【初始化-sshd】init_sshd.sh
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
#!/bin/bash
#
# 2015/4/20
# SSH
s_port=2222
echo
"[-] add dport ${s_port}"
mkdir
-p
/data/ops/conf
cd
/data/ops/conf/
iptables-save >rc.firewall.txt
grep
"dport ${s_port} -j"
rc.firewall.txt ||
sed
-i
"/-A INPUT -j REJECT --reject-with icmp-host-prohibited/i\-A INPUT -p tcp -m state --state NEW -m tcp --dport ${s_port} -j ACCEPT"
rc.firewall.txt
iptables-restore rc.firewall.txt
echo
"[-] iptables status:"
iptables -nL
echo
"[-] check it before running 'service iptables save'"
setenforce 0
cat
>
/etc/ssh/sshd_config
.new << _EOF
Port 22
Port ${s_port}
Protocol 2
SyslogFacility AUTHPRIV
#PasswordAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM
yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding
yes
UseDNS no
Subsystem
sftp
/usr/libexec/openssh/sftp-server
_EOF
mv
/etc/ssh/sshd_config
/etc/ssh/sshd_config
.old
mv
/etc/ssh/sshd_config
.new
/etc/ssh/sshd_config
echo
'#########################################'
echo
''
cat
/etc/ssh/sshd_config
echo
''
echo
'#########################################'
echo
'注意：selinux禁用并重启后再更改port，以免连接不上ssh端口；建议后续再禁用root，password登录，改用key登录；'
echo
'[note] check config file and run : service sshd reload'
|
本文转自 pcnk 51CTO博客，原文链接：http://blog.51cto.com/nosmoking/1594641，如需转载请自行联系原作者
