Imikhuba emihle nge-OpenSSH

I-OpenSSH (Vula Igobolondo Eliphephile) isethi yezinhlelo zokusebenza ezivumela ukuxhumana okubethelwe ngenethiwekhi, kusetshenziswa i- umthetho ssh. Yenziwe njengenye indlela yamahhala nevulekile kuhlelo I-Shell evikelekile, okuyi-software ephathelene. « Wikipedia.

Abanye abasebenzisi bangacabanga ukuthi imikhuba emihle kufanele isetshenziswe kuphela kumaseva kanti akunjalo. Ukusabalalisa okuningi kwe-GNU / Linux kufaka i-OpenSSH ngokuzenzakalela futhi kunezinto ezimbalwa okufanele uzikhumbule.

Ukuphepha

Lawa amaphuzu abaluleke kakhulu ama-6 okufanele uwagcine engqondweni lapho ulungiselela i-SSH:

1. Sebenzisa iphasiwedi eqinile.
2. Shintsha imbobo ezenzakalelayo ye-SSH.
3. Sebenzisa njalo inguqulo 2 yephrothokholi ye-SSH.
4. Khubaza ukufinyelela kwezimpande.
5. Khawulela ukufinyelela komsebenzisi.
6. Sebenzisa ukufakazela ubuqiniso bokhiye.
7. Okunye okukhethwa kukho

Iphasiwedi eqinile

Iphasiwedi enhle yileyo equkethe izinhlamvu ze-alphanumeric noma ezikhethekile, izikhala, izinhlamvu ezinkulu nezincane... njll. Lapha phakathi DesdeLinux Sibonise izindlela ezimbalwa zokwenza amaphasiwedi amahle. Angavakashela Lesi sihloko y lokhu okunye.

Shintsha imbobo ezenzakalelayo

Imbobo ezenzakalelayo ye-SSH ingu-22 ukuyiguqula, konke okumele sikwenze ukuhlela ifayili / njll / ssh / sshd_config. Sifuna umugqa othi:

#Port 22

siyayikhulula bese siguqula ezingama-22 zenye inombolo .. ngokwesibonelo:

Port 7022

Ukwazi amachweba esingawasebenzisi kukhompyutha / kuseva yethu singayisebenzisa esigungwini:

$ netstat -ntap

Manje ukufinyelela ikhompyutha noma iseva yethu kufanele sikwenze ngoku -p inketho ngokulandelayo:

$ ssh -p 7022 usuario@servidor

Sebenzisa i-Protocol 2

Ukuqinisekisa ukuthi sisebenzisa inguqulo 2 yephrothokholi ye-SSH, kufanele sihlele ifayela / njll / ssh / sshd_config bese ubheka umugqa othi:

# Isivumelwano 2

Siyayikhulula bese siqala kabusha insiza ye-SSH.

Ungavumeli ukufinyelela njengezimpande

Ukuvimbela umsebenzisi wezimpande ukuthi akwazi ukufinyelela kude nge-SSH, sibheka kufayela/ njll / ssh / sshd_config umugqa:

#PermitRootLogin no

futhi asikuvumeli. Ngicabanga ukuthi kufanelekile ukucacisa ukuthi ngaphambi kokwenza lokhu kufanele siqiniseke ukuthi umsebenzisi wethu unezimvume ezidingekayo zokwenza imisebenzi yokuphatha.

Khawulela ukufinyelela ngabasebenzisi

Futhi akulimazi ukuvumela ukufinyelela nge-SSH kuphela kubasebenzisi abathile abathembekile, ngakho-ke sibuyela kufayela / njll / ssh / sshd_config futhi sengeza umugqa:

VumelaUsers elav usemoslinux kzkggaara

Lapho kusobala ukuthi, abasebenzisi elav, usemoslinux kanye ne-kzkggaara yibo abazokwazi ukufinyelela.

Sebenzisa ukufakazela ubuqiniso bokhiye

Yize le ndlela kunconywa kakhulu, kufanele sinakekele ngokukhethekile ngoba sizofinyelela kuseva ngaphandle kokufaka iphasiwedi. Lokhu kusho ukuthi uma umsebenzisi ekwazi ukungena kuseshini yethu noma eyebiwe ikhompyutha yethu, singaba senkingeni. Noma kunjalo, ake sibone ukuthi singakwenza kanjani.

Into yokuqala ukudala izikhiye ezimbili (zomphakathi nezangasese):

ssh-keygen -t rsa -b 4096

Ngemuva kwalokho sidlulisa ukhiye wethu siye kukhompyutha / iseva:

ssh-copy-id -i ~/.ssh/id_rsa.pub elav@200.8.200.7

Ekugcineni kufanele singakhululeki, kufayela / njll / ssh / sshd_config umugqa:

AuthorizedKeysFile .ssh/authorized_keys

Okunye okukhethwa kukho

Singasinciphisa isikhathi sokulinda lapho umsebenzisi angangena ngempumelelo ngempumelelo ohlelweni afike kumasekhondi angama-30

LoginGraceTime 30

Ukugwema ukuhlaselwa kwe-ssh ngokusebenzisa i-TCP Spoofing, kushiya uhlangothi lwe-ssh lubethelwe luphila isikhathi esingaphezu kwemizuzu emi-3, singazisebenzisa lezi zinketho ezi-3.

I-TCPKeepAlive no ClientAliveInterval 60 ClientAliveCountMax 3

Khubaza ukusetshenziswa kwama-rhosts noma ama-shosts, okuthi ngenxa yezizathu zokuphepha unxuswa ukuthi ungasetshenziswa.

ZibaIzivakashi yebo ZibaUseKaziIzivakashiYesho amaRhostsUkuqinisekiswa chaRhostsRSAUkuqinisekiswa cha

Hlola izimvume ezisebenzayo zomsebenzisi ngesikhathi sokungena ngemvume.

StrictModes yes

Nika amandla ukuhlukaniswa kwamalungelo.

UsePrivilegeSeparation yes

Iziphetho:

Ngokwenza lezi zinyathelo singangeza ukuphepha okwengeziwe kuma-computer nakumaseva ethu, kepha akumele sikhohlwe ukuthi kunesici esibalulekile: yini phakathi kwesihlalo nekhibhodi. Kungakho ngincoma ukufunda Lesi sihloko.

Umthombo: Kanjani