sshd

Configuration

Port 监听端口
ListenAddress 监听地址
Protocol 2 使用SSH Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
UsePrivilegeSeparation yes 使用权限分离
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel [DEBUG] 日志级别
LoginGraceTime 登录验证过程中，切断连接之前服务器需要等待的时间
PermitRootLogin [no/yes] 允许root登录
StrictModes yes
MaxAuthTries 最大错误尝试的次数
RSAAuthentication [no/yes] 允许RSA验证
PubkeyAuthentication [no/yes]
AuthorizedKeysFile %h/.ssh/* 公钥路径
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
IgnoreUserKnownHosts yes
PermitEmptyPasswords [no/yes] 允许空密码
ChallengeResponseAuthentication no 是否响应任何形式的认证
PasswordAuthentication [no/yes] 允许口令验证
KerberosAuthentication no
KerberosGetAFSToken no
KerberosOrLocalPasswd yes
KerberosTicketCleanup yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no 设置登录后是否显示一些信息，即打印出/etc/motd文件的内容，考虑到安全可以设置为no。
PrintLastLog 设置登录时打印最后一次登录记录
TCPKeepAlive yes
UseLogin no
MaxStartups  2:50:3 设置从第2个尚未登录的连接开始，以50%的几率拒绝新连接，直到全部尚未登录的连接数达到3
Banner 登录后的提示消息
UsePAM 使用PAM来管理认证
ClientAliveInterval 客户端超时
ClientAliveCountMax 客户端超时最大次数
UsePrivilegeSeparation 设置用户的权限
Compression 设置是否可以是用压缩命令，可以设置为yes
AllowUsers [user@host]允许的用户
AllowGroups [group]允许的组
DenyUsers [user@host]拒绝的用户

Security

TCP Wrappers

Use TCP wrappers to wrap sshd in TCP, only allowing specific hosts to connect to the ssh server

vi /etc/hosts.allow
sshd:*.*.*.* 允许该IP SSH连接
vi /etc/hosts.deny
sshd:ALL 除了hosts.allow中允许的，其他IP都禁止SSH连接

PAM

Two-factor login authentication can be done using PAM - Pluggable Authentication Modules [1] [2]

Note: a key takes priority over PAM — if a key exists, you can bypass PAM authentication and log in directly with the key. Of course, you can also set a hook command on the key to work around this

knockd

The most drastic option for hardening a computer’s security is: close all open ports, so that no attack can get through to your computer. [3] Only open the needed port to a user who can supply the “secret knock”, letting them then enter a password and access the computer. The port-knocking daemon knockd watches for the knock sequence, and performs the corresponding action once a valid sequence is detected.

Web-based

Accessing the ssh service through a web browser [4]

References