Khulisa ukhuseleko kwi-GNU / Linux

Sawubona a bahlobo DesdeLinux, lo prometido es deuda y aquí va un post de indlela yokwandisa ukhuseleko lweenkqubo zeLinux kwaye uhlale ngaloo ndlela ikhuselekile kubangeneleli ukongeza ekukhuseleni ulwazi kwiiseva zakho, iiPC okanye iilaptops!!!!

Comenzando

Fail2ban: sisicelo esibhalwe kwiPython ukunqanda ungenelelo kwinkqubo, esebenza ngokohlwaya okanye ukuvala imidibaniso ekude ezama ukufikelela ngokunyanzelwa ngenkohlakalo.

Ukufakwa:

Fedora, RHEL, CentOS:

yum install fail2ban

Debian, Ubuntu:

apt-get install fail2ban

Ukuseta:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local nano /etc/fail2ban/jail.local

Kwindawo ebizwa ngokuthi [DEFAULT] sikhulula kwaye silungise #bantime = 3600 siyishiya ngolu hlobo:

#bantime = 3600 bantime = 604800

Kwi [sshd] inxalenye esazisa inikwe amandla = yinyani, siyishiya ngolu hlobo:

#enabled = inyaniso inikwe amandla = yinyani

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqala inkonzo:

Fedora, RHEL, CentOS:

i-systemctl yenza ukuba i-fail2ban.service systemctl iqale i-fail2ban.service

Debian, Ubuntu:

inkonzo fail2ban ukuqala

Yala ukufikelela kweengcambu usebenzisa i-ssh:

Ukukhusela umatshini wethu siza kukhanyela i-ssh ngokusebenzisa ingcambu yomsebenzisi. Ukwenza oku, sihlela ifayile /etc/ssh/sshd_config ngolu hlobo lulandelayo:

cp sshd_config sshd_config.bck nano /etc/ssh/sshd_config

Siyazikhulula kwaye sitshintshe

#Umgaqo we2 weProtocol

Siyazikhulula kwaye sitshintshe

#PermitRootLogin ewe PermitRootLogin no

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqala inkonzo:

Fedora, RHEL, CentOS:

i-systemctl yenza ukuba i-sshd.service systemctl iqale i-sshd.service

Debian, Ubuntu:

inkonzo sshd ukuqala

Yala ukufikelela kwiseva ye-ssh usebenzisa isitshixo kwaye uvumele i-ssh kuphela ngamaqhosha e-RSA

Ukuba sifuna ukudibanisa ne-PC1 kwi-Server1, into yokuqala ekufuneka siyenzile kukuvelisa isitshixo sethu kwi-PC1. Ngomsebenzisi wethu kwaye ngaphandle kweengcambu kwi-PC1 senza:

ssh-keygen -t rsa -b 8192 (oku kuvelisa ngaphezu kwesitshixo esikhuselekileyo kuba izitshixo ezisuka ku-1024 ukuya ku-2048 ziqhele ukusetyenziswa)

Nje ukuba sinesitshixo sethu silayishe kwi-Server1:

ssh-copy-id user@server_ip

Nje ukuba kwenziwe oku siza kudibanisa kwi-Server1 yethu kwaye silungise ifayile ye-nano /etc/ssh/sshd_config ngeemvume zengcambu:

ssh umsebenzisi@Server1 nano /etc/ssh/sshd_config

Sitshintsha umgca othi #PasswordAuthentication ewe kule:

#Ukuqinisekiswa kwePassword ewe
Inombolo yoQinisekiso lwegama eliyimfihlo

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqala kwakhona inkonzo ye-ssh:

Fedora, RHEL, CentOS:

i-systemctl iqalise kwakhona i-sshd.service

Debian, Ubuntu:

inkonzo sshd iqale kwakhona

Guqula izibuko lokumamela le-ssh

Kwakhona sihlela /etc/ssh/sshd_config kwaye kwinxalenye ebhekisa kwizibuko siyishiya ngolu hlobo:

# Port 22 Port 2000 (okanye naliphi na elinye inani elikhulu kuno 2000. Kwimizekelo yethu siyakusebenzisa oku.)

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqala kwakhona inkonzo ye-ssh:

Fedora, RHEL, CentOS:

i-systemctl iqalise kwakhona i-sshd.service

Debian, Ubuntu:

inkonzo sshd iqale kwakhona

Ukuba usebenzisa fail2ban, kuyimfuneko ukutshintsha uqwalaselo malunga ne sshd ngokulungelelanisa izibuko.

nano /etc/fail2ban/jail.local

[sshd]
port    = ssh, 2000

[sshd-ddos]
port    = ssh, 2000

[dropbear]
port    = ssh, 2000

[selinux-ssh]
port    = ssh, 2000

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqalisa kwakhona inkonzo:

Fedora, RHEL, CentOS:

i-systemctl iqalisa kwakhona i-fail2ban.service

Debian, Ubuntu:

inkonzo fail2ban iqala kwakhona

Firewall

Fedora, RHEL, CentOS:

Kwezi nkqubo, iSelinux kunye nee-Iptables zenziwe zisebenze ngokungagqibekanga kwaye ndincoma ukuba uzigcine ngolo hlobo. Uvula njani izibuko ngee-Iptables? Makhe sibone indlela yokuvula izibuko elitsha 2000 le-ssh port esalitshintshileyo ngaphambili:

Vula:

nano /etc/sysconfig/iptables

kwaye silungisa umgca ubhekisa kokungagqibekanga ssh izibuko 22 kwaye uyishiye ngolu hlobo:

#-A Igalelo -m imo --state ENTSHA -m tcp -p tcp --dport 22 -j YAMKELE -A Igalelo -p tcp -m imo --state ENTSHA -m tcp --dport 2000 -j YAMKELE

Sigcina nge-CTRL+O kwaye sivale nge-CTRL+X

Siqalisa kwakhona inkonzo:

i-systemctl iqalisa kwakhona ii-iptables

Debian, Ubuntu:

Kwi-Debian okanye Ubuntu kunye ne-derivatives sine-firewall ye-UFW eya kwenza ubomi bethu bube lula kuba ilawula i-Netfilter ngokulula kakhulu.

Ukufakwa:

apt-fumana ukufaka ufw ufw vumela

Ukubona ubume bezibuko ezivulekileyo senza:

ubume ufw

Ukuvula izibuko (kumzekelo wethu iya kuba yi-ssh port entsha 2000):

ufw vumela i2000

Ukukhanyela izibuko (kwimeko yethu izakuba lizibuko elingagqibekanga 22 le ssh):

ufw khanyela 22 ufw cima khanyela 22

Nantso ke zihlobo. Ngale ndlela baya kugcina oomatshini bakho bekhuselekile. Ungalibali ukuphawula kwaye kude kube lixesha elizayo :D.