Vimbela imizamo yephasiwedi ku-Linux ukuze uvikele i-SSH namasevisi

  • Hlaziya amalogi okufakazela ubuqiniso bese ulungisa i-sshd_config ukuze ukhawulele abasebenzisi, amachweba, amaphrothokholi, kanye nemizamo, ngaleyo ndlela unciphise indawo yokuhlasela.
  • Sebenzisa i-Fail2ban ukuze uqaphe izinsizakalo ezibalulekile (i-SSH, iwebhu, izizindalwazi) bese uvimba ngokuzenzakalelayo ama-IP ngokwehluleka okuningi.
  • Sebenzisa okhiye be-SSH esikhundleni samaphasiwedi bese ukhubaza i-PasswordAuthentication ukuze unciphise ngokuphelele ukuhlaselwa kwe-brute-force.
  • Qinisa ngama-firewall, ama-TCP wrappers, kanye, uma kudingeka, ama-2FA, uhlanganise izendlalelo eziningi zokuzivikela ukuze uvikele amaseva akho e-Linux abonakalayo.
Lorena Figueredo

Imizuzu ye-17

Vimbela imizamo yephasiwedi ku-Linux ukuvikela i-SSH nezinsizakalo

Uma uphatha iseva ye-Linux evezwe kwi-inthanethi, uzobona ngokushesha noma kamuva ku-log izinkulungwane zemizamo yokungena ngemvume ye-SSH kusuka kumakheli e-IP angahleliweAkukhona ukuthi abakuthandi: bangama-robot azenzakalelayo ahambahamba ezindaweni ze-IP efuna iminyango engavikelekile kahle.

Kuseva encane, leyo mizamo ingahunyushwa ibe Ukwanda kokusetshenziswa kwe-CPU, ukwehla kokusebenza, ngisho nokuphazamiseka kwesevisi ngezikhathi ezithileIzindaba ezinhle ukuthi i-Linux inikeza amathuluzi amaningi okunciphisa imizamo yokungena ngephasiwedi, ukuvimba ama-IP anolaka, kanye nokuqinisa i-SSH ukuze kube nzima kakhulu kumhlaseli.

Ukuthola ukuhlaselwa kwe-SSH brute-force kanye nomthelela wazo kuseva

Ngaphambi kokuthi siqale ukumisa noma yini, kuyasiza ukuqonda ukuthi singabona kanjani ukuthi sibhekene nobunzima ukuhlaselwa kwe-brute-force ngokumelene ne-SSH noma ezinye izinsizakalonokuthi iyini imiphumela emshinini.

Uphawu olujwayelekile kakhulu ukubona ukwanda okungazelelwe kokusetshenziswa kwe-CPU ngaphandle kokushintsha kwethrafikhi esemthethweni noma umthwalo wedathabheyisiIsibonelo, ungase ube nokwanda kwe-CPU imizuzu embalwa ngenkathi ukusetshenziswa kwememori nediski kuhlala kungashintshi, okuvame ukukhomba izinqubo ezidinga ukubalwa okuningi (njengemizamo eminingi yokuqinisekisa) kunemibuzo enzima.

Ukuze uhlaziye okwakwenzeka esikhathini esithile, kuyasiza kakhulu ukusebenzisa iphephandabaIthuluzi le-systemd lokufunda amalogi esistimu, isevisi, i-kernel, kanye nokuqinisekiswa. Isibonelo esijwayelekile sombuzo kungaba:

journalctl --since "2025-11-16 13:10" --until "2025-11-16 13:16"

Ngalolo hlobo lombuzo ungabuyekeza ngokuningiliziwe Yimiphi imiyalezo uhlelo oluyibhalile ngesikhathi sefasitela lapho i-CPU ikhuphuke khona?: izinsizakalo eziqala kabusha, ukwehluleka kokuqinisekisa, amaphutha e-kernel, njll.

Ezimweni eziningi uzothola imigqa ephindaphindwayo ehlobene ne-SSH, njenge "Iphasiwedi yehlulekile" ekhombisa imizamo yokungena ehlulekileLokho kufana kakhulu neziqinisekiso zokuhlola ama-bots ngamandla amakhulu.

Linganisa imizamo ehlulekile ku-/var/log/auth.log

Kuzinhlelo ze-Debian/Ubuntu, ifayela eliyisihluthulelo lokulandelela noma yini ehlobene nokuqinisekiswa yi- /var/log/auth.logYilapho kubhalwa khona ukungena ngemvume okuphumelelayo, imizamo ehlulekile, imicimbi ye-PAM, ukukhiywa kwama-akhawunti, njll.

Uma ufuna ukwazi ukuthi iphethini iqoshwe kangaki "Iphasiwedi ehlulekile" kulogi yamanje, ungasebenzisa:

sudo grep 'Failed password' /var/log/auth.log | wc -l

Umphumela ungamangaza: akuvamile ukubonwa izinkulungwane zemizamo ehlulekile zanqwabelana ngendaba yamahoraFuthi khumbula ukuthi yilelo fayela lamanje nje.

Njengoba amalogi ejikeleziswa, kubalulekile futhi ukubuyekeza amafayela amadala. Ungabona ukuthi ilogi yamanje ihlanganisa isikhathi esingakanani ngento efana nale:

head -n 1 /var/log/auth.log
tail -n 1 /var/log/auth.log

Ngaleyo ndlela uzokwazi ukuthi Usuku lwerekhodi lokuqala nelokugcina olukhona ku-auth.logOkunye ukuzama kwangaphambilini kuzoba ku-auth.log.1 nakumafayela acindezelwe ku-auth.log.N.gz.

Ukuze ubukeze amalogi amadala acindezelwe futhi ubale imizamo yephasiwedi ehlulekile, ungasebenzisa:

zgrep 'Failed password' /var/log/auth.log.*.gz | wc -l

Uma uhlanganisa lokho okubonayo ku- auth.log, auth.log.1 kanye ne-auth.log.*.gz Uzothola umbono omuhle we Umlando wokuhlaselwa ngamandla amakhulu, uma kucatshangelwa ukuthi ezindala kakhulu kungenzeka ukuthi sezinyamalele kakade ngenxa yokujikeleza.

Indlela okusebenza ngayo ukujikeleziswa kwelogi yokuqinisekisa

Indlela kanye nemvamisa amalogi ajikeleza ngayo kuncike ekucushweni kwe- qobisaKu-Ubuntu, ukuzungeza kwe-auth.log kuvame ukuchazwa ku-/etc/logrotate.d/rsyslog, lapho uzothola khona into efana nale:

weekly
rotate 4
compress

Lokho kusho ukuthi Ilogi lijikeleziswa masonto onke, kugcinwa amakhophi amane amadala, bese amadala ecindezelwa abe amafayela e-.gz.Umsebenzi we-cron wansuku zonke unesibopho sokusebenzisa i-logrotate nokusebenzisa le mithetho.

Ngakho-ke, uma ubala imizamo yakho yamandla amakhulu, cabanga ukuthi Ubona idatha yomlando yamasonto ambalwa edlule kuphela.Noma yini eyenzeka esikhathini esidlule ngeke isatholakala ohlelweni.

Thola abasebenzisi abahlaselayo nama-IP

Ngale kokubalwa okuphelele, kubalulekile ukwazi Yimaphi abasebenzisi abahlosiwe futhi ukuhlaselwa kuvela kumaphi amakheli e-IP?Uma une-awk encane ku-auth.log unayo eduze.

Ukuze ubone ukuthi yimaphi amagama abasebenzisi azanywa emizamweni ehlulekile:

sudo grep 'Failed password' /var/log/auth.log \
  | awk '{print $(NF-5)}' \
  | sort | uniq -c

Futhi ukubona ama-IP anomsebenzi osolisayo kakhulu:

sudo grep 'Failed password' /var/log/auth.log \
  | awk '{print $(NF-3)}' \
  | sort | uniq -c | head

Lokhu kuzokuvumela ukuthi ubone ngokushesha ukuthi bayahlasela yini. ama-akhawunti angempela avela kusistimu yakho noma kubasebenzisi abajwayelekile njenge-root, admin, test, user, njll., kanye nokuthi yimaphi ama-IP okufanele uwavimbe ngokushesha.

Ingabe kungokungathi sína kangaka ukuthi kunezinkulungwane zemizamo?

Kumelwe kucatshangelwe ukuthi, uma iseva yakho itholakala kwi-inthanethi futhi Ukulalela kwe-SSH ku-port 22 noma kunoma iyiphi enyeLe seva izothola lolu hlobo lwethrafikhi amahora angama-24 ngosuku. Kujwayelekile ukubona izinkulungwane zemizamo ehlulekile uma iseva ibilokhu isebenza isikhathi eside.

Ubukhulu bamandla adonsela phansi buxhomeke kuzilungiselelo zakho:

Isethaphu Ingozi elinganiselwe
Amaphasiwedi abuthakathaka + vula i-SSH ku-inthanethi Ingozi ephezulu kakhulu yokuyekethisa
Amaphasiwedi aqinile Ingozi emaphakathi, kodwa ukusetshenziswa kwezinsizakusebenza
I-Fail2ban ilungiselelwe kahle Ingozi ephansi kanye nokuhlaselwa okuncishisiwe kakhulu
Finyelela kuphela ngezihluthulelo ze-SSH Ingozi isondele kakhulu ku-zero ngamandla amakhulu

Ngamanye amazwi: ukuhlaselwa okuzenzakalelayo kuyinto evamile, kodwa uma ukucushwa kwakho kungakhululekile, Iphasiwedi eyodwa nje ehlulekile yanele ukukubangela ukuthi ulahlekelwe yiseva yonke.Yingakho kubaluleke kakhulu ukunciphisa imizamo, ukuvimba ama-IP, futhi, lapho kungenzeka, ukususa amaphasiwedi.

Ukuqina kwe-SSH okuyisisekelo: izinketho ezibalulekile ku-sshd_config

Vimbela imizamo yephasiwedi ku-Linux ukuvikela i-SSH nezinsizakalo

Umzila wokuqala wokuzivikela ungaphakathi komuntu siqu I-SSH daemon (sshd) kanye nefayela layo lokucushwa /etc/ssh/sshd_config (kanye namafayela e-.d ahlobene). Iziqondiso ezimbalwa ezilungisiwe kahle zinciphisa kakhulu indawo yokuhlasela.

Khumbula ukuthi ekusakazweni kwesimanje njengo-Ubuntu 22.04 nangemva kwalokho, I-sshd iqale ifunde i-/etc/ssh/sshd_config bese kuba amafayela aku-/etc/ssh/sshd_config.d/*.conf ngokulandelana kwezinhlamvu zamagama. Noma yini evela kamuva ingase ibhale ngaphezulu kwamapharamitha achazwe ngaphambilini, ngakho-ke qaphela kakhulu ukuthi yini oyishintshayo.

Khubaza ukufinyelela okungenaphasiwedi kanye nezikhathi ezingadingekile

Nakuba iza ihlelwe kahle ekusakazweni okuningi kwesimanje, akukubi ukuqinisekisa lokho Ukungena ngemvume ngaphandle kwephasiwedi echaziwe akuvunyelwe.Isiqondiso esiyinhloko yilesi:

PermitEmptyPasswords no

Ngokuvamile kubekwa amazwana noma kusethwe ngokusobala ku-"cha". Futhi, qiniseka ukuthi unezici ongeke uzisebenzise ezikhutshaziwe, njenge... Ukudlulisela phambili kwe-X11 (X11Ukudlulisela phambili) Uma ungenzi amaseshini ehluzo ezikude:

X11Forwarding no

Ngokuphathelene nezinqubo, uma nganoma yisiphi isizathu uphatha uhlelo oludala kakhulu, hlola ukuthi kuvunyelwe izenzo ezithile kuphela. Iphrothokholi ye-SSH 2:

Protocol 2

Shintsha imbobo ezenzakalelayo bese ukhawulela ukuthi ilalele kusiphi isikhombikubona.

Elinye icebo elilula, nakuba lingelona elilula, yileli Susa i-SSH kusuka ku-port 22 uye ku-port engeyona ejwayelekile.Lokhu akukuvikeli kumhlaseli ongathi sína, kodwa kuhlunga inani elikhulu lomsindo ozenzakalelayo oskena kuphela i-22.

Port 2222
ListenAddress 192.168.56.8

Ngaphezu kokushintsha ichweba, ungacacisa ikheli elithile lapho i-SSH izolalela khona, isibonelo, ikheli lakho le-IP langaphakathi uma ufuna ukuligcina kunethiwekhi ethile. Kodwa-ke, uma ukusatshalaliswa kwakho kusebenzisa i-ssh.socket ye-systemd, kungadingeka... Khubaza isokhethi bese ubuyela ku-ssh.service yakudala. ukuhlonipha ukucushwa kwembobo:

sudo systemctl disable ssh.socket
sudo systemctl daemon-reload
sudo systemctl enable ssh.service
sudo systemctl start ssh.service

Noma nini lapho ushintsha imbobo, hlola uxhumano oluvela kwenye itheminali ngaphambi kokuvala iseshini eyinhloko, ukuze ungabhajwa ngaphandle kokufinyelela okude.

Vimba noma ukhawulele ukufinyelela kwezimpande

Umsebenzisi wempande uyisisulu esilula sabahlaseli, ngakho-ke kunengqondo. vimbela ukuxhumeka nge-SSHngisho nangamaphasiwedi. Ulawula lokhu kuziphatha ngesiqondiso:

PermitRootLogin no

Ezintweni eziningi zesimanje, iza ngemodi ethi "prohibit-password", evimbela ukungena kwamaphasiwedi kodwa ishiye umnyango uvulekele izitifiketi. Uma ufuna ukuphepha, yishiye isethwe ku-"cha" bese usebenzisa i-akhawunti ejwayelekile ene-sudo yokuphatha.

Chaza ukuthi ubani ongafinyelela: AllowUsers kanye ne-AllowGroups

Ngokuzenzakalelayo, noma yimuphi umsebenzisi one- igobolondo elivumelekile kanye nephasiwedi echaziwe Ungazama ukuxhuma nge-SSH. Lokho ngokuvamile akulungile kumaseva okukhiqiza, lapho mhlawumbe ama-akhawunti amabili noma amathathu kuphela okufanele abe nokufinyelela.

Ukuze ukhawulele abasebenzisi abavunyelwe, uneziqondiso ezilandelayo. Vumela Abasebenzisi y VumelaAmaqembu. Isibonelo:

AllowUsers harry hermione
AllowGroups gryffindor

Uhlu luhlukaniswe ngezikhala kanti izincazelo zezincazelo yilezo "zohlu olumhlophe": Ama-akhawunti namaqembu abhalwe ohlwini kuphela azokwazi ukuqinisekisaKhumbula futhi ukuthi i-AllowUsers iza kuqala kune-AllowGroups, ngakho-ke ungawaxubi ngaphandle kokuthi ucacile ngokulandelana kokuhlola.

Umkhuba omuhle ukusebenza ngokuyinhloko namaqembu ajwayelekile. abashushisi noma abaphathi bese wengeza ama-akhawunti agunyaziwe lapho, esikhundleni sokugcina uhlu lwabasebenzisi ngamunye ngamunye kufayela.

Nciphisa imizamo yokuqinisekisa kanye nesikhathi sokungasebenzi

Esinye isendlalelo sokuvikela sikhona Nciphisa inani lemizamo ehlulekile evunyelwe ekuxhumekeni okukodwa nokuthi iseshini ingahlala isikhathi esingakanani ingasebenzi. Embuzweni wokuqala, ungasebenzisa:

MaxAuthTries 3

Ngalokhu, iseva izovala uxhumano ngemva kwemizamo emithathu engalungile, okuyinto Lokhu kwenza noma yikuphi ukuhlasela okuzama amaphasiwedi amaningi ngokumelene neseshini efanayo ye-SSH kungasebenzi kahle..

Ngokuphathelene nesikhathi sokungasebenzi, i-SSH ikuvumela ukuthi uqede ukuxhumana okuhlala kuvuliwe ngaphandle komsebenzi ongaphezu komkhawulo ochaziwe. I-ClientAliveInterval (ngemizuzwana):

ClientAliveInterval 180

Ngemva kwemizuzu emithathu kungekho traffic, iseva izothumela imiyalezo yokugcina iphila futhi, uma iklayenti lingaphenduli, Iseshini izovala ngokuzenzakalelayoKuyindlela yokunciphisa izingozi ezivela kuma-terminal angakhohliwe, angavuliwe.

Vimbela ukufinyelela ngekheli le-IP: i-TCP Wrappers kanye ne-Match

Kwezinye izimo ungase ube nentshisekelo kuzo Ama-IP athile noma amabanga kuphela angafinyelelwa nge-SSHUnezindlela eziningana zokukwenza: kusukela ku-firewall uqobo (iptables/nftables), ngokusebenzisa i-TCP Wrappers, kuya kumabhulokhi e-Match e-sshd_config.

Nge-TCP Wrappers, esasetshenziswa ekusatshalalisweni okuningi, ukufinyelela kulawulwa nge-/etc/hosts.allow kanye ne-/etc/hosts.deny. Ukugeleza yilokhu: Okokuqala, i-hosts.allow iyahlolwa, bese kuba i-hosts.deny.Isibonelo esinqunyelwe kungaba:

# /etc/hosts.deny
ALL: ALL
# /etc/hosts.allow
sshd: 192.168.1.89 192.168.1.55
sshd: ALL: DENY

Ngaleso simiso, Ama-host amabili kuphela azokwazi ukuxhuma nge-SSHkanti okunye kuzonqatshwa. Kusebenza kahle kakhulu ezindaweni ezivaliwe, yize kungaguquguquki kakhulu kune-firewall yesimanje enhle.

Enye inketho, ejwayelekile kakhulu kwi-SSH, ukusebenzisa amabhlogo Match ngaphakathi kwe-sshd_config ukuze kusetshenziswe imithetho esekelwe ekhelini noma kumsebenzisi. Cabanga ukuthi ufuna umsebenzisi "git" akwazi ukungena noma kuphi, kodwa umsebenzisi wakho womlawuli "greg" angangena kuphela kusuka ku-LAN 192.168.1.0/24. Ungahlanganisa i-AllowUsers nemithetho ye-Match Address, yize kufanele uqaphele kakhulu ukuthi... ungazivaleli kude nawe.

I-Fail2ban: Amabhulokhi azenzakalelayo ngokumelene namandla aluhlaza

Ngisho noma uqinisa i-SSH, ama-bot asazozama iziqinisekiso, okubangela ukusetshenziswa kwe-CPU nomsindo we-log. Ukuze kuncishiswe lokhu, lokhu kuyasetshenziswa. I-Fail2ban, uhlelo lokuvimbela ukungena olusekelwe kulogi okuvimba ngokuzenzakalelayo ama-IP ngamaphutha amaningi kakhulu.

I-Fail2ban ibhalwe nge-Python futhi ithembele "emajele" noma amajele, ngalinye lihlotshaniswa nensizakalo kanye namafayela elogi elilodwa noma ngaphezuluUma ithola iphethini yephutha eliphindaphindwayo (ukwehluleka kwephasiwedi, ukufinyelela okuvinjelwe, njll.), ibangela izenzo, ngokuvamile imithetho ye-firewall ukuvimba umthombo.

Faka i-Fail2ban ekusakazweni kwe-Linux okuvamile

Ukufakwa okuyisisekelo kulula kakhulu usebenzisa umphathi wephakheji wokusabalalisa kwakho. Ku-Ubuntu noma ku-Debian, lokhu kunganele:

sudo apt update
sudo apt install fail2ban

Ezinhlelweni ezisekelwe ku-RHEL (RHEL, CentOS, AlmaLinux, Rocky, njll.) umyalo ojwayelekile uzoba no- dnf noma yum, kuye ngenguqulo:

sudo dnf install fail2ban

Iphakheji ivame ukufaka isevisi yesistimu eqala ngokuzenzakalelayo, yize kufanelekile ukuhlola lokho I-Fail2ban iqala ekuqaleni futhi iyasebenza:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

Isakhiwo sokucushwa: jail.conf, jail.local, kanye ne-jail.d

Ukucushwa kuhlala ku- /njll/fail2ban/Ifayela eliyinhloko yi-jail.conf, kodwa ukulihlela ngqo akukhuthazwa ngoba liyabhalwa phansi ngesikhathi sokubuyekezwa. Kunalokho, kufanele:

  • Dala noma hlela /etc/fail2ban/jail.local ukuze ubhale kabusha amanani azenzakalelayo.
  • Noma engeza amafayela athile ku-/etc/fail2ban/jail.d/*.conf.

I-Fail2ban ilayisha ukucushwa ngale ndlela:

/etc/fail2ban/jail.conf
/etc/fail2ban/jail.d/*.conf
/etc/fail2ban/jail.local

Konke okuchazayo ejele. Indawo ithatha indawo yokuqala kunayo yonke into eyake yaba khona ngaphambili, ngakho-ke Ungenza ngokwezifiso ngaphandle kokuthinta amafayela ephakheji..

Amapharamitha abalulekile emhlabeni wonke: i-bantime, i-maxretry, i-ignoretip

Ngaphakathi kwe-jail.conf (noma i-jail.local) uzobona isigaba [SOKWENZAKALELAYO] esinemingcele yomhlaba wonke ethinta wonke amajele ngaphandle kokuthi abekwe ngaphezulu. Ebaluleke kakhulu yile:

  • isikhathi: isikhathi lapho i-IP izovinjelwa khona (ngemizuzwana) ngemva kokudlula inani lokwehluleka okuvunyelwe.
  • i-maxretry: inani eliphezulu lemizamo ehlulekile ngaphambi kokusebenzisa ukuvinjelwa.
  • isikhathi sokuthola: isikhathi lapho leyo mizamo ibalwa khona (isb., 10m imizuzu eyishumi).
  • ukunganaki: uhlu lwama-IP noma amabanga okungafanele i-Fail2ban iwavimbe (isibonelo, i-IP yakho yomphakathi noma inethiwekhi yakho yokuphatha).

Isibonelo, ungaba nento efana nale ku-[DEFAULT]:

[DEFAULT]
bantime  = 600
findtime = 600
maxretry = 5
ignoreip = 127.0.0.1/8 192.168.1.0/24

Ngaleso simiso, Noma yiliphi ikheli le-IP elihluleka izikhathi ezinhlanu ngemizuzu eyishumi lizovinjelwa imizuzu eyishumi., ngaphandle kokuthi kuyingxenye yobubanzi obunganakwa.

Lungiselela i-sshd yejele ukuze umise ukuhlaselwa kwe-SSH

Ijele elivame kakhulu yijele le-SSH. Ezindaweni eziningi zokusabalalisa, liza lilungiselelwe kusengaphambili ku-jail.conf; udinga nje ukulisebenzisa noma ukulungisa amanani alo ku-jail.local. Isibonelo esilula:

[sshd]
enabled  = true
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 600
findtime = 10m

Kulokhu, Imizamo emithathu yokungena ngemvume ehlulekile ku-auth.log zingakapheli imizuzu eyishumi izoholela ekuvinjelweni kwekheli le-IP lomhlaseli imizuzu eyishumi.I-Fail2ban ifaka imithetho ku-firewall (ama-iptables, ama-nftables noma i-UFW, kuye ngohlelo) ukuze ukuxhumana okuvela kuleyo IP kungafinyeleli ngisho naku-sshd.

Ukuze usebenzise noma yiziphi izinguquko zokucushwa, khumbula ukuqala kabusha isevisi:

sudo systemctl restart fail2ban

Buka isimo samajele kanye nama-IP avinjelwe

I-Fail2ban ifaka uhlelo lokulawula oluwusizo kakhulu, iklayenti le-fail2banNgaleli thuluzi, ungabona ukuthi yimaphi amajele asebenzayo nokuthi yimaphi ama-IP avinjelwe. Isibonelo:

sudo fail2ban-client status

Kuzobonisa into efana nalokhu:

Status
|- Number of jail: 1
`- Jail list: sshd

Ukuze uthole ulwazi oluningiliziwe mayelana nejele le-SSHD:

sudo fail2ban-client status sshd

Umphumela uhlanganisa, phakathi kwezinye izinkambu, inani lama-IP avinjelwe njengamanje kanye inani eliphelele lamakheli avinjiwe okungenani kanye, kanye nohlu lwe-IP oluqhubekayo.

Ngale datha ungathola umbono wokuthi Ingakanani ithrafikhi enonya etholwa yiseva yakho futhi iphumelela kangakanani ukucushwa kwamanje?.

Izingidi ezihlala njalo kanye ne-bantime eqhubekayo

Uma ufuna ukuba lukhuni kakhulu kubantu abaphindayo ukwephula umthetho, i-Fail2ban inikeza amasu amabili athakazelisayo: ukuvinjelwa okuhlala njalo kanye nokuvinjelwa okuqhubekayo.

Ukuze uvimbele unomphela noma yiliphi ikheli le-IP elidlula umkhawulo wokuhluleka, vele ufake:

bantime = -1

Ngaleso shintsho, Ama-IP avunyelwe awavulwa ngokuzenzakalelayoUngazisusa ngesandla kuphela uma kudingeka.

Indlela eguquguqukayo kakhulu yindlela ekhuphukayo, lapho ukuphinda ubugebengu ngakunye kwandisa isikhathi sokuvinjelwa ngokwesici esithile:

bantime           = 10m
bantime.increment = true
bantime.rndtime   = 0
bantime.factor    = 4
bantime.maxtime   = -1

Ngala manani, ukuqhubeka kuzobukeka kanje:

  • Ibhulokhi yesithathu: Imizuzu ye-10
  • Ibhulokhi yesibili: Imizuzu ye-40
  • Ibhulokhi yesithathu: Imizuzu ye-160 (~amahora ama-2 nama-40)
  • Ibhlokhi lesi-4: nxazonke Amahora we-10,6
  • Ibhloko lesi-5: abanye Amahora we-42

Njengoba i-bantime.maxtime ingu-1, i- ubude bungaqhubeka bukhula unomphela, okwenza abashayi abanzima kakhulu bangabi khona unomphela emdlalweni.

Ukusebenzisa i-Fail2ban ngale kwe-SSH: i-Apache, i-WordPress, i-MySQL, izitolo eziku-inthanethi…

Uma usuyitholile i-Fail2ban, into enengqondo okufanele uyenze ukuyelula ku- vikela ezinye izinsizakalo ezibucayi ngaphandle kwe-SSH: amaphaneli okuphatha iwebhu, i-CMS, izizindalwazi, njll.

Isibonelo, esitolo esiku-inthanethi (iMagento, iPrestaShop, iWooCommerce…) kunengqondo kakhulu ukudala ijele eliqapha Amalogi okufinyelela e-Apache noma e-Nginx afuna amakhodi amaningi angu-401/403 ku-/admin noma ku-/loginUkucushwa okuncane okusekelwe ku-Apache kungaba:

[apache-auth]
enabled  = true
filter   = apache-auth
logpath  = /var/log/apache2/access.log
maxretry = 5
bantime  = 3600

Ezindaweni ze-WordPress, inhlanganisela evamile ukuqapha /wp-login.php kanye /xmlrpc.phpLezi yizindawo zokungena ezivamile zokuhlasela kwe-brute-force kanye ne-bot. Isihlungi singafakwa ku-/etc/fail2ban/filter.d/wordpress.conf:

[Definition]
failregex = .*"POST /wp-login.php HTTP.*" 403
ignoreregex =

Futhi ijele elihambisanayo ejele. lendawo:

[wordpress]
enabled  = true
filter   = wordpress
logpath  = /var/log/apache2/access.log
maxretry = 3
bantime  = 3600

Umqondo ofanayo usebenza kuma-database avuliwe (into evame ukugwenywa kangcono): uma ufuna ukuvikela i-MySQL emizamweni yokufinyelela ehlulekile eqhubekayo, ungakha isihlungi se- Imiyalezo ethi “Ukufinyelela kunqatshelwe kumsebenzisi” kulogi yamaphutha:

[Definition]
failregex = ^<HOST>.*Access denied for user.*$
ignoreregex =

Bese kuba yijele:

[mysqld-auth]
enabled  = true
filter   = mysql
logpath  = /var/log/mysql/error.log
maxretry = 5
bantime  = 1800

Kumaseva okusingatha anamaphaneli okulawula afana cPanel noma PleskI-Fail2ban ihlangana kahle futhi: ingaqapha izinsizakalo zeposi, i-Apache, i-FTP, ngisho nephaneli yokulawula uqobo, ivimba ama-IP adlula uphawu ngemizamo yokungena ngemvume.

Ukuqinisekiswa ngezihluthulelo ze-SSH: ukuphela kokuhlaselwa kwephasiwedi

Konke okungenhla kuyasiza, kodwa intuthuko yangempela yekhwalithi ifika lapho unquma Yeka ukusebenzisa amaphasiwedi e-SSH bese ushintshela kukhiye womphakathi/wangaseseNgaleso sikhathi, ukuhlaselwa kwamaphasiwedi nge-brute-force akusasebenzi.

Umqondo ulula: umsebenzisi ngamunye osemthethweni unezihluthulelo ezimbili, i- ukhiye oyimfihlo ohlala kudivayisi yakho futhi a ukhiye womphakathi okopishwe kuseva kufayela lomsebenzisi elihambisanayo elithi ~/.ssh/authorized_keys.

Uma iklayenti lixhuma, alithumeli ukhiye wangasese; lithumela ukhiye womphakathi bese usayina inselelo yeseva ngeyangasese. Iseva ihlola leyo siginesha ngokumelene neyomphakathi, futhi kuphela uma ifana lapho ivumela ukufinyelela khona.

Kungani okhiye be-SSH bechitha amandla e-password brute

Kuhlelo lwephasiwedi olujwayelekile, umhlaseli kufanele azame imicu yombhalo kuze kube yilapho eyodwa ifana nephasiwedi egciniwe (noma i-hash yayo). Nakuba iphasiwedi enhle inezinhlanganisela eziningi ezingenzeka, Sikhuluma ngama-oda amakhulu anjenge-10¹⁰ amathuba amaphasiwedi ajwayelekile.

Ukhiye ojwayelekile we-256-bit SSH (njengalowo oku-Ed25519) uhamba ezindaweni zokusesha ngokulandelana kwe- Izinhlanganisela ezingu-10⁶¹⁷Empeleni, akunakwenzeka ngokwezibalo ukuthi umhlaseli aqagele ukhiye wangasese ngamandla amakhulu ngamakhompyutha esimanje.

Kodwa ngaphezu kwalokho, iseva ayizami nokubala noma yini uma Ukhiye womphakathi owethulwe awukho ku-authorized_keysUma kunjalo, ilahla uxhumano cishe ngokushesha, ngaphandle kokusebenzisa izinqubo zokuqinisekisa ze-PAM noma zendabuko, ngakho-ke ukusetshenziswa kwe-CPU ngesikhathi sokuhlasela okukhulu kuncane kakhulu.

Khiqiza futhi uqinisekise okhiye be-SSH kuklayenti

Ngaphambi kokufinyelela iseva, hlola ukuthi umshini wakho usuvele unepheya lokhiye we-SSH elikhiqizwe. Mane nje ubhale okuqukethwe yi-~/.ssh:

ls -l ~/.ssh

Uma ubona amafayela afana nalawa id_ed25519 kanye ne-id_ed25519.pub Uma une-id_rsa kanye ne-id_rsa.pub, usuvele unayo i-pair esebenzayo. I-Ed25519 ingeyesimanje futhi ilula, ngakho-ke ngokuvamile iyindlela engcono kakhulu kulezi zinsuku.

Uma ungenawo okhiye, dala abasha nge:

ssh-keygen -t ed25519 -C "tu_usuario@tu_equipo"

Umyalo uzodala amafayela amabili:

  • id_ed25519: ukhiye oyimfihlo, okungafanele neze wabelane ngawo.
  • id_ed25519.pub: ukhiye womphakathi, ongawukopishela kumaseva.

Ungabuka okuqukethwe ukhiye womphakathi nge:

cat ~/.ssh/id_ed25519.pub

Kopisha ukhiye womphakathi kuseva bese uhlola ukufinyelela

Kuseva, qiniseka ukuthi isiqondisi se-~/.ssh sikhona somsebenzisi ozongena ngemvume njengo (isibonelo, i-git noma umsebenzisi wakho womlawuli) nokuthi sinaso izimvume 700:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

Bese wengeza okuqukethwe kwe-id_ed25519.pub yeklayenti lakho ku- ~/.ssh/authorized_keys (ukudala ifayela uma lingekho) bese ulinika izimvume ezingu-600:

echo "TU_PUBLIC_KEY" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Khumbula ukufaka esikhundleni se-YOUR_PUBLIC_KEY ngomugqa ophelele owubonile usebenzisa i-`cat` emshinini wakho. Ukusuka lapho, ungahlola uxhumano ngokucacisa ngokucacile ukhiye uma ufisa.

ssh -i ~/.ssh/id_ed25519 usuario@IP_DEL_SERVIDOR

Uma konke kuhamba kahle, Iseva ngeke icele iphasiwedi futhi uzogxumela ngqo kugobolondoNgaleso sikhathi usukulungele ukucabanga ngokukhubaza ukuqinisekiswa kwephasiwedi.

Khubaza ngokuphelele i-PasswordAuthentication kuseva

Uma usuqinisekisile ukuthi ungangena ku-akhawunti yakho ngephasiwedi yakho kusuka okungenani kudivayisi eyodwa (okungcono ezimbili, uma kwenzeka ulahlekelwa eyodwa), kungumqondo omuhle lokho. Khubaza ukungena ngemvume ngephasiwedi kwe-SSHLokhu kuqeda noma yimuphi umzamo we-classic brute force.

Ngaphambi kokuthinta ukucushwa, kungumqondo omuhle ukubona ukuthi yimaphi amafayela achaza i-PasswordAuthentication, ngoba ezifakiwe eziningi zesimanje Kunamafayela e-.d abhala ngaphezulu inani le-sshd_config eyinhloko:

sudo grep -R "PasswordAuthentication" /etc/ssh/

Kuvamile ukuthola into efana nale:

/etc/ssh/sshd_config.d/50-cloud-init.conf:PasswordAuthentication yes
/etc/ssh/sshd_config:PasswordAuthentication no

Kuleso simo, ukucushwa okusebenzayo kuzoba "yebo" ngoba ifayela le-50-cloud-init.conf liyalayishwa ngemuva kwalokho bese libhala ngaphezulu inani. Ungaqinisekisa umphumela wokugcina osetshenziswa yi-sshd nge:

sudo sshd -T | grep passwordauthentication

Ukuze ukhubaze amaphasiwedi angempela, hlela ifayela elinomthwalo wemfanelo (isibonelo /etc/ssh/sshd_config.d/50-cloud-init.conf) bese ushiya:

PasswordAuthentication no

Bese uqala kabusha isevisi ye-SSH:

sudo systemctl restart ssh

Futhi hlola kabili nge:

sudo sshd -T | grep passwordauthentication

Uma ibuyisa "cha", Imizamo yokungena ngemvume ngephasiwedi izonqatshwa ngokusheshaIzinhlelo ezifana ne-PuTTY zizobonisa iphutha ngoba azikwazi ukunikeza iziqinisekiso zohlobo lwephasiwedi, kodwa amaklayenti akho anezihluthulelo azoqhubeka nokusebenza ngaphandle kwenkinga.

Ukuhlanganisa okhiye be-SSH ne-Fail2ban nezinye izindlela

Uma ususa i-PasswordAuthentication ku-equation, inani le-Fail2ban le-SSH liba usizo kakhulu kune-critical, njengoba Ama-bot awanawo ngisho nensimu yokufaka iphasiwedi.Noma kunjalo, kuyalulekwa ukugcina ijele le-sshd lisebenza ngoba lisebenza njengesendlalelo esengeziwe ngokumelene nemizamo engavamile yezinye izinhlobo noma ukusetshenziswa kabi kwezinkinobho.

Uma lokhu kuhlanganiswa kwe Izinkinobho ze-SSH kuphela + i-Fail2ban + i-root lock + uhlu lwe-AllowUsers/AllowGroups oluhlelwe kahle Engeza i-firewall evimbelayo (iptables/nftables, UFW, firewalld) futhi, uma kufaneleka, uhlu lokulawula ukufinyelela nge-TCP Wrappers, futhi uzobe unciphise amathuba okungena ngamandla amakhulu abe sezingeni elincane.

Ezindaweni ezibucayi kakhulu, ungathatha isinyathelo esengeziwe bese wethula ukuqinisekiswa kwezinto ezimbili (2FA) kwe-SSHkusetshenziswa amamojula afana ne-Google Authenticator noma afanayo nge-PAM, noma ngisho nokukhawulela ukuthi ubani ongafinyelela imbobo ye-SSH kusetshenziswa ama-VPN azinikele.

Njengoba zonke lezi zinto zihlanganiswe kahle—ukutholwa kwamalogi, ukucushwa kwe-sshd ngokucophelela, ukusetshenziswa kabanzi kwe-Fail2ban, okhiye be-SSH esikhundleni samaphasiwedi, kanye, uma kudingeka, nezilawuli ezisekelwe ku-IP—iseva ye-Linux ingaphatha ukuhlaselwa okuqhubekayo kwamandla anamandla ku-SSH nakwezinye izinsizakalo eziveziwengenkathi kugcinwa ukufinyelela okulula nokuphephile kwabaphathi.


Engeza njengomthombo okhethwayo