科技行者

行者学院 转型私董会 科技行者专题报道 网红大战科技行者

知识库

知识库 安全导航

至顶网网络频道安全增强措施用Openssh构建安全网络

安全增强措施用Openssh构建安全网络

  • 扫一扫
    分享文章到微信

  • 扫一扫
    关注官方公众号
    至顶头条

下面向大家介绍用Openssh构建安全网络。

作者:51cto 2007年10月14日

关键字:

  • 评论
  • 分享微博
  • 分享邮件

在本页阅读全文(共2页)

服务器配置如下:
/usr/local/etc/sshd_config:
# $OpenBSD: sshd_config,v 1.56 2002/06/20 23:37:12 markus Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
#Port 22
#Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::
# HostKey for protocol version 1
HostKey /usr/local/etc/ssh_host_key
# HostKeys for protocol version 2
HostKey /usr/local/etc/ssh_host_rsa_key
HostKey /usr/local/etc/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768
# Logging
#obsoletes QuietMode and FascistLogging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
#LoginGraceTime 600
#PermitRootLogin yes
#StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /usr/local/etc/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#AFSTokenPassing no
# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no
# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt yes
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
UsePrivilegeSeparation yes
Compression yes
#MaxStartups 10
# no default banner path
#Banner /some/path
#VerifyReverseMapping no
# override default of no subsystems
Subsystem sftp /usr/local/libexec/sftp-server
这里关闭了SSH的密码验证方式,采用RSA的密钥验证方法,用户需要首先在服务器上用ssh-keygen –t rsa在自己的主目录下.ssh目录里自动生成密钥对,id_rsa(私钥)和id_rsa.pub(公钥),然后手工将id_rsa.pub拷贝成autohrized_keys文件.并将id_rsa和id_rsa..pub文件传至客户端保存好,同时删除服务器端的id_rsa和id_rsa.pub文件。
客户端测试:如果是UNIX客户端,将id_rsa和id_rsa.pub放在用户主目录的.ssh子目录下, 用ssh和sftp可以进行测试;如果是WINDOWS系统的客户端,可以通过SECURECRT指定authencation为publickey方式,并且在properties中的session settings中选用use identity file,指定具体的id_rsa的文件位置,即可登录。这样,只有拥有密钥对的用户才可以登录。当然,得保护好自己的钥匙不可泄露,为安全起见,服务器需要定时改变每个用户的密钥。
通过以上对intranet内部服务器的安全配置,实现了安全性和方便性的整合。
    • 评论
    • 分享微博
    • 分享邮件
    邮件订阅

    如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。

    重磅专题
    往期文章
    最新文章