标签:inpu selinux exec sel 哈希 win dcl 系统环境 执行
Secure Shell(安全外壳协议,简称SSH)是一种加密的网络传输协议,可在不安全的网络中为网络服务提供安全的传输环境。SSH通过在网络中创建安全隧道来实现SSH客户端与服务器之间的连接。虽然任何网络服务都可以通过SSH实现安全传输,SSH最常见的用途是远程登录系统,人们通常利用SSH来传输命令行界面和远程执行命令。使用频率最高的场合类Unix系统,但是Windows操作系统也能有限度地使用SSH。
SSH本身是一个非常安全的认证连接方式。不过由于人过等方面的原因,难免会造成密码的泄露。针对这种问题我们不妨给SSH再加一把锁。当然,增加这层锁的方式有很多种。例如:knockd、S/KEY、OPIE/OPTW、Two-factor authentication等。
Google身份验证器是一款基于时间与哈希的一次性密码算法的两步验证软件令牌,此软件用于Google的认证服务。此项服务所使用的算法已列于 RFC 6238 和 RFC 4226 中。
Google身份验证器给予用户一个六位到八位的一次性密码用于进行登录Google或其他站点时的附加验证。其同样可以给第三方应用生成口令,例如密码管家程序或网络硬盘。先前版本的Google身份验证器开放源代码,但之后的版本以专有软件的形式公开。
[root@clsn.io /root] clsn.io Blog WebSite #cat /etc/redhat-release CentOS release 6.8 (Final) [root@clsn.io /root] clsn.io Blog WebSite #uname -a Linux clsn.io 4.10.5-1.el6.elrepo.x86_64 #1 SMP Wed Mar 22 14:55:33 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux [root@clsn.io /root] clsn.io Blog WebSite #sestatus SELinux status: disabled
yum -y install wget gcc make pam-devel libpng-devel
# 可在google的github下载 wget https://github.com/google/google-authenticator/archive/1.02.tar.gz tar xf 1.02.tar.gz cd google-authenticator-1.02/libpam/ ./bootstrap.sh ./configure make && make install
安装完成后会在 /usr/local/lib/security/pam_google_authenticator.so生成一个 库文件,
系统还会多在/usr/local/bin目录生成一个google-authenticator可执行文件,通过运行该命令进行配置。
# cp /usr/local/lib/security/pam_google_authenticator.so /lib64/security/
[root@clsn.io /lib64/security] clsn.io Blog WebSite #google-authenticator Do you want authentication tokens to be time-based (y/n) n # 是否基于时间的认证,为了防止不同跨时区的问题,这里选择n https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://hotp/root@clsn.io%3Fsecret%3*****%26issuer%3Dclsn.io # s生成的二维码 Your new secret key is: **** Your verification code is 5****0 Your emergency scratch codes are: 40****84 19****95 60****78 83****92 31****58 # 这5个码用于在取不到或错的验证码有错时,用于应急用的。不过每个只能用一次,不能重复使用。 Do you want me to update your "/root/.google_authenticator" file? (y/n) y By default, three tokens are valid at any one time. This accounts for generated-but-not-used tokens and failed login attempts. In order to decrease the likelihood of synchronization problems, this window can be increased from its default size of 3 to 17. Do you want to do so (y/n) y If the computer that you are logging into isn‘t hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting (y/n) y
添加pam认证,在第一行添加
# vim /etc/pam.d/sshd auth required pam_google_authenticator.so ------------------------------------------------------------------ #cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth required pam_google_authenticator.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth
修改sshd配置
# vim /etc/ssh/sshd_config ChallengeResponseAuthentication no #把上面配置改成
重启 sshd 服务
# service sshd restart
(版本5.00,更新日期 2017年9月27日)
下载地址:https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=zh
CLSN镜像地址 https://clsn.io/files/google/com.google.android.apps.authenticator.apk
获取30秒一次的动态码的客户端是浏览器(仅支持chrome、firefox)、Android设备、苹果IOS设备、Blackberry、WP手持设备。各自程序的下载地址为:
chrome google-authenticator插件
firefox google-authenticator插件
import hmac, base64, struct, hashlib, time def calGoogleCode(secretKey): input = int(time.time())//30 key = base64.b32decode(secretKey) msg = struct.pack(">Q", input) googleCode = hmac.new(key, msg, hashlib.sha1).digest() o = ord(googleCode[19]) & 15 googleCode = str((struct.unpack(">I", googleCode[o:o+4])[0] & 0x7fffffff) % 1000000) if len(googleCode) == 5: googleCode = ‘0‘ + googleCode return googleCode secretKey = ‘***这里填秘钥***‘ print calGoogleCode(secretKey)
http://www.361way.com/google-authenticator-ssh/2186.html
http://netsecurity.51cto.com/art/201305/392443.htm
https://blog.csdn.net/bwlab/article/details/51321746
https://github.com/google/google-authenticator/wiki
https://blog.csdn.net/RBPicsdn/article/details/81155054
SSH + Google Authenticator 安全加固
标签:inpu selinux exec sel 哈希 win dcl 系统环境 执行
原文地址:https://www.cnblogs.com/tu240302975/p/13339514.html