devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Linux ❉ SSH服务器_there was 1 failed login attempt

作者：从前慢现在也慢 | 2024-02-19 14:29:02

赞

踩

there was 1 failed login attempt

一 介绍

        SSH - Secure Shell 安全外壳协议：SSH 为建立在应用层基础上的安全协议。SSH 是较可靠，专为远程登录会话和其他网络服务提供安全性的协议。利用 SSH 协议可以有效防止远程管理过程中的信息泄露问题；

        服务端口：TCP 22；

         此服务默认安装并开启，此处我们只研究其使用方法

  1. [root@slave1 ~]# systemctl status sshd
  2. ● sshd.service - OpenSSH server daemon
  3.    Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
  4.    Active: active (running) since Sun 2021-12-12 06:46:02 EST; 2 days ago
  5.      Docs: man:sshd(8)
  6.            man:sshd_config(5)
  7.  Main PID: 1104 (sshd)
  8.     Tasks: 1
  9.    Memory: 1.9M
  10.    CGroup: /system.slice/sshd.service
  11.            └─1104 /usr/sbin/sshd -D
  12.  
  13. Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.


 

SSH和TELNET的区别

        SSH是加密的，基于SSL。而TELNET是明码传输的，发送的数据被监听后不需要解密就可以看到内容。两者本来端口也有差异，但是ssh的监听端口可以修改，所以这个也不能算是区别。

        一般不建议使用telnet。

 

二 配置文件内容详解

SSH服务配置路径：/etc/ssh/sshd_config

 

  1. [root@slave1 ~]# cat /etc/ssh/sshd_config
  2. #Port 22								/监听端口；
  3. #AddressFamily any	       			    /兼用IPv4和IPv6；
  4. #ListenAddress 0.0.0.0					/监听地址，0.0.0.0表示所有IPv4地址；
  5. #ListenAddress ::						/监听地址，0.0.0.0表示所有IPv6地址；
  6. HostKey /etc/ssh/ssh_host_rsa_key		/rsa私钥认证；
  7. HostKey /etc/ssh/ssh_host_ecdsa_key		/ecdsa私钥认证；
  8. HostKey /etc/ssh/ssh_host_ed25519_key	/ed25519私钥认证；
  9. #SyslogFacility AUTH
  10. SyslogFacility AUTHPRIV	       			 /当被登录时会记录登录信息；
  11. #LogLevel INFO
  12. # Authentication:
  13. #LoginGraceTime 2m
  14. PermitRootLogin yes						/允许root用户直接登录；
  15. #StrictModes yes						/允许sshd检查用户主目录或相关文件的权限数据；
  16. #MaxAuthTries 6							/最大登录尝试次数，全部失败需要等待；
  17. #MaxSessions 10							/最大会话数；
  18. #PubkeyAuthentication yes
  19. # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
  20. # but this is overridden so installations will only check .ssh/authorized_keys
  21. AuthorizedKeysFile	.ssh/authorized_keys	/服务器生成一对公私钥之后，会将公钥放到.ssh/authorized_keys里面，将公钥发给客户端；
  22. #AuthorizedPrincipalsFile none
  23. #AuthorizedKeysCommand none
  24. #AuthorizedKeysCommandUser nobody
  25. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
  26. #HostbasedAuthentication no
  27. # Change to yes if you don't trust ~/.ssh/known_hosts for
  28. # HostbasedAuthentication
  29. #IgnoreUserKnownHosts no
  30. # Don't read the user's ~/.rhosts and ~/.shosts files
  31. #IgnoreRhosts yes
  32. # To disable tunneled clear text passwords, change to no here!
  33. #PasswordAuthentication yes
  34. #PermitEmptyPasswords no
  35. PasswordAuthentication yes
  36. # Change to no to disable s/key passwords
  37. #ChallengeResponseAuthentication yes
  38. ChallengeResponseAuthentication no
  39. # Kerberos options
  40. #KerberosAuthentication no
  41. #KerberosOrLocalPasswd yes
  42. #KerberosTicketCleanup yes
  43. #KerberosGetAFSToken no
  44. #KerberosUseKuserok yes
  45. # GSSAPI options
  46. GSSAPIAuthentication yes
  47. GSSAPICleanupCredentials no
  48. #GSSAPIStrictAcceptorCheck yes
  49. #GSSAPIKeyExchange no
  50. #GSSAPIEnablek5users no
  51. UsePAM yes
  52. #AllowAgentForwarding yes
  53. #AllowTcpForwarding yes
  54. #GatewayPorts no
  55. X11Forwarding yes
  56. #X11DisplayOffset 10
  57. #X11UseLocalhost yes
  58. #PermitTTY yes
  59. # It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
  60. # as it is more configurable and versatile than the built-in version.
  61. PrintMotd no
  62. #PrintLastLog yes
  63. #TCPKeepAlive yes
  64. #PermitUserEnvironment no
  65. #Compression delayed
  66. #ClientAliveInterval 0
  67. #ClientAliveCountMax 3
  68. #UseDNS no			  				   /是否反解DNS；
  69. #PidFile /var/run/sshd.pid
  70. #MaxStartups 10:30:100
  71. #PermitTunnel no
  72. #ChrootDirectory none
  73. #VersionAddendum none
  74. # no default banner path
  75. #Banner none
  76. # Accept locale-related environment variables
  77. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
  78. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
  79. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
  80. AcceptEnv XMODIFIERS
  81. # override default of no subsystems
  82. Subsystem	sftp	/usr/libexec/openssh/sftp-server	/支持sftp连接；
  83. # Example of overriding settings on a per-user basis
  84. #Match User anoncvs
  85. #	X11Forwarding no
  86. #	AllowTcpForwarding no
  87. #	PermitTTY no
  88. #	ForceCommand cvs server

 三 服务配置

1 修改登陆端口号

注意关闭防火墙和selinux

  1. [root@localhost ~]# systemctl stop firewalld
  2. [root@localhost ~]# setenforce 0
  1. # 修改端口
  2. [root@localhost ~]# cat /etc/ssh/sshd_config | grep Port
  3. Port 222
  4. [root@localhost ~]# systemctl restart sshd
  5.  
  6.  
  7.  
  8. # 验证结果，注意端口号和地址之间不需要冒号，否则会作为一个地址使用导致无法解析
  9. # 用户名可加可不加，实验嘛
  10. [c:\~]$ ssh root@192.168.247.134 222
  11.  
  12.  
  13. Connecting to 192.168.247.134:222...
  14. Connection established.

2 限制root账户直接登录

  1. # 新建用户并创建密码
  2. [root@localhost ~]# useradd wangjie
  3. [root@localhost ~]# id wangjie
  4. uid=1000(wangjie) gid=1000(wangjie) groups=1000(wangjie)
  5. [root@localhost ~]# passwd wangjie
  6. Changing password for user wangjie.
  7. New password: 
  8. BAD PASSWORD: The password is shorter than 8 characters
  9. Retype new password: 
  10. passwd: all authentication tokens updated successfully.
  11.  
  12. # 修改配置
  13. [root@localhost ~]# cat /etc/ssh/sshd_config | grep PermitRoot
  14. PermitRootLogin no
  15.  
  16. [root@localhost ~]# systemctl restart sshd

验证结果：root不能主动登陆，但是新建的用户可以 

 

  1. [c:\~]$ ssh wangjie@192.168.247.134 222
  2.  
  3.  
  4. Connecting to 192.168.247.134:222...
  5. Connection established.
  6. To escape to local shell, press 'Ctrl+Alt+]'.
  7.  
  8. Last failed login: Thu Dec 16 03:19:07 CST 2021 from 192.168.247.1 on ssh:notty
  9. There was 1 failed login attempt since the last successful login.
  10. /usr/bin/xauth:  file /home/wangjie/.Xauthority does not exist
  11. [wangjie@192 ~]$ 
  12. [wangjie@192 ~]$ pwd
  13. /home/wangjie
  14. [wangjie@192 ~]$ su - root
  15. Password: 
  16. Last login: Thu Dec 16 01:38:47 CST 2021 on :0
  17. Last failed login: Thu Dec 16 03:28:38 CST 2021 from 192.168.247.1 on ssh:notty
  18. There were 2 failed login attempts since the last successful login.
  19. [root@192 ~]# pwd
  20. /root
  21. # 输入Ctrl + D
  22. [root@192 ~]# logout
  23. [wangjie@192 ~]$ logout

3 限制登录账户

  1. [root@localhost ~]# cat /etc/ssh/sshd_config | grep AllowUser
  2. AllowUsers root
  3. # #本配置sshd主配置文件没有相关语句，需要在后面自行添加，若多个账户需要被限制用空格隔开
  4. [root@localhost ~]# systemctl restart sshd
  5.  
  6.  
  7. # 测试结果：redhat不能主动登录，root可以主动登录
  8. [c:\~]$ ssh root@192.168.247.134 222
  9.  
  10.  
  11. Connecting to 192.168.247.134:222...
  12. Connection established.
  13. To escape to local shell, press 'Ctrl+Alt+]'.
  14.  
  15. Last login: Thu Dec 16 03:29:58 2021
  16. /usr/bin/xauth:  file /root/.Xauthority does not exist
  17. [root@192 ~]#
声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/115235
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号