CentOS7下SSH服务学习笔记
测试环境：
[root@nmserver-7 ~]# uname -a
Linux nmserver-7.test.com 3.10.0-514.el7.centos.plus.i686 #1 SMP Wed Jan 25 12:55:04 UTC 2017 i686 i686 i386 GNU/Linux
[root@nmserver-7 ~]# cat /etc/redhat-release
CentOS release 7.3.1611 (AltArch)
[root@nmserver-7 ~]#
1、SSH服务安装
linux系统安装后默认已经开启ssh服务，并且包含ssh所有需要的软件了，但是还是有必要了解下已经安装的ssh是那个包提供的，
[root@nmserver-7 ~]# whereis sshd
sshd: /usr/sbin/sshd /usr/share/man/man8/sshd.8.gz
[root@nmserver-7 ~]# rpm -qf /usr/sbin/sshd
openssh-server-6.6.1p1-31.el7.i686
[root@nmserver-7 ~]#
也就是说假如没有ssh服务的话我们可以通过yum安装openssh-server来重新启动ssh服务
那么openssh-server都在系统中安装了什么文件？
[root@nmserver-7 ~]# rpm -ql openssh-server
/etc/pam.d/sshd
/etc/ssh/sshd_config #配置文件位置
/etc/sysconfig/sshd
/usr/lib/fipscheck/sshd.hmac
/usr/lib/systemd/system/sshd-keygen.service
/usr/lib/systemd/system/sshd.service
/usr/lib/systemd/system/sshd.socket
/usr/lib/systemd/system/sshd@.service
/usr/libexec/openssh/sftp-server
/usr/sbin/sshd
/usr/sbin/sshd-keygen
/usr/share/man/man5/moduli.5.gz
/usr/share/man/man5/sshd_config.5.gz
/usr/share/man/man8/sftp-server.8.gz
/usr/share/man/man8/sshd.8.gz
/var/empty/sshd
2、SSH服务启动
CentOS7.3下SSH服务的启动
[root@nmserver-7 ~]# systemctl stop sshd #停止
[root@nmserver-7 ~]# systemctl start sshd #开始
[root@nmserver-7 ~]# systemctl restart sshd #重启
[root@nmserver-7 ~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
Active: active (running) since 四 2017-08-24 16:32:52 CST; 1s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 2863 ExecStart=/usr/sbin/sshd $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 2864 (sshd)
CGroup: /system.slice/sshd.service
└─2864 /usr/sbin/sshd
8月 24 16:32:51 nmserver-7.test.com systemd[1]: Starting OpenSSH server d...
8月 24 16:32:52 nmserver-7.test.com systemd[1]: PID file /var/run/sshd.pi...
8月 24 16:32:52 nmserver-7.test.com sshd[2864]: Server listening on 0.0.0...
8月 24 16:32:52 nmserver-7.test.com sshd[2864]: Server listening on :: po...
8月 24 16:32:52 nmserver-7.test.com systemd[1]: Started OpenSSH server da...
Hint: Some lines were ellipsized, use -l to show in full.
查看ssd服务端口是否正常，
[root@nms ~]# netstat -tlnp |grep ssh
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1207/sshd
tcp 0 0 :::22 :::* LISTEN 1207/sshd
3、SSH原理（SSH服务器端与客户端的连接步骤）
step1:服务器建立公钥文件
每一次启动sshd服务时，该服务会主动去找/etc/ssh/ssh_host*文件，若系统刚安装完成，会没有公钥文件，
sshd会主动计算出这些需要的公钥文件，同时也会计算出服务器自己需要的私钥文件。
step2:客户端主动连接要求
若客户端想要连接到ssh服务器，则需要使用适当的客户端程序来连接，linux系统默认已经安装openssh-clients，包含SSH客户端；
windows下常用的客户端连接工具有xShell、SecureCart、Putty等
step3:服务器传送公钥文件给客户端
接收到客户端的要求后，服务器便将第一个步骤取的公钥文件以明码的形式传送给客户端；
step4:客户端记录/比对服务器的公钥数据及随机计算自己的公私钥；
客户端将接收到的公钥数据记录到客户端的用户主目录内的 ~/.ssh/known_hosts文件里，之后则开始计算客户端自己的公私钥数据；
step5:返回客户端的公私钥数据到服务器端
用户将自己的公钥传送给服务器，此时服务器具有服务器的私钥和客户端的公钥，而客户端具有服务器的公钥及客户端自己的私钥，你会看到，
在此次连接的服务器与客户端的密钥系统（公钥+私钥）并不一样，因此，才称为非对称密钥系统；
step6：服务器接收客户端的公钥开始双向加解密
（1）服务器到客户端：服务器传送数据时，使用客户端的公钥加密后进行发送，客户端接收后，用自己的私钥解密；
（2）客户端到服务器：客户端传送数据时，使用服务器的公钥进行加密数据然后发送给服务器，服务器接收后用服务器的私钥解密数据；
4、SSHD服务器配置
SSHD服务器的详细设置都放在/etc/ssh/sshd_config配置文件中，在配置文件中，只要是未被注释的设置值即为“默认值”
[root@nmserver-7 ssh]# cat /etc/ssh/sshd_config
# $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#ssh默认使用22端口，也可以使用多个Port,例如想要开放sshd在22和2200，则多加一行内容为：Port 2200 然后重启SSHD服务即可；
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#监听的主机网卡，默认值是监听所有接口的SSH要求
# The default requires explicit activation of protocol 1
#Protocol 2
#选择SSH协议版本，默认支持V2 如要支持旧版本V1，则改为“Protocol 2，1”
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key #ssh 版本使用的私钥
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key #ssh 版本2使用的RSA私钥
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key #ssh 版本2使用的ECDSA私钥
HostKey /etc/ssh/ssh_host_ed25519_key
#说明主机Private Key 放置的位置，默认使用上面文件
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024 #设置生产密钥的位数
# Ciphers and keying
#RekeyLimit default none
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH #当有人使用SSH登录系统的时候，SSH会记录信息；
SyslogFacility AUTHPRIV
#LogLevel INFO #设置日志等级
# Authentication: # 以下是安全设置项目
#LoginGraceTime 2m
#PermitRootLogin yes #是否允许root登录。默认是允许的，建议设置成no
#StrictModes yes #是否让SSDH去检查用户主目录或相关文件的权限数据；
#MaxAuthTries 6
#MaxSessions 10
#RSAAuthentication yes
#PubkeyAuthentication yes #是否允许用户自行使用成对的密钥系统进行登录；
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys #自定义的公钥数据放置于用户主目录下 .ssh/authorized_keys内
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes
# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
UsePrivilegeSeparation sandbox # Default for new installations.
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
4、SSH简易安全设置
4.1 服务器软件本身的设置强化
SSHD服务器配置文件/etc/ssh/sshd_config默认项目已经很完备了，出于安全考虑需要设置：禁止root这个账号使用sshd服务；
[root@db2017 ~]# vi /etc/ssh/sshd_config
# Authentication:
#LoginGraceTime 2m
#PermitRootLogin yes #去掉注释且修改成PermitRootLogin no
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
4.2、TCP Wrapper使用：/etc/hosts.allow /etc/hosts.deny
假如只想让本机以及局域网192.168.1.0/24、192.168.0.0/24及192.168.100.0/24网段内的主机能够登录的话，可以这样设置：
[root@db2017 ~]# vi /etc/hosts.allow
#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
sshd:127.0.0.1 192.168.0.0/255.255.255.0 192.168.1.0/255.255.255.0 192.168.100.0/255.255.255.0 #新添加的SSHD规则！
[root@db2017 ~]# vi /etc/hosts.deny
# the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# The rules in this file can also be set up in
# /etc/hosts.allow with a 'deny' option instead.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
sshd:ALL
4.3、iptables数据包过滤防火墙
[root@db2017 sysconfig]# vi /etc/sysconfig/iptables
增加规则：
iptables -A INPUT -i EXTIF -s 192.168.0.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i EXTIF -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
