标签：SSH

0、说明

0.1、实验环境系统为Centos 7.4系统，最小化安装后未做任何配置

1、修改SSH默认连接端口

1.1、确保SELinux处于关闭状态

[root@imzcy ~]# setenforce 0
[root@imzcy ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

1.2、编辑sshd_config配置文件，修改默认端口（17行左右）。并重启sshd服务使配置生效

[root@imzcy ~]# grep ^Port /etc/ssh/sshd_config 
Port 10022
[root@imzcy ~]# systemctl restart sshd

1.3、firewalld防火墙添加规则，放行tcp/10022端口

#添加防火墙规则
[root@imzcy ~]# firewall-cmd --permanent --zone=public --add-port=10022/tcp
[root@imzcy ~]# firewall-cmd --reload

#确认配置
[root@imzcy ~]# firewall-cmd --list-all |grep 10022
  ports: 10022/tcp

这时候就可以使用10022端口连接ssh服务器了。
可能遇到的问题：

如果修改完ssh端口号，重启sshd服务报错，然后注释掉之前的更改就能正常重启，请使用getenforce命令检查下selinux状态是否为关闭

2、禁止root用户远程登录

#2.1、修改sshd_config配置文件（38行左右）
[root@imzcy ~]# grep ^PermitRootLogin /etc/ssh/sshd_config 
PermitRootLogin no
[root@imzcy ~]# 

#2.2、重启sshd服务，使配置立即生效
[root@imzcy ~]# systemctl restart sshd

3、限制ssh访问服务器的源IP

#编辑hosts.allow配置文件，追加一行内容
[root@imzcy ~]# echo "sshd:192.168.43.226:allow" >>/etc/hosts.allow

#编辑hosts.deny配置文件，追加一行内容
[root@imzcy ~]# echo "sshd:ALL" >>/etc/hosts.deny

这里只写了一种方法，还可以通过修改sshd_config配置文件来限制源IP，也可以使用firewalld来限制源IP

4、限制ssh访问服务器的用户名

#修改sshd_config配置文件，允许zcy用户ssh访问服务器（以空格分开用户；添加完允许，默认拒绝其他所有用户）
[root@imzcy ~]# echo "AllowUsers zcy" >>/etc/ssh/sshd_config

#重启sshd服务，使配置立即生效
[root@imzcy ~]# systemctl restart sshd

5、修改telnet ssh端口时显示的版本号

#5.1、查看sshd位置
[root@imzcy ~]# whereis sshd
sshd: /usr/sbin/sshd /usr/share/man/man8/sshd.8.gz

#5.2、查看SSH版本
[root@imzcy ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

#5.3、查看sshd程序关于版本的信息
[root@imzcy ~]# strings /usr/sbin/sshd |grep OpenSSH_7.4
OpenSSH_7.4p1-RHEL7-7.4p1-11
OpenSSH_7.4
OpenSSH_7.4p1

#5.4、使用sed替换版本（记得一定要先备份下）
[root@imzcy ~]# cp -p /usr/sbin/sshd ./
[root@imzcy ~]# sed -i 's/OpenSSH_7.4/OpenSSH_2.3/g' /usr/sbin/sshd

#5.5、重启下sshd服务，没有报错即可
[root@imzcy ~]# systemctl restart sshd

再使用telnet连接ssh端口，显示的版本则为：SSH-2.0-OpenSSH_2.3

ssh免密登录在带来方便的同时也带来一些问题，那就是不知道什么时间什么人利用ssh免密通道登录服务器了，为此我们需要在sshd的配置文件里设置好详细日志，以便日后回溯。

在CentOS里，sshd的日志文件是保存在/var/log/secure里的，如果不进行特殊设置的话，它只记录一些最简单的信息，比如什么时间哪个账号被人用免密登录的方式登录了，如果这个账号的authorized_keys里有很多key的话，这样的log没有办法告诉你客户到底是用哪个key登录的。

所以，我们需要在sshd的配置文件/etc/ssh/sshd_config文件里找到以下项LogLevel并把它改成LogLevel VERBOSE，这一项的缺省值是INFO，不够详细，所以我们需要把它改成啰嗦模式，这样可以记录更多信息。

改成VERBOSE并重启sshd(service sshd restart)后，我们会在日志文件里看到类似于这样的记录：

Apr 1 10:37:06 hostname sshd[5903]: Found matching RSA key: 83:67:b5:c7:bb:17:4d:06:ca:dc:8b:ca:85:cc:0c:b1

但这样的信息明显不同于我们在authorized_keys里存放的信息，那该怎么办呢？实际上，在sshd的日志文件里存储的只是我们authorized_keys的指纹信息fingerprint，不是真正的key，必须从authorized_keys反算出fingerprint来，才能做对比：

ssh-keygen -E md5 -lf /home/someuser/.ssh/authorized_keys

但是这样依然很麻烦，有没有办法直接告诉我日志里到底是谁登录的呢？为此我们还需要引入一个用Perl写的小程序点击预览。(原作者写的略有问题，在新版的CentOS里必须要求附加md5参数，为此我做了一些小的修改)：

#!/usr/bin/perl -w
use strict;
use diagnostics;
use File::Temp;

# Matches Fingerprints from sshd logs (sshd on loglevel VERBOSE) against
# authorized_keys for the respective user.

die "Please specify input file!n" unless ($ARGV[0]);

my $fingerprints;

my $nav = File::Navigate->new($ARGV[0]);
# Store publickey login events
my @lines = @{$nav->find(qr/sshd[d+]: Accepted publickey for .+ from .+ port d+/)};

# Process all publickey login events
foreach(@lines){
    $nav->cursor($_);
    my $line = $nav->get();
    $line =~ /^(.{15}).+sshd[(d+)]: Accepted publickey for (.+) from (.+) port (d+)/;
    my $date = $1;
    my $pid  = $2;
    my $user = $3;
    my $ip   = $4;
    my $port = $5;
    my $fp   = "unknown"; # (yet)
    # Seek backwards to find matching fingerprint line
    my $sought = 0;
    while ((my $seekline = $nav->getprev()) and ($sought++ < 1000)){
        if ($seekline =~ /sshd[$pid]: Found matching .+ key: (.+)/){
            $fp = $1;
            last;
        }elsif($line =~ /sshd[$pid]: Connection from $ip port $port/){
            last;
        }
    }
    my $key = get_key($fp, $user);
    print ""$date";"$user";"$fp";"$key"n";
}

sub get_key{
    my $fp   = shift;
    $fp = "MD5:" . $fp;
    my $user = shift;

    # See if FP is cached
    if ($fingerprints->{$user}){
        if ($fingerprints->{$user}->{$fp}){
            return $fingerprints->{$user}->{$fp};
        }else{
            return "No matching key found.";
        }
    }

    # Else, generate fingerprints from users authorized_keys
    print STDERR "------> Reading keys for user $usern";
    my $home = (getpwnam($user))[7];
    open my $fh_in, "<$home/.ssh/authorized_keys" or warn "No such file: $home/.ssh/authorized_keysn";
    while (<$fh_in>){
        chomp;
        next unless (/^ssh-/);
        my $out_fh = File::Temp->new();
        print $out_fh "$_n";
        close $out_fh;
        my $fp_raw = `ssh-keygen -E md5 -lf $out_fh`;
        # Second field of output has the fingerpring
        my $fp = (split /s+/, $fp_raw)[1];
        $fingerprints->{$user}->{$fp} = $_;
    }
    if ($fingerprints->{$user}->{$fp}){
        return $fingerprints->{$user}->{$fp};
    }else{
        return "No matching key found.";
    }
}

package File::Navigate;
use strict;
use warnings;

=head1 NAME

File::Navigate - Navigate freely inside a text file

=head1 DESCRIPTION

The module is a glorified wrapper for tell() and seek().

It aims to simplify the creation of logfile analysis tools by
providing a facility to jump around freely inside the contents
of large files without creating the need to slurp excessive
amounts of data.

=head1 SYNOPSIS

  use File::Navigate;
  my $nav = File::Navigate->new('/var/log/messages');

  # Read what's below the "cursor":
  my $first = $nav->get;

  # Advance the cursor before reading:
  my $second = $nav->getnext;
  my $third  = $nav->getnext;

  # Advance the cursor by hand:
  $nav->next;
  my $fourth = $nav->get;

  # Position the cursor onto an arbitrary line:
  $nav->cursor(10);
  my $tenth  = $nav->get;

  # Reverse the cursor one line backward:
  $nav->prev;
  my $ninth  = $nav->get;

  # Reverse the cursor before reading:
  my $eigth  = $nav->getprev;

  # Read an arbitrary line:
  my $sixth  = $nav->get(6);

=cut

our @ISA       = qw(Exporter);
our @EXPORT_OK = qw();
our $VERSION   = '1.0';

=head1 CLASS METHODS

=head2 I<new()>

Open the file and create an index of the lines inside of it.

  my $mapper = File::Navigate->new($filename);

=cut

sub new($){
    my $class = shift;
    my $file;
    unless ($file = shift){
        die "No file specifiedn";
    }
    unless (-e $file){
        die "File not found: $filen";
    }
    unless (-r $file){
        die "File not readable: $filen";
    }
    my $self = {};
       $self->{'cursor'}         = 1;
       $self->{'lineindex'}      = {};
       $self->{'lineindex'}->{1} = 0;
    open my $fh, "$file"
        or die "Can't open $file: $!n";
    while (<$fh>){
        my $thisline = $.;
        my $nextline = $thisline + 1;
        $self->{'lineindex'}->{$nextline} = tell $fh;
    }
    $self->{'length'} = scalar(keys %{$self->{'lineindex'}}) - 1 ;
    $self->{'fh'} = $fh;
    bless $self;
}

=head1 OBJECT METHODS

=head2 I<count()>

Returns the number of lines in the file ("wc -l")

  my $lines = $nav->count;

=cut

sub length(){
    my $self = shift;
    return $self->{'length'};
}

=head2 I<cursor()>

Returns the current cursor position and/or sets the cursor.

  my $cursor = $nav->cursor();   # Query cursor position.
  my $cursor = $nav->cursor(10); # Set cursor to line 10

=cut

sub cursor($){
    my $self = shift;
    if (my $goto = shift){
        $self->{'cursor'} = $goto;
    }
    return $self->{'cursor'};
}

=head2 I<get()>

Gets the line at the cursor position or at the given position.

  my $line = $nav->get();   # Get line at cursor
  my $line = $nav->get(10); # Get line 10

=cut

sub get($){
    my $self = shift;
    my $fh   = $self->{'fh'};

    my $getline;
    $getline = $self->{'cursor'} unless ($getline = shift);

    if ($getline < 1){
        warn "WARNING: Seek before first line.";
        return undef;
    }elsif($getline > $self->{'length'}){
        warn "WARNING: Seek beyond last line.";
        return undef;
    }
    seek ($fh, $self->{'lineindex'}->{$getline}, 0);
    my $gotline = <$fh>;
    chomp $gotline;
    return $gotline;
}

=head2 I<next()>

Advance the cursor position by one line. Returns the new cursor position.
Returns I<undef> if the cursor is already on the last line.

  my $newcursor = $nav->next();

=cut

sub next(){
    my $self = shift;
    if ($self->{'cursor'} == $self->{'length'}){
        return undef;
    }
    $self->{'cursor'}++;
    return $self->{'cursor'};
}

=head2 I<prev()>

Reverse the cursor position by one line. Returns the new cursor position.
Returns I<undef> if the cursor is already on line 1.

  my $newcursor = $nav->prev();

=cut

sub prev(){
    my $self = shift;
    if ($self->{'cursor'} == 1){
        return undef;
    }
    $self->{'cursor'}--;
    return $self->{'cursor'};
}

=head2 I<getnext()>

Advance to the next line and return it.
Returns I<undef> if the cursor is already on the last line.

  my $newcursor = $nav->getnext();

=cut

sub getnext(){
    my $self = shift;
    $self->next or return undef;
    return $self->get;
}

=head2 I<getprev()>

Reverse to the previous line and return it:
Returns I<undef> if the cursor is already on line 1.

  my $newcursor = $nav->getprev();

=cut

sub getprev(){
    my $self = shift;
    $self->prev or return undef;
    return $self->get;
}

=head2 I<find()>

Find lines containing given regex. Returns array with line numbers.

  my @lines = @{$nav->find(qr/foo/)};

=cut

sub find($){
    my $self = shift;
    my $regex = shift;

    my @results;
    for (my $lineno = 1; $lineno <= $self->{'length'}; $lineno++){
        my $line = $self->get($lineno);
            if ($line =~ $regex){
            push @results, $lineno;
        }
    }
    return @results;
}

sub DESTROY(){
    my $self = shift;
    close $self->{'fh'};
}

=head1 EXAMPLE

I<tac>, the opposite of I<cat>, in Perl using File::Navigate:

  #!/usr/bin/perl -w
  use strict;
  use File::Navigate;

  foreach my $file (reverse(@ARGV)){
          my $nav = File::Navigate->new($file);
          # Force cursor beyond last line
          $nav->cursor($nav->length()+1);
          print $nav->get()."n" while $nav->prev();
  }

=head1 BUGS

Seems to lack proper error handling.

=head1 LIMITATIONS

Works only on plain text files. Sockets, STDIO etc. are not supported.

=head1 PREREQUISITES

Tested on Perl 5.6.1.

=head1 STATUS

Mostly harmless.

=head1 AUTHOR

Martin Schmitt <mas at scsy dot de>

=cut

1;

为此我们给它起名叫match-ssh-keys，赋予它可执行权限(chmod +x match-ssh-keys)，然后把它搬到/usr/local/bin里(mv match-ssh-keys /usr/local/bin/)，这样我们以后再想查谁通过sshd免密登录过服务器就方便了，我们只需要执行：

match-ssh-keys /var/log/secure

就可以了。