Khulisa ukuphepha ku-GNU / Linux

Sawubona abangane kusuka DesdeLinux, okwathenjiswa isikweletu nansi iposi mayelana ukukhulisa kanjani ukuvikelwa kwezinhlelo zeLinux futhi uhlale unjalo ephephile kubantu abangenayo kanye nokuvikela imininingwane kumaseva wakho, ama-PC noma ama-laptops !!!!

I-Comenzando

I-Fail2ban: uhlelo lokusebenza olubhalwe ePython ukuvimbela ukungena ohlelweni, olusebenza ngokujezisa noma ngokuvimba ukuxhumana okukude okuzama ukufinyelela ngamandla.

Ukufaka:

I-Fedora, RHEL, CentOS:

yum install fail2ban

I-Debian, Ubuntu:

apt-get install fail2ban

Ukusetha:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local nano /etc/fail2ban/jail.local

Engxenyeni ebizwa nge- [DEFAULT] asixhumanisi futhi siguqula i- #bantime = 3600 siyishiya kanjena:

#bantime = 3600 bantime = 604800

Engxenyeni ye- [sshd] sethula i-enabled = true ukuyishiya kanjena:

#enabled = true inikwe amandla = kuyiqiniso

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Siqala isevisi:

I-Fedora, RHEL, CentOS:

i-systemctl inika amandla i-fail2ban.service systemctl qala i-fail2ban.service

I-Debian, Ubuntu:

insizakalo yehlulekile ukuvalwa kokuqala

Yenqaba ukufinyelela kwezimpande usebenzisa i-ssh:

Ukuvikela umshini wethu sizokwenqaba i-ssh ngomsebenzisi wezimpande. Ukuze senze lokhu, sihlela ifayela le / etc / ssh / sshd_config kanje:

cp sshd_config sshd_config.bck nano / njll / ssh / sshd_config

Asithandeki futhi siyashintsha

Isivumelwano 2 # Protocol 2

Asithandeki futhi siyashintsha

#PermitRootLogin yebo Imvume yeRootLogin cha

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Siqala isevisi:

I-Fedora, RHEL, CentOS:

i-systemctl inika amandla i-sshd.service systemctl qala sshd.service

I-Debian, Ubuntu:

service sshd qala

Yenqaba ukufinyelela kuseva ye-ssh usebenzisa iphasiwedi bese uvumela i-ssh kuphela ngokhiye be-RSA

Uma sifuna ukuxhumana ne-PC1 ku-Server1, into yokuqala okufanele uyenze ukukhiqiza ukhiye wethu ku-PC1. Ngomsebenzisi wethu futhi ngaphandle kwezimpande ku-PC1 senza:

i-ssh-keygen -t rsa -b 8192 (lokhu kukhiqiza ukhiye ongaphezu kokuvikelekile ngoba okhiye abavela ku-1024 kuya ku-2048 bavame ukusetshenziswa)

Lapho sesine-password yethu, siyilayisha kuServer1:

ssh-copy-id umsebenzisi @ server_ip

Uma lokhu sekwenziwe, sizoxhuma kwi-Server1 yethu futhi siguqule ifayela le-nano / etc / ssh / sshd_config ngezimvume zempande:

umsebenzisi we-ssh @ Server1 nano / etc / ssh / sshd_config

Siguqula ulayini othi #PasswordAuthentication yebo kulokhu:

#PasswordAuthentication yebo
IphasiwediUkuqinisekisa cha

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Siqala kabusha insizakalo ye-ssh:

I-Fedora, RHEL, CentOS:

ukuqala kabusha kwesistimu sshd.service

I-Debian, Ubuntu:

service sshd qala kabusha

Shintsha imbobo yokulalela ye-ssh

Siphinde sihlele / njll / ssh / sshd_config futhi engxenyeni ebhekise ethekwini siyishiya kanjena:

# Port 22 Port 2000 (noma enye inombolo engaphezu kuka 2000. Ezibonelweni zethu sizokusebenzisa lokhu.)

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Siqala kabusha insizakalo ye-ssh:

I-Fedora, RHEL, CentOS:

ukuqala kabusha kwesistimu sshd.service

I-Debian, Ubuntu:

service sshd qala kabusha

Uma besebenzisa i-fail2ban kuyadingeka ukushintsha ukucushwa maqondana ne-sshd yokulungisa itheku.

nano /etc/fail2ban/jail.local

[sshd]
port    = ssh, 2000

[sshd-ddos]
port    = ssh, 2000

[dropbear]
port    = ssh, 2000

[selinux-ssh]
port    = ssh, 2000

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Sivuselela isevisi:

I-Fedora, RHEL, CentOS:

ukuqala kabusha kwesistimu kwehluleka2ban.service

I-Debian, Ubuntu:

insiza ihluleka2ban ukuqala kabusha

firewall

I-Fedora, RHEL, CentOS:

Ama-Selinux nama-Iptable enziwa asebenza ngokuzenzakalela kulezi zinhlelo futhi ngincoma ukuthi uqhubeke ngale ndlela. / Ungavula kanjani itheku ngama-iptables? Ake sibheke ukuthi ingavulwa kanjani i-port 2000 entsha ye-ssh port esiyishintshe ngaphambili:

Vula:

nano / etc / sysconfig / iptables

futhi siguqula umugqa obhekise esizindeni ssh port 22 bese usishiya kanjena:

# -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 2000 -j ACCEPT

Songa nge-CTRL + O futhi sivale nge-CTRL + X

Siqala kabusha insiza:

systemctl qala kabusha iptables

I-Debian, Ubuntu:

Ku-Debian noma ku-Ubuntu nakwezinye izinto esivela kuzo sine-firewall yeUFW ezokwenza impilo ibe lula kithina ngoba iphatha iNetfilter ilula kakhulu.

Ukufaka:

thola ukufaka ufw ufw inika amandla

Ukubona isimo samachweba avulekile esikwenzayo:

isimo se-ufw

Ukuvula itheku (ngokwesibonelo sethu kuzoba yi-ssh port 2000 entsha):

ufw vumela 2000

Ukwenqaba itheku (kithi kuzoba itheku elizenzakalelayo 22 le-ssh):

ufw khanyela i-22 ufw susa ukuphika i-22

Futhi abangane abakulungele. Ngale ndlela bazogcina imishini yakho iphephile. Ungakhohlwa ukuphawula kuze kube ngokuzayo: D.