[关闭]
@mrz1 2018-01-09T09:24:23.000000Z 字数 3592 阅读 3764

SSH远程登录配置文件sshd_config详解

服务

/etc/ssh/sshd_config
man sshd_config 帮助

  1. [root@centos7 ~]#cat /etc/ssh/sshd_config
  2. #Port 22 //这个是ssh服务的监听端口，在实际生产环境中一般都不用默认的22端口 
  4. #AddressFamily any //any默认ipv4 ipv6
  5. #ListenAddress 0.0.0.0 
  6. #ListenAddress ::
  7. ListenAddress用来设置sshd服务器绑定的IP地址;监听的主机适配卡，举个例子来说，如果您有两个 IP， 分别是 192.168.0.11 及 192.168.2.20 那么只想要开放192.168.0.11时，就可以设置为：ListenAddress 192.168.0.11表示只监听来自 192.168.0.11 这个 IP 的SSH联机。如果不使用设定的话，则预设所有接口均接受 SSH
  9. HostKey /etc/ssh/ssh_host_rsa_key 使用的 RSA 私钥
  10. HostKey /etc/ssh/ssh_host_ecdsa_key
  11. HostKey /etc/ssh/ssh_host_ed25519_key
  13. # Logging
  14. #SyslogFacility AUTH
  15. SyslogFacility AUTHPRIV   日志
  16. #LogLevel INFO
  18. # Authentication:
  20. #LoginGraceTime 2m 宽限登录时间不输入密码两分钟自动退出
  21. #PermitRootLogin yes 改为no 是不让root连接（登录普通用户在切换到root可以）
  22. #StrictModes yes 检查.ssh/文件的所有者，权限等
  23. #MaxAuthTries 6 最大认证次数的一般6/2=3
  24. #MaxSessions 10 克隆会话最大连接
  26. #PubkeyAuthentication yes 支持公钥验证（一般开启公钥验证关闭用户登录）
  28. # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
  29. # but this is overridden so installations will only check .ssh/authorized_keys
  30. AuthorizedKeysFile      .ssh/authorized_keys
  32. #AuthorizedPrincipalsFile none
  34. #AuthorizedKeysCommand none
  35. #AuthorizedKeysCommandUser nobody
  37. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  38. #HostbasedAuthentication no
  39. # Change to yes if you don't trust ~/.ssh/known_hosts for
  40. # HostbasedAuthentication
  41. #IgnoreUserKnownHosts no
  42. # Don't read the user's ~/.rhosts and ~/.shosts files
  43. #IgnoreRhosts yes
  45. # To disable tunneled clear text passwords, change to no here!
  46. #PasswordAuthentication yes 
  47. #PermitEmptyPasswords no (允许空口令吗) 拒绝用户登录（一般开启公钥验证关闭用户登录）
  48. PasswordAuthentication yes
  50. # Change to no to disable s/key passwords
  51. #ChallengeResponseAuthentication yes
  52. ChallengeResponseAuthentication no
  54. # Kerberos options
  55. #KerberosAuthentication no
  56. #KerberosOrLocalPasswd yes
  57. #KerberosTicketCleanup yes
  58. #KerberosGetAFSToken no
  59. #KerberosUseKuserok yes
  61. # GSSAPI options
  62. GSSAPIAuthentication yes//这里改为no 是让连接速度 加快
  63. GSSAPICleanupCredentials no 
  64. #GSSAPIStrictAcceptorCheck yes
  65. #GSSAPIKeyExchange no
  66. #GSSAPIEnablek5users no
  68. # Set this to 'yes' to enable PAM authentication, account processing,
  69. # and session processing. If this is enabled, PAM authentication will
  70. # be allowed through the ChallengeResponseAuthentication and
  71. # PasswordAuthentication.  Depending on your PAM configuration,
  72. # PAM authentication via ChallengeResponseAuthentication may bypass
  73. # the setting of "PermitRootLogin without-password".
  74. # If you just want the PAM account and session checks to run without
  75. # PAM authentication, then enable this but set PasswordAuthentication
  76. # and ChallengeResponseAuthentication to 'no'.
  77. # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
  78. # problems.
  79. UsePAM no
  81. #AllowAgentForwarding yes
  82. #AllowTcpForwarding yes
  83. #GatewayPorts no (网关)
  84. X11Forwarding yes
  85. #X11DisplayOffset 10
  86. #X11UseLocalhost yes
  87. #PermitTTY yes
  88. #PrintMotd yes
  89. #PrintLastLog yes
  90. #TCPKeepAlive yes
  91. #UseLogin no
  92. #UsePrivilegeSeparation sandbox
  93. #PermitUserEnvironment no
  94. #Compression delayed
  95. #ClientAliveInterval 30 （没操作的话30秒一到就断开连接）
  96. #ClientAliveCountMax 0（没操作的话30秒一到就断开连接）
  97. #ShowPatchLevel no
  98. #UseDNS yes //这里改为no 是让连接速度 加快
  99. #PidFile /var/run/sshd.pid //运行的服务编号 
  100. #MaxStartups 10:30:100 //当连接数超过10会以30%的失败率拒绝用户登录（达到100，100%拒绝）
  101. #PermitTunnel no
  102. #ChrootDirectory none
  103. #VersionAddendum none
  105. # no default banner path
  106. #Banner none //ssh登录提示信息
  107. Banner /etc/ssh/banner.txt //ssh登录读取内容
  109. # Accept locale-related environment variables
  110. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
  111. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
  112. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
  113. AcceptEnv XMODIFIERS
  114. AllowUsers wang //默认没这一行添加 只允许网用户登录（包括root）白名单
  115. DenyUsers  黑名单（优先级高）
  116. AllowGroups
  117. DenyGroups
  119. # override default of no subsystems
  120. Subsystem       sftp    /usr/libexec/openssh/sftp-server
  122. # Example of overriding settings on a per-user basis
  123. #Match User anoncvs
  124. #       X11Forwarding no
  125. #       AllowTcpForwarding no
  126. #       PermitTTY no
  127. #       ForceCommand cvs server

tail /var/log/secure 查看日志

添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注