扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
1. 安装软件包:
openssh-3.4pl-sol7-sparc-local
openssl-0.96d-sol7-sparc-local
zlib-1.1.4-sol7-sparc-local
prngd-0.0.25-sol7-sparc-local
egd-0.8-sol7-sparc-local
2. 安装prngd和sshd的启动脚本
::::::::::::::
S98prngd
::::::::::::::
#!/bin/sh
pid=`/usr/bin/ps -e | /usr/bin/grep prngd | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'`
case $1 in
'start')
/usr/local/sbin/prngd /var/spool/prngd/pool
;;
'stop')
if [ "${pid}" != "" ]
then
/usr/bin/kill ${pid}
fi
;;
*)
echo "usage: /etc/init.d/prngd {start|stop}"
;;
esac
::::::::::::::
S98sshd
::::::::::::::
#!/bin/sh
pid=`/usr/bin/ps -e | /usr/bin/grep sshd | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'`
case $1 in
'start')
/usr/local/sbin/sshd
;;
'stop')
if [ "${pid}" != "" ]
then
/usr/bin/kill ${pid}
fi
;;
*)
echo "usage: /etc/init.d/sshd {start|stop}"
;;
esac
3. 用prngd生成伪随机初始种子数
cat /var/log/syslog /var/adm/messages >/usr/local/etc/prngd/prngd-seed
mkdir /var/spool/prngd
/etc/rc2.d/S98prngd start
检查prngd工作是否正常: /usr/local/bin/egc.pl /var/spool/prngd/pool get
显示如: 9151 bits of entropy in pool
4. 增加sshd用户
mkdir /var/empty
chown root /var/empty
chgrp sys /var/empty
chmod 755 /var/empty
groupadd sshd
useradd –g sshd –c ‘sshd privsep’ –d /var/empty –s /bin/false sshd
5. 修改tcpd的控制文件/etc/hosts.allow和/etc/hosts.deny
ALL:n.n.n.n #登录主机IP
6. 在server端创建主机密钥对
ssh-keygen –t rsa1 –f /usr/local/etc/ssh_host_key –N “”
ssh-keygen –t dsa –f /usr/local/etc/ssh_host_dsa_key –N “”
ssh-keygen –t rsa –f /usr/local/etc/ssh_host_rsa_key –N “”
启动sshd:
/etc/rc2.d/S98sshd start
7. 关闭原telnet和ftp服务
修改/etc/inetd.conf 文件,kill –HUP
8. 在客户端做以下测试
UNIX客户端:
Ssh [-l username] [-p port]
Sftp [-l username] [-p port]
WINDOWS:客户端
Securecrt 3.4.5 //在session的配置中,authentication使用password方式
Securefx2.0.3
以上为默认安装情况,即SSH的密码验证。
为了保证唯一的一台登录服务器的安全,又不至于在修改sshd配置后重启进程带来无法登录管理的问题,继续使用telnet和ftp服务,结合采用SSHD的密钥验证方式,并且在/etc/hosts.allow文件中做以下设置:
################# internal network ######################
ALL:n.n.n.n #operator1
ALL:n.n.n.n #operator2
################## out network ###########################
sshd: ALL #RSA auth
这样,管理员在公司的固定IP地址仍旧可以很方便地登录到主机上操作,而如果在家中或外出出差,由于IP地址是非固定的,可以通过sshd的密钥验证来进行登录。
服务器配置如下:/usr/local/etc/sshd_config: # $OpenBSD: sshd_config,v 1.56 2002/06/20 23:37:12 markus Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options change a # default value. #Port 22 #Protocol 2,1 #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 HostKey /usr/local/etc/ssh_host_key # HostKeys for protocol version 2 HostKey /usr/local/etc/ssh_host_rsa_key HostKey /usr/local/etc/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging #obsoletes QuietMode and FascistLogging SyslogFacility AUTH LogLevel INFO # Authentication: #LoginGraceTime 600 #PermitRootLogin yes #StrictModes yes RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys # rhosts authentication should not be used #RhostsAuthentication no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # For this to work you will also need host keys in /usr/local/etc/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #AFSTokenPassing no # Kerberos TGT Passing only works with the AFS kaserver #KerberosTgtPassing no # Set this to 'yes' to enable PAM keyboard-interactive authentication # Warning: enabling this may bypass the setting of 'PasswordAuthentication' #PAMAuthenticationViaKbdInt yes #X11Forwarding no #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes #PrintLastLog yes #KeepAlive yes #UseLogin no UsePrivilegeSeparation yes Compression yes #MaxStartups 10 # no default banner path #Banner /some/path #VerifyReverseMapping no # override default of no subsystems Subsystem sftp /usr/local/libexec/sftp-server |
如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。
5G已至 转型当时——服务提供商如何把握转型的绝佳时机
去集群 更超群——大容量网络演进之路
2019 IBM 中国论坛
H3C 2019 Navigate 领航者峰会
助推数据中心网络现代化转型 打造灵活可靠基础架构平台