SSH的一些安全小技巧

Table of Contents

前言

关于 ssh 的好处, 相信不用我多说了吧? 簡而言之, 之前的 rpc command 于 telnet 都全可用 ssh 代替. 比方如下的這些常見功能:

- 远程登录
    ssh user@remote.machine
- 远程执行
    ssh user@remote.machine 'command ...'
- 远程复制
    scp user@remote.machine:/remote/path /local/path
    scp /local/path user@remote.machine:/remote/path
- X forward
    ssh -X user@remote.machine
    xcommand ...
- Tunnel / Portforward
    ssh -L 1234:remote.machine:4321 user@remote.machine
    ssh -R 1234:local.machine:4321 user@remote.machine
    ssh -L 1234:other.machine:4321 user@remote.machine

至於详细的用法, 我這就不說了. 请读者自行研究吧.

我这里要说的, 是针对 ssh 服务为大家介绍一些安全技巧, 希望大家用得更安心些

实例

(以 RedHat 9 为例)

轉往 client :
$ ssh-keygen -t rsa
+ 按三下 enter 完成﹔不需設密碼,除非您會用 ssh-agent .
$ scp ~/.ssh/id_rsa.pub user1@server.machine:id_rsa.pub
+ 若是 windows client, 可用 puttygen.exe 產生 public key, 
   然後複制到 server 端後修改之, 使其內容成為單一一行.
+ 如果 server 端已經禁止密碼登入, 那請用其它放法復製 publick key.

登入 server 端:

(最好還將 SSL 設起來, 或只限 https 連線更佳, 我這裡略過 SSL 設定, 請讀者自補.) (如需控制連線來源, 那請再補 Allow/Deny 項目, 也請讀者自補.)

# cat > /var/www/html/ssh_open/ssh_open.php <<END
<?
//Set dir path for ip list
$dir_path=".";

//Set filename for ip list
$ip_list="ssh_open.txt";

//Get client ip
$user_ip=$_SERVER['REMOTE_ADDR'];

//allow specifying ip if needed
if (@$_GET['myip']) {
$user_ip=$_GET['myip'];
}

//checking IP format
if ($user_ip##long2ip(ip2long($user_ip))) {

//Put client ip to a file
if(@!($file = fopen("$dir_path/$ip_list","w+")))
{
        echo "Permission denied!!<br>";
        echo "Pls Check your rights to dir $dir_path or file $ip_list";
}
else
{
        fputs($file,"$user_ip");
        fclose($file);
        echo "client ip($user_ip) has put into $dir_path/$ip_list";
}
} else {
echo "Invalid IP format!!<br>ssh_open.txt was not changed.";
}
?>

.

END
# touch /var/www/html/ssh_open/ssh_open.txt
# chmod 640 /var/www/html/ssh_open/*
# chgrp apache /var/www/html/ssh_open/*
# chmod g+w /var/www/html/ssh_open/ssh_open.txt
# chmod o+t /var/www/html/ssh_open
# service httpd restart
# mkdir /etc/iptables
# cat > /etc/iptables/sshopen.sh <<END
#!/bin/bash

PATH=/sbin:/bin:/usr/sbin:/usr/bin

list_dir=/var/www/html/ssh_open
list_file=$list_dir/allow_ssh.txt
bad_list=$list_dir/bad_ip.txt
auth_log=$list_dir/xinetd.log
trusted_ip="127.0.0.1 4.3.2.1"
chain_name=ssh_rules

mail_to=root

# clear chain if exits, or create chain.
iptables -L -n | /bin/grep -q "^Chain $chain_name" && {
        iptables -F $chain_name
        true
} || {
        iptables -N $chain_name
        iptables -I INPUT -p tcp --dport 22 -j $chain_name
}

# clear chain on demand
[ "$1" = clear ] && {
        iptables -F $chain_name
    cat /dev/null > $list_file
        exit 0
}

# do nothing while list is empty
[ -s $list_file ] || exit 1

# deny connection if host dosn't math to list
host_ip=$(grep 'myssh from=' $auth_log | tail -1 | awk -F'=' '{print $NF}')
list_ip=$(cat $list_file)
if [ -n "$host_ip" -a "$host_ip" != "$list_ip" ]; then
    echo -e "${trusted_ip/ /\n}" | grep -q "$host_ip" || {
        /sbin/iptables-save | grep -q "INPUT -s $host_IP -j DROP$" || {
                /sbin/iptables -I INPUT -s $host_ip -j DROP
                echo $host_ip >> $bad_list
                echo "$host_ip is blocked by $0 on $(date)" | mail -s "block 
ip" $mail_to
        }
    }
    exit 2
fi

# add rule
iptables -A $chain_name -p tcp --dport 22 -s $(< $list_file) -j ACCEPT && \
    echo "ssh opened to $(< $list_file) on $(date)" | \
    mail -s "sshopen" $mail_to
exit 0
END
# chmod +x /etc/iptables/sshopen.sh
# echo -e 'sshopen\t\t1234/tcp' >> /etc/services
# cat > /etc/xinetd.d/sshopen <<END
service sshopen
{
        log_type        = FILE /studyarea/www/phorum/xinetd.log
        log_on_success  = HOST
        log_on_failure  = HOST
        disable = no
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /etc/iptables/sshopen.sh
}
# iptables -I INPUT -p tcp --dport 1234 -j ACCEPT
# cat > /etc/cron.d/sshopen <<END
*/5 * * * *     root    /etc/iptables/sshopen.sh clear
END

.

轉往 client 
 browser URL 輸入:
    http://server.machine/ssh_open/ssh_open.php?myip=1.2.3.4
(若不指定 ?myip=1.2.3.4 則以 client 當時 IP 為準, 若沒經 proxy 的話.)
如此, server 端的 ssh_open.txt 只有單一記錄, 每次蓋寫. 
接著:
    $ telnet server.machine 1234
然後你有最多 5 分鐘時間用 ssh 連線 server !

此步驟的基本構思如下:

這樣, 那些亂 try SSH 的家夥, 頂多能試 5 次(LIMIT 可調整), 然後就給 BLOCK 掉了. 此外, 在 PERM_LIST 的 ip, 也可提供給 iptables 的初始 script , 來個永久性封閉:

    for i in $(< $PERM_LIST) 
    do 
        /sbin/iptables -I INPUT -s $i -j DROP 
    done

這裡, 我只是設為發信給 root.

事實上, 你可修改為起動 firewall 將 %a 這個傳回值給 ban 掉也行.

不過, 對方要是有選擇性的做 port scan , 沒掃到 finger 的話, 那當然就沒用了...

总结

security 有蠻多挺好玩的小技巧, 有空再跟大家做分享... ^_^

参考


title: SSH的一些安全小技巧
date: 2011-11-17 07:23
author: None
site: 帐号、业务安全|岂安