如何开启Centos6.4系统的SSH服务_百度知道
如何开启Centos6.4系统的SSH服务
提问者采纳
chkconfig sshd on
#设置开机自启service sshd start
来自团队：
其他类似问题
为您推荐：
等待您来回答
下载知道APP
随时随地咨询
出门在外也不愁CentOS 6.6系统怎么开启XDMCP服务_百度知道
CentOS 6.6系统怎么开启XDMCP服务
rpm -qa | grep ssh 注：使用root用户登录：yum install openssh-server安装：若没安装SSH则可输入。 ◆登录Centos6。 查看SSH是否安装：若为非root用户登录。 启动SSH服务.4系统。 ◆示例。 注，输入执行某些命权限不够时需加sudo。 ◆输入命令..
来自团队：
其他类似问题
为您推荐：
其他1条回答
i /gdm/etc&#47.conf
等待您来回答
下载知道APP
随时随地咨询
出门在外也不愁Docker中开启sshd服务 | 4LinuxFun
VPS广而告知微信公众号：centoscn
Centos 6.4安全防护设置指南
CentOS操作系统安装完成之后，我们需要对现有的系统进行一些简单的设置，才能使用操作系统更加安全可靠，下面我们来向大家介绍一些最基本的安全防护策略，进一步提升操作系统的安全性。
1、修改客户密码的长度
密码的安全是操作系统的第一步，所以我们必须要求有一个强壮的密码，可以通过修改/etc/login.defs文件来实现我们要求的密码长度。
/etc/login.defs原始内容如下：
[root@localhost ~]# vi /etc/login.defs
# Please note that the parameters in this configuration file control the
# behavior of the tools from the shadow-utils component. None of these
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
# passwd command) should therefore be configured elsewhere. Refer to
# /etc/pam.d/system-auth for more information.
# *REQUIRED*
#&& Directory where mailboxes reside, _or_ name of file, relative to the
#&& home directory.& If you _do_ define both, MAIL_DIR takes precedence.
#&& QMAIL_DIR is for Qmail
#QMAIL_DIR&&&&& Maildir
MAIL_DIR&&&&&&& /var/spool/mail
#MAIL_FILE&&&&& .mail
# Password aging controls:
#&&&&&& PASS_MAX_DAYS&& Maximum number of days a password may be used.
#&&&&&& PASS_MIN_DAYS&& Minimum number of days allowed between password changes.
#&&&&&& PASS_MIN_LEN&&& Minimum acceptable password length.
#&&&&&& PASS_WARN_AGE&& Number of days warning given before a password expires.
PASS_MAX_DAYS&& 99999
PASS_MIN_DAYS&& 0
PASS_MIN_LEN&&& 5
PASS_WARN_AGE&& 7
# Min/max values for automatic uid selection in useradd
UID_MIN&&&&&&&&&&&&&&&&&& 500
UID_MAX&&&&&&&&&&&&&&&& 60000
# Min/max values for automatic gid selection in groupadd
GID_MIN&&&&&&&&&&&&&&&&&& 500
GID_MAX&&&&&&&&&&&&&&&& 60000
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#USERDEL_CMD&&& /usr/sbin/userdel_local
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
CREATE_HOME&&&& yes
# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK&&&&&&&&&& 077
# This enables userdel to remove user groups if no members exist.
USERGROUPS_ENAB yes
# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512
# Password aging controls:
#&&&&&& PASS_MAX_DAYS&& Maximum number of days a password may be used.
#&&&&&& PASS_MIN_DAYS&& Minimum number of days allowed between password changes.
#&&&&&& PASS_MIN_LEN&&& Minimum acceptable password length.
#&&&&&& PASS_WARN_AGE&& Number of days warning given before a password expires.
PASS_MAX_DAYS&& 99999
PASS_MIN_DAYS&& 0
PASS_MIN_LEN&&& 5
PASS_WARN_AGE&& 7
# Min/max values for automatic uid selection in useradd
UID_MIN&&&&&&&&&&&&&&&&&& 500
UID_MAX&&&&&&&&&&&&&&&& 60000
# Min/max values for automatic gid selection in groupadd
GID_MIN&&&&&&&&&&&&&&&&&& 500
GID_MAX&&&&&&&&&&&&&&&& 60000
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#USERDEL_CMD&&& /usr/sbin/userdel_local
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
CREATE_HOME&&&& yes
# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK&&&&&&&&&& 077
# This enables userdel to remove user groups if no members exist.
USERGROUPS_ENAB yes
# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512
将密码最小的长度调整为8
PASS_MIN_LEN 8
2、注释掉操作系统不需要使用的用户和用户组
Centos 6.4操作系统安装好之后，我们需要针对一些不需要使用的用户和用户组来进行设置，减少可能发生的安全问题。
/etc/passwd原始内容如下：
[root@localhost ~]# vi /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
pulse:x:498:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
saslauth:x:497:76:&Saslauthd user&:/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x::Anonymous NFS User:/var/lib/nfs:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin
注释掉以下用户
#userdel adm:x:3:4:adm:/var/adm:/sbin/nologin
#userdel lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
#userdel sync:x:5:0:sync:/sbin:/bin/sync
#userdel shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
#userdel halt:x:7:0:halt:/sbin:/sbin/halt
#userdel uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
#userdel operator:x:11:0:operator:/root:/sbin/nologin
#userdel games:x:12:100:games:/usr/games:/sbin/nologin
#userdel gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
#userdel ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
/etc/group原始内容如下：
[root@localhost ~]# vi /etc/group
bin:x:1:bin,daemon
daemon:x:2:bin,daemon
sys:x:3:bin,adm
adm:x:4:adm,daemon
lp:x:7:daemon
wheel:x:10:
mail:x:12:mail,postfix
uucp:x:14:
games:x:20:
gopher:x:30:
video:x:39:
lock:x:54:
audio:x:63:
nobody:x:99:
users:x:100:
dbus:x:81:
usbmuxd:x:113:
utmp:x:22:
utempter:x:35:
desktop_admin_r:x:499:
desktop_user_r:x:498:
floppy:x:19:
vcsa:x:69:
rtkit:x:497:
avahi-autoipd:x:170:
cdrom:x:11:
tape:x:33:
dialout:x:18:
wbpriv:x:88:
pulse:x:496:
pulse-access:x:495:
fuse:x:494:
haldaemon:x:68:haldaemon
apache:x:48:
saslauth:x:76:
postdrop:x:90:
postfix:x:89:
abrt:x:173:
rpcuser:x:29:
nfsnobody:x:65534:
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
sshd:x:74:
tcpdump:x:72:
slocate:x:21:
ldap:x:55:
注释掉以下用户组
#groupdel adm:x:4:adm,daemon
#groupdel lp:x:7:daemon
#groupdel uucp:x:14:
#groupdel games:x:20:
#groupdel dip:x:40:
3、检查系统的安全登陆文件
通过检查/var/log/secure该文件的信息，我们可以了解到有哪些用户及IP地址进行登陆。
[root@localhost ~]# more /var/log/secure grep refused
::::::::::::::
/var/log/secure
::::::::::::::
Jan 16 22:33:29 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed
esktop/ConsoleKit/Session1 (system bus name :1.23, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo
cale zh_CN.UTF-8) (disconnected from bus)
Jan 16 22:33:32 localhost sshd[1728]: Received signal 15; terminating.
Jan 16 22:33:32 localhost sshd[2460]: Exiting on signal 15
Jan 16 22:33:32 localhost sshd[2460]: pam_unix(sshd:session): session closed for user root
Jan 17 15:54:27 localhost sshd[1737]: Server listening on 0.0.0.0 port 22.
Jan 17 15:54:27 localhost sshd[1737]: Server listening on :: port 22.
Jan 17 15:54:35 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes
ktop/ConsoleKit/Session1 (system bus name :1.24 [/usr/libexec/polkit-gnome-authentication-agent-1], object p
ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 17 15:54:50 localhost sshd[2461]: Accepted password for root from 192.168.1.3 port 55918 ssh2
Jan 17 15:54:50 localhost sshd[2461]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 17 16:01:55 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed
esktop/ConsoleKit/Session1 (system bus name :1.24, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo
cale zh_CN.UTF-8) (disconnected from bus)
Jan 17 16:01:58 localhost sshd[1737]: Received signal 15; terminating.
Jan 17 16:01:58 localhost sshd[2461]: Exiting on signal 15
Jan 17 16:01:58 localhost sshd[2461]: pam_unix(sshd:session): session closed for user root
Jan 29 10:49:52 localhost sshd[1728]: Server listening on 0.0.0.0 port 22.
Jan 29 10:49:52 localhost sshd[1728]: Server listening on :: port 22.
Jan 29 10:49:57 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes
ktop/ConsoleKit/Session1 (system bus name :1.23 [/usr/libexec/polkit-gnome-authentication-agent-1], object p
ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 29 10:50:02 localhost sshd[2452]: Accepted password for root from 192.168.1.4 port 53853 ssh2
Jan 29 10:50:02 localhost sshd[2452]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): user unknown
Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): au logname= uid=0 euid=0
&tty=ftp ruser=fsdaf rhost=192.168.1.4
Jan 29 10:51:43 localhost vsftpd[2482]: pam_succeed_if(vsftpd:auth): error retrieving information about user
Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): user unknown
Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): au logname= uid=0 euid=0
&tty=ftp ruser=ithov rhost=192.168.1.4
Jan 29 10:51:58 localhost vsftpd[2484]: pam_succeed_if(vsftpd:auth): error retrieving information about user
Jan 29 10:54:35 localhost sshd[2452]: pam_unix(sshd:session): session closed for user root
Jan 29 10:54:36 localhost sshd[2493]: Accepted password for root from 192.168.1.4 port 54693 ssh2
Jan 29 10:54:36 localhost sshd[2493]: pam_unix(sshd:session): session opened for user root by (uid=0)
grep: 没有那个文件或目录
refused: 没有那个文件或目录
4、使用chattr命令给下列文件加上不可更改的属性
有效防止非法用户进行文件的修改。
[root@localhost ~]# chattr +i /etc/passwd
[root@localhost ~]# chattr +i /etc/shadow
[root@localhost ~]# chattr +i /etc/group
[root@localhost ~]# chattr +i /etc/gshadow
5、更改SSH端口加强登陆安全
CentOS 6.4安装好之后，默认使用22端口进行连接，就像Windows Server 2008操作系统一样使用3389，对于一般的用户很容易就猜测到这个端口是提供什么服务的，所以建议使用10000以上的端口，这样别人在扫描的时候，能扫描到端口的机率也会降低一些。
不要允许使用低版本的SSH协议进行连接
[root@localhost ~]# vi /etc/ssh/sshd_config
将#protocol 2,1改为
protocol 2
(注：centos 6下已默认取消了低版本协议，默认值为protocol 2)
将PORT改为1000以上端口
[root@localhost ~]# vi /etc/ssh/sshd_config
Port 10000
开启防火墙端口，并重新启动防火墙生效
[root@localhost ~]# vi /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT
[root@localhost ~]# service iptables restart
iptables：清除防火墙规则：[确定]
iptables：将链设置为政策 ACCEPT：filter [确定]
iptables：正在卸载模块：[确定]
iptables：应用防火墙规则：[确定]
iptables：载入额外模块：ip_nat_ftp [确定]
6、防止IP欺骗
编辑/etc/host.conf文件并增加如下几行来防止IP欺骗攻击。
order bind，hosts
nospoof on
------分隔线----------------------------
ossec官方网站http://www.ossec.net/
ossec帮助文档http://ossec-docs.readthedocs.o...虚拟机中实现Linux与Windows之间的文件传输-SSHSecureShellClien
一、配置环境
虚拟机Linux：CentOS 6.4
传输工具：SSHSecureShellClient-3.2.9 & &&进入下载
二、实现步骤
& & 1. 在Windows中安装文件传输工具SSHSecureShellClient-3.2.9，主界面如下：
2. 启动虚拟机中的Linux，查看Linux的IP地址，如下：
ifconfig命令查看IP地址，我的IP是192.168.242.134。
3.配置虚拟网卡的ip地址在同一网段：
在windows下ping 192.168.242.134 ：
有来自虚拟机的响应，OK。
<span style="color: #. 开启Linux的SSHD服务，使用命令：#chkconfig sshd on .
5.&开始到Linux的连接，如下：
单击单击工具栏上的Quick Connect按钮 ，输入linux IP地址，用户名，连接，在弹出的对话框中输入密码：
连接成功！
点击文件传输按钮：
已经连接到Linux了。左边是Windows资源管理器，右边是Linux目录，默认打开到/root目录。
现在可以在windows和虚拟机中的linux传输文件了，可以拖拽文件传输哦。
标签(Tag):
------分隔线----------------------------
------分隔线----------------------------