CentOS Stream 9通过配置sshd_config中AllowUsers实现SSH访问控制
CentOS Stream 9通过配置sshd_config中AllowUsers实现SSH访问控制
CentOS Stream 9通过配置sshd_config中AllowUsers实现SSH访问控制
一、CentOS目前主流的几个版本说明
(图片可放大查看)
CentOS Linux 与CentOS Stream
(图片可放大查看)
- CentOS Linux 目前两个主要版本
-- CentOS Linux 7
-- CentOS Linux 8
(图片可放大查看)
- CentOS Stream 目前两个主要版本
-- CentOS Stream 8
-- CentOS Stream 9
(图片可放大查看)
二、CentOS Stream 9 系统安装初体验
(图片可放大查看)
(图片可放大查看)
1、安装过程截图
(图片可放大查看)
(图片可放大查看)
(图片可放大查看)
(图片可放大查看)
(图片可放大查看)
(图片可放大查看)
(图片可放大查看)
2、安装后关闭SELINUX
getenforce
setenforce 0
sed -i 's/^SELINUX=.*$/SELINUX=disabled/' /etc/selinux/config
cat /etc/selinux/config
(图片可放大查看)
接下来进行正题
三、CentOS Stream 9通过配置sshd_config中AllowUsers实现SSH访问控制
1、CentOS Stream 9默认无/etc/hosts.allow
在CentOS Stream 9系统中
ll /etc/hosts.allow
ldd /usr/sbin/sshd
可以发现无libwrap.so.0库文件
(图片可放大查看)
系统中没有/etc/hosts.allow 和/etc/hosts.deny 文件
对比CentOS7系统
具体参考如下两篇文章
2、man sshd_config
man sshd_config查看AllowUsers参数配置说明
AllowUsers
This keyword can be followed by a list of user name patterns, separated by spaces.
If specified, login is allowed only for user names that match one of the patterns.
Only user names are valid; a numerical user ID is not recognized. By default, login
is allowed for all users. If the pattern takes the form USER@HOST then USER and
HOST are separately checked, restricting logins to particular users from particular
hosts. HOST criteria may additionally contain addresses to match in CIDR ad‐
dress/masklen format. The allow/deny users directives are processed in the follow‐
ing order: DenyUsers, AllowUsers.
(图片可放大查看)
3、SSH访问控制配置步骤实践
vi /etc/ssh/sshd_config
添加如下一行，只允许192.168.31.100+root用户登录
AllowUsers root@192.168.31.100
systemctl restart sshd
(图片可放大查看)
(图片可放大查看)
验证：192.168.31.232尝试SSH登录CentOS Stream 9 192.168.31.192
输入正确密码也会提示登录失败
(图片可放大查看)
在CentOS Stream 9服务器上查看日志
tail -f /var/log/secure
可以看到如下日志
Jan 24 21:07:47 localhost sshd[1447]: User root from 192.168.31.232 not allowed because not listed in AllowUsers
(图片可放大查看)
这样就可以实现SSH访问控制
当注释掉AllowUsers这一行，重启sshd服务，就可以正常登录
(图片可放大查看)
(图片可放大查看)
Tips:
CentOS Linux 8以后就不再支持/etc/hosts.allow和/etc/hosts.deny
1、CentOS Linux 8
2、CentOS Stream 9
3、CentOS Stream 8
以上3种系统均可以按本文中方法来实现SSH访问控制