标签：
1 [root@linl_C ~]# ssh-keygen 2 Generating public/private rsa key pair. 3 Enter file in which to save the key (/root/.ssh/id_rsa): 4 Enter passphrase (empty for no passphrase): 5 Enter same passphrase again: 6 Your identification has been saved in /root/.ssh/id_rsa. #$HOME/.ssh/id_rsa私钥 7 Your public key has been saved in /root/.ssh/id_rsa.pub. #$HOME/.ssh/id_rsa.pub公钥 8 The key fingerprint is: 9 ca:d7:72:c0:ee:5d:61:cc:ea:e4:06:c4:b4:a5:7f:cf root@linl_C 10 The key‘s randomart image is: 11 +--[ RSA 2048]----+ 12 | | 13 | . . | 14 | o + | 15 | .= o | 16 | .S. = | 17 | . o.o.o.. | 18 | o +.=..o | 19 | o B.. E | 20 | ..+ | 21 +-----------------+ 22 [root@linl_C ~]# ls .ssh/ 23 id_rsa id_rsa.pub
1 [root@linl_C ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub lin_S #如果用root账号，则主机可以省略用户名 2 root@lin_s‘s password: 3 Now try logging into the machine, with "ssh ‘lin_S‘", and check in: 4 .ssh/authorized_keys 5 to make sure we haven‘t added extra keys that you weren‘t expecting.
1 [root@linl_C ~]# ssh lin_S #无交互登录 2 Last login: Fri May 20 11:00:50 2016 from 10.0.0.16 3 [root@linl_S ~]# ls $HOME/.ssh/ #在lin_S上$HOME/.ssh/下查看拷贝过来的文件，会将id_rsa.pub重命名为authorized_keys 4 authorized_keys known_hosts
1 [root@linl_C ~]# ssh-copy-id -i .ssh/id_rsa.pub linypwb@lin_S 2 linypwb@lin_s‘s password: 3 Now try logging into the machine, with "ssh ‘linypwb@lin_S‘", and check in: 4 .ssh/authorized_keys 5 to make sure we haven‘t added extra keys that you weren‘t expecting. 6 [root@linl_C ~]# ssh linypwb@lin_S 7 Last login: Fri May 20 11:30:07 2016 from lin_c 8 [linypwb@linl_S ~]$ 9 [linypwb@linl_S ~]$ ls .ssh/ 10 authorized_keys
1 [root@linl_S ~]# vi /etc/ssh/sshd_config 2 #PasswordAuthentication yes #将认证设置为no 3 PasswordAuthentication no 4 [root@linl_S ~]# service sshd restart #重启sshd服务 5 Stopping sshd: [ OK ] 6 Starting sshd: [ OK ]
互动：是否可以禁止root身份登录？ 不行，因为有些程序需要使用root身份登录并运行。另外判断一个用户是不是超级管理员，看的是用户的ID是否为0。
1）修改登录shell
将 /bin/bash 改为 /sbin/nologin
1 [root@linl_S ~]# vim /etc/passwd 2 #root:x:0:0:root:/root:/bin/bash 3 root:x:0:0:root:/root:/sbin/nologin
1 [root@linl_S ~]# vim /etc/ssh/sshd_config 2 #PermitRootLogin yes 3 PermitRootLogin no
1 [root@linl_S ~]# vi /etc/passwd 2 #linypwb:x:500:500::/home/linypwb:/bin/bash 3 linypwb:x:0:0::/home/linypwb:/bin/bash 4 5 [root@linl_C ~]# ssh linypwb@lin_S 6 linypwb@lin_s‘s password: 7 Last login: Fri May 20 14:22:53 2016 from lin_c 8 [root@linl_S ~]# id linypwb 9 uid=0(root) gid=0(root) groups=0(root) 10 [root@linl_S ~]# pwd 11 /home/linypwb 12 [root@linl_S ~]# whoami 13 root
1 [root@linl_S ~]# rpm -ivh /mnt/Packages/lrzsz-0.12.20-27.1.el6.x86_64.rpm 2 warning: /mnt/Packages/lrzsz-0.12.20-27.1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY 3 Preparing... ########################################### [100%] 4 1:lrzsz ########################################### [100%] 5 [root@linl_S ~]# rz #选择上传安装包 6 [root@linl_S ~]# ls fail2ban* 7 fail2ban-0.8.14.tar.gz
1 [root@linl_S ~]# tar -zxf fail2ban-0.8.14.tar.gz 2 [root@linl_S ~]# ls 3 fail2ban-0.8.14 fail2ban-0.8.14.tar.gz
1 [root@linl_S ~]# vim fail2ban-0.8.14/README.md
1 [root@linl_S ~]# python -V 2 Python 2.6.6
5）安装fail2ban1 [root@linl_S ~]# cd fail2ban-0.8.14 2 [root@linl_S fail2ban-0.8.14]# python setup.py install 3 running install 4 running build 5 ... 6 Please do not forget to update your configuration files. 7 They are in /etc/fail2ban/.
1 [root@linl_S fail2ban-0.8.14]# cp files/redhat-initd /etc/init.d/fail2ban 2 [root@linl_S fail2ban-0.8.14]# chkconfig --add fail2ban 3 [root@linl_S fail2ban-0.8.14]# chkconfig --list fail2ban 4 fail2ban 0:off 1:off 2:off 3:on 4:on 5:on 6:off
1 [root@linl_S fail2ban-0.8.14]# grep chkconfig ./* -R 2 ./files/redhat-initd:# chkconfig: - 92 08
1 [root@linl_S ~]# ls /etc/fail2ban/ 2 action.d fail2ban.conf fail2ban.d filter.d jail.conf jail.d
1 [DEFAULT] #全局设置 2 ignoreip = 127.0.0.1/8 #忽略的IP列表,不受设置限制 3 bantime = 600 #屏蔽时间，单位：秒 4 findtime = 600 #这个时间段内超过规定次数会被ban掉 5 maxretry = 3 #最大尝试次数 6 backend = auto #日志修改检测机制（gamin、polling和auto这三种） 7 [sshd] #单个服务检查设置，如设置bantime、findtime、maxretry和全局冲突，服务优先级大于全局设置。 8 enabled = false #是否激活此项（true/false） 9 filter = sshd #过滤规则filter的名字，对应filter.d目录下的sshd.conf 10 action = iptables[name=SSH, port=ssh, protocol=tcp] #动作的相关参数，对应action.d/iptables.conf文件 11 sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com, sendername="Fail2Ban"] #触发报警的收件人 12 logpath = /var/log/sshd.log #检测的系统的登陆日志文件。
1 [ssh-iptables] 2 enabled = true #是否激活此项（true/false）修改成 true 3 filter = sshd 4 action = iptables[name=SSH, port=ssh, protocol=tcp] 5 sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com, sendername="Fail2Ban"] 6 logpath = /var/log/secure #这里要写sshd服务日志文件 7 findtime = 300 #在5分钟内内出现规定次数就开始工作 8 maxretry = 3 #3次密码验证失败 9 bantime = 3600 #禁止用户IP访问主机1小时
1 [root@linl_S ~]# service fail2ban start 2 Starting fail2ban: [ OK ]
1 [root@linl_S ~]# > /var/log/secure #清空日志，从现在开始 2 [root@linl_S ~]# /etc/init.d/fail2ban restart #重启fail2ban 服务 3 Stopping fail2ban: [ OK ] 4 Starting fail2ban: [ OK ] 5 [root@linl_S ~]# iptables -nL #查看防火墙状态 6 Chain INPUT (policy ACCEPT) 7 target prot opt source destination 8 fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 9 10 Chain FORWARD (policy ACCEPT) 11 target prot opt source destination 12 13 Chain OUTPUT (policy ACCEPT) 14 target prot opt source destination 15 16 Chain fail2ban-SSH (1 references) #多出一条fail2ban-SSH的规则链 17 target prot opt source destination 18 RETURN all -- 0.0.0.0/0 0.0.0.0/0
1 [root@linl_C ~]# ssh lin_S #正确密码可以登录 2 root@lin_s‘s password: 3 Last login: Fri May 20 19:26:32 2016 from 10.0.0.1 4 [root@linl_S ~]# ssh lin_S 5 ssh: Could not resolve hostname lin_S: Name or service not known 6 [root@linl_S ~]# logout 7 Connection to lin_S closed. 8 [root@linl_C ~]# ssh lin_S #3次错误密码后，被拒绝 9 root@lin_s‘s password: 10 Permission denied, please try again. 11 root@lin_s‘s password: 12 Permission denied, please try again. 13 root@lin_s‘s password: 14 Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). 15 [root@linl_C ~]# ssh lin_S #重新尝试，被锁定 16 ssh: connect to host lin_S port 22: Connection refused
1 [root@linl_S ~]# iptables -nL |tail -4 #查看防火墙，多了一条REJECT条目，禁止10.0.0.16主机访问 2 Chain fail2ban-SSH (1 references) 3 target prot opt source destination 4 REJECT all -- 10.0.0.16 0.0.0.0/0 reject-with icmp-port-unreachable 5 RETURN all -- 0.0.0.0/0 0.0.0.0/0 6 [root@linl_S ~]# fail2ban-client status #查看fail2ban 工作状态 7 Status 8 |- Number of jail: 1 9 `- Jail list: ssh-iptables 10 [root@linl_S ~]# fail2ban-client status ssh-iptables #查看具体某一项工作状态 11 Status for the jail: ssh-iptables 12 |- filter 13 | |- File list: /var/log/secure #读取的日志：/var/log/secure 14 | |- Currently failed: 0 15 | `- Total failed: 3 #一共失败了3次 16 `- action 17 |- Currently banned: 1 #当前ban掉了1个IP 18 | `- IP list: 10.0.0.16 #IP 19 `- Total banned: 1
1 [root@linl_S ~]# vim /var/log/fail2ban.log 2 ... 3 #2016-05-20 20:03:17,553 fail2ban.actions[3465]: WARNING [ssh-iptables] Ban 10.0.0.16 #删除ban掉IP 的日志信息 4 [root@linl_S ~]# service fail2ban restart 5 Stopping fail2ban: [ OK ] 6 Starting fail2ban: [ OK ] 7 [root@linl_C ~]# ssh lin_S #此时，lin_C再尝试可以进行登录 8 root@lin_s‘s password: 9 Last login: Fri May 20 19:34:43 2016 from lin_c 10 [root@linl_S ~]#
1 [root@linl_S ~]# iptables -F #清空防火墙 2 [root@linl_S ~]# iptables -nL |tail -2 #REJECT条目已清空 3 Chain fail2ban-SSH (0 references) 4 target prot opt source destination 5 6 [root@linl_C ~]# ssh lin_S #此时，lin_C再尝试可以进行登录 7 root@lin_s‘s password: 8 Last login: Fri May 20 20:08:17 2016 from lin_c 9 [root@linl_S ~]#
1 [root@linl_C ~]# scp /etc/passwd root@10.0.0.15:/tmp 2 root@10.0.0.15‘s password: 3 passwd 100% 1578 1.5KB/s 00:00
1 [root@linl_S ~]# scp root@10.0.0.16:/etc/passwd /tmp 2 root@10.0.0.16‘s password: 3 passwd 100% 1578 1.5KB/s 00:00
标签：
原文地址：http://www.cnblogs.com/linypwb/p/5568069.html
