwa (a cikin misalinmu zai zama sabon tashar tashar ssh 2000):

ufw bada izinin 2000

Don ƙin yarda da tashar jiragen ruwa (a cikin yanayinmu zai zama tashar tashar tsoho ta 22 na ssh):

ufw musun 22 ufw share musanta 22

Kuma abokai a shirye. Wannan hanyar zasu kiyaye injunan ku. Kar ka manta da yin tsokaci kuma har zuwa lokaci na gaba: D.