OpenSSH Configurations Optimization & Simple Usages

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# CentOS/RedHat
sudo yum install openssh-clients -y
sudo yum install openssh-server -y

# Debian/Ubunut
sudo apt-get install openssh-clients -y
sudo apt-get install openssh-server -y

# OpenSUSE contain server & client side
sudo zpyyer install openssh -y

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

sudo systemctl stop sshd.service
sudo systemctl disable sshd.service

# CentOS/RedHat
sudo yum erase openssh-server -y

# Debian/Ubunut
sudo apt-get purge openssh-server -y
sudo apt-get autoremove -y

# OpenSUSE
sudo zypper remove -y openssh

1

man ssh | sed -n '/^FILES/,/^EXIT STATUS/p' | sed '$d'

1

ssh -Q {cipher | cipher-auth | mac | kex | key}

1
2
3
4
5
6
7

len=20

# method 1
tr -dc A-Za-z0-9_ < /dev/urandom | head -c $len | xargs

# method 2
openssl rand -base64 $len

1

man 5 sshd_config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

# Only Use SSH Protocol 2
sudo sed -i -r '[email protected]^#?(Protocol 2)@\[email protected]' /etc/ssh/sshd_config

# Limit Users' SSH Access, separated by spaces
# DenyUsers > AllowUsers > DenyGroups > AllowGroups

# Log Out Timeout Interval, just work for Protocol 2
[[ ! -z $(sed -n -r '/^#?ClientAliveCountMax/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(ClientAliveCountMax).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a ClientAliveCountMax 0' /etc/ssh/sshd_config

[[ ! -z $(sed -n -r '/^#?ClientAliveInterval/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(ClientAliveInterval).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a ClientAliveInterval 180' /etc/ssh/sshd_config

# Disallow the system send TCP keepalive messages to the other side
[[ ! -z $(sed -n -r '/^#?TCPKeepAlive/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(TCPKeepAlive).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a TCPKeepAlive no' /etc/ssh/sshd_config

# Don't read the user's ~/.rhosts and ~/.shosts files
[[ ! -z $(sed -n -r '/^#?IgnoreRhosts/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(IgnoreRhosts).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a IgnoreRhosts yes' /etc/ssh/sshd_config

# Use Public Key Based Authentication
[[ ! -z $(sed -n -r '/^#?PubkeyAuthentication/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(PubkeyAuthentication).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a PubkeyAuthentication yes' /etc/ssh/sshd_config

# Just Allow Public Key Authentication Login
[[ ! -z $(sed -n -r '/^#?AuthenticationMethods/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(AuthenticationMethods).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a AuthenticationMethods publickey' /etc/ssh/sshd_config

# Disable Host-Based Authentication
[[ ! -z $(sed -n -r '/^#?HostbasedAuthentication/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(HostbasedAuthentication).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a HostbasedAuthentication no' /etc/ssh/sshd_config

# Disable root Login via SSH {yes,without-password,forced-commands-only,no}
[[ ! -z $(sed -n -r '/^#?PermitRootLogin/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(PermitRootLogin).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a PermitRootLogin no' /etc/ssh/sshd_config

# Disable Password Authentication
[[ ! -z $(sed -n -r '/^#?PasswordAuthentication/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(PasswordAuthentication).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a PasswordAuthentication no' /etc/ssh/sshd_config

# Disallow Empty Password Login
[[ ! -z $(sed -n -r '/^#?PermitEmptyPasswords/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(PermitEmptyPasswords).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a PermitEmptyPasswords no' /etc/ssh/sshd_config

# Enable a Warning Banner After Login, just change /etc/motd
# Enable a Warning Banner Before Login, default none
[[ ! -z $(sed -n -r '/^#?Banner/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(Banner).*@\1 /etc/ssh/[email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a Banner /etc/ssh/banner' /etc/ssh/sshd_config

sed -r -n '[email protected]_NAME="(.*)"@\[email protected]' /etc/os-release | sudo tee /etc/ssh/banner

# Enable Logging Message {QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, DEBUG3}
[[ ! -z $(sed -n -r '/^#?LogLevel/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(LogLevel).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a LogLevel VERBOSE' /etc/ssh/sshd_config

# Turn on privilege separation
[[ ! -z $(sed -n -r '/^#?UsePrivilegeSeparation/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(UsePrivilegeSeparation).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a UsePrivilegeSeparation sandbox' /etc/ssh/sshd_config

# Check file modes and ownership of the user's files and home directory before accepting login
[[ ! -z $(sed -n -r '/^#?StrictModes/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(StrictModes).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a StrictModes yes' /etc/ssh/sshd_config

# Ciphers Setting
[[ ! -z $(sed -n -r '/^#?Ciphers.*aes.*/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(Ciphers).*@\1 [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,[email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr' /etc/ssh/sshd_config

# Supported HostKey algorithms by order of preference
sudo sed -i -r '[email protected]^#?(HostKey /etc/ssh/ssh_host_dsa_key)[email protected]#\[email protected]' /etc/ssh/sshd_config
sudo sed -i -r '[email protected]^#?(HostKey /etc/ssh/ssh_host_rsa_key)[email protected]\[email protected]' /etc/ssh/sshd_config
sudo sed -i -r '[email protected]^#?(HostKey /etc/ssh/ssh_host_ecdsa_key)[email protected]\[email protected]' /etc/ssh/sshd_config
sudo sed -i -r '[email protected]^#?(HostKey /etc/ssh/ssh_host_ed25519_key)[email protected]\[email protected]' /etc/ssh/sshd_config

# Specifies the available KEX (Key Exchange) algorithms
sudo sed -i -r '/^#?KexAlgorithms/d;$a KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256' /etc/ssh/sshd_config

# Message authentication codes (MACs) Setting
sudo sed -i -r '/^#?MACs/d;$a MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]' /etc/ssh/sshd_config

#此處禁止TCP端口、X11轉發

# Disable TCP Port forwarding {yes,no,local,remote}
[[ ! -z $(sed -n -r '/^#?AllowTcpForwarding/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(AllowTcpForwarding).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a AllowTcpForwarding no' /etc/ssh/sshd_config

# Disable X11 forwarding
[[ ! -z $(sed -n -r '/^#?X11Forwarding/p' /etc/ssh/sshd_config) ]] && sudo sed -i -r '[email protected]^#?(X11Forwarding).*@\1 [email protected]' /etc/ssh/sshd_config || sudo sed -i -r '$a X11Forwarding no' /etc/ssh/sshd_config

1

man 5 ssh_config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

touch ~/.ssh/config
chmod 600 ~/.ssh/config

tee ~/.ssh/config <<-EOF
# Ensure KnownHosts are unreadable if leaked - it is otherwise easier to know which hosts your keys have access to.
HashKnownHosts yes

# Host keys the client accepts - order here is honored by OpenSSH
HostKeyAlgorithms [email protected],[email protected],ssh-ed25519,ssh-rsa,[email protected],[email protected],[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256

KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
EOF

1
2
3
4
5
6

#　RSA
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_$(date +%Y-%m-%d) -C "Comments"

#Ｄ25519
# This is only compatible with OpenSSH 6.5+ and fixed-size (256 bytes).
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_$(date +%Y-%m-%d) -C "Comments"

1

ssh-copy-id [-n] [-i [identity_file]] [-p port] [-o ssh_option] [[email protected]]hostname

1

ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 22 [email protected]

1
2
3

cat $HOME/.ssh/id_ed25519.pub | ssh -p 22 [email protected] '(umask 077; [[ -d ~/.ssh ]] || mkdir ~/.ssh; cat >> ~/.ssh/authorized_keys)'

cat $HOME/.ssh/id_rsa.pub | ssh -p 22 [email protected] '(umask 077; [[ -d ~/.ssh ]] || mkdir ~/.ssh; cat >> ~/.ssh/authorized_keys)'

1

ssh -p 22 [email protected]

1

ssh -p 22 [email protected] 'bash /tmp/test.sh'

1
2
3
4
5
6
7

cd /home/$nowUser/Documents/

# method 1
tar Jcf - node_hexo/ | ssh -p 22 [email protected] "cat > /tmp/hexo.tar.xz"

# method 2
tar Jcf - node_hexo/ | ssh -p 22 [email protected] "dd of=/tmp/hexo.tar.xz"

1
2
3
4
5

# method 1
ssh -p 22 [email protected] "cat /tmp/hexo.tar.xz" | tar Jxf - -C /tmp

# method 2
ssh -p 22 [email protected] "dd if=/tmp/hexo.tar.xz" | tar Jxf - -C /tmp

1

mysqldump -uroot -pXXX database_name | ssh [email protected] -pXXX mysql -utianyun -pXXX database_name

1

ssh node2 'cat /etc/corosync/corosync.conf' | diff - /etc/corosync/corosync.conf

1
2
3
4
5
6
7

[[email protected] ~]$ ssh node2 'cat /etc/corosync/corosync.conf' | diff - /etc/corosync/corosync.conf
Enter passphrase for key '/home/flying/.ssh/id_rsa':

#命令執行返回0，表示成功
[[email protected] ~]$ echo $?
0
[[email protected] ~]$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[[email protected] ~]$ ssh node2 'cat /etc/corosync/corosync.conf' | diff - /etc/corosync/corosync.conf
Enter passphrase for key '/home/flying/.ssh/id_rsa':
5c5
<     transport: udpu1
---
>     transport: udpu

#命令執行返回1，表示失敗
[[email protected] ~]$ echo $?
1
[[email protected] ~]$