SSH - kalit bilan kirish va qattiqlashtirish

SSH - serverga yagona eshik. Uni to'g'ri sozlash serverni himoya qilishning eng katta bitta qadami: parol bilan kirishni o'chirib, kalitga o'tish hujumlarning aksariyatini foydasiz qiladi.

Parol nima uchun yetarli emas #

Kalit juftligi qanday ishlaydi #

Kalit yaratish #

mkdir -p ish
ssh-keygen -t ed25519 -f ish/kalit -N "" -C "husanboy@ish-stoli" >/dev/null
ssh-keygen -t rsa -b 4096 -f ish/eski_kalit -N "" -C "eski@usul" >/dev/null

Haqiqiy buyruq - bu:

ssh-keygen -t ed25519 -C "husanboy@ish-stoli"

Ikkita fayl paydo bo'ladi:

cd ish && stat -c "%a %n" kalit kalit.pub

600 kalit
644 kalit.pub

Kalit turlari #

cd ish
awk '{print $1, length($2)}' kalit.pub
awk '{print $1, length($2)}' eski_kalit.pub

ssh-ed25519 68
ssh-rsa 716

Ed25519 kaliti o'n barobar qisqa, lekin kuchi bo'yicha RSA-4096 dan qolishmaydi.

cd ish && ssh-keygen -lf kalit.pub | awk '{print $1, $4}'

256 (ED25519)

Ochiq kalitni serverga qo'yish #

Eng oson usul:

ssh-copy-id -i ~/.ssh/kalit.pub husanboy@203.0.113.10

U aslida shunchaki ~/.ssh/authorized_keys fayliga bitta satr qo'shadi va ruxsatlarni to'g'rilaydi:

cd ish
mkdir -p uy/.ssh
cat kalit.pub >> uy/.ssh/authorized_keys
chmod 700 uy/.ssh
chmod 600 uy/.ssh/authorized_keys
stat -c "%a %n" uy/.ssh uy/.ssh/authorized_keys
wc -l < uy/.ssh/authorized_keys

700 uy/.ssh
600 uy/.ssh/authorized_keys
1

ssh -vvv husanboy@203.0.113.10

~/.ssh/config - eslab qolmaslik uchun #

Har ulanishda uzun buyruq yozish o'rniga:

cd ish
cat > ssh_config <<'EOF'
Host veb
    HostName 203.0.113.10
    User husanboy
    Port 2222
    IdentityFile ~/.ssh/kalit
    IdentitiesOnly yes
EOF
ssh -F ssh_config -G veb 2>/dev/null | grep -E '^(user|hostname|port|identityfile|identitiesonly) ' | sort

hostname 203.0.113.10
identitiesonly yes
identityfile ~/.ssh/kalit
port 2222
user husanboy

Endi ssh veb yozish kifoya.

Foydali config sozlamalari:

Server tomonini qattiqlashtirish #

mkdir -p /run/sshd
mkdir -p konf
cat > konf/sshd_config <<'EOF'
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
MaxAuthTries 3
AllowUsers husanboy
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

Sozlamani saqlashdan oldin tekshiring:

sshd -t -f konf/sshd_config && echo "sintaksis to'g'ri"

sintaksis to'g'ri

Xato qiymat qanday ushlanadi:

printf 'PermitRootLogin xato_qiymat\n' > konf/yomon.conf
sshd -t -f konf/yomon.conf 2>&1

konf/yomon.conf line 1: unsupported option "xato_qiymat".

Yakuniy sozlamani ko'rish:

sshd -T -f konf/sshd_config | grep -E '^(port|permitrootlogin|passwordauthentication|pubkeyauthentication|permitemptypasswords|maxauthtries|allowusers|x11forwarding) ' | sort

allowusers husanboy
maxauthtries 3
passwordauthentication no
permitemptypasswords no
permitrootlogin no
port 2222
pubkeyauthentication yes
x11forwarding no

Portni o'zgartirish - foydasi va chegarasi #

known_hosts - serverning shaxsiyati #

Birinchi ulanishda tasdiqlangan barmoq izi ~/.ssh/known_hosts ga yoziladi. Keyingi safar SSH uni jimgina solishtiradi.

cd ish
printf '%s
' "203.0.113.10 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAe" > kh
ssh-keygen -F 203.0.113.10 -f kh >/dev/null && echo "yozuv topildi"

yozuv topildi

cd ish
printf '%s
' "203.0.113.10 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAe" > kh
ssh-keygen -H -f kh 2>/dev/null
head -c 3 kh; echo

kh updated.
Original contents retained as kh.old
|1|

ssh-keygen -H eski faylni kh.old sifatida saqlab qo'yadi - uni o'chirishni unutmang, aks holda xeshlashning ma'nosi qolmaydi.

|1| bilan boshlangan satr - xeshlangan host nomi. Shunda known_hosts faylini qo'lga kiritgan hujumchi siz qaysi serverlarga ulanishingizni bilmaydi.

Ubuntu bu sozlamani standart holda yoqib qo'yadi (HashKnownHosts yes).

Yopiq kalitdan ochiq kalitni tiklash #

.pub faylni yo'qotib qo'ysangiz, uni qayta yaratish mumkin - yopiq kalitning ichida ochiq kalit ham bor.

cd ish
ssh-keygen -y -f kalit > tiklangan.pub
cut -d' ' -f1,2 kalit.pub > a; cut -d' ' -f1,2 tiklangan.pub > b
diff a b && echo "ochiq kalit aynan bir xil"

ochiq kalit aynan bir xil

Kalitni bekor qilish #

cd ish
mkdir -p uy2/.ssh
cat kalit.pub eski_kalit.pub > uy2/.ssh/authorized_keys
wc -l < uy2/.ssh/authorized_keys
grep -v "eski@usul" uy2/.ssh/authorized_keys > uy2/.ssh/yangi
mv uy2/.ssh/yangi uy2/.ssh/authorized_keys
wc -l < uy2/.ssh/authorized_keys
grep -c "husanboy@ish-stoli" uy2/.ssh/authorized_keys

2
1
1

Kalitni bekor qilish - authorized_keys dan o'sha satrni o'chirish. Boshqa markaziy ro'yxat yo'q.

Xulosa #

• Parol uzatiladi, kalit - yo'q; shuning uchun kalit kuchliroq.
• ed25519 - bugungi standart tanlov; dsa va 2048-bit RSA - yo'q.
• Serverga faqat .pub fayl boradi.
• ~/.ssh = 700, authorized_keys = 600, egasi - foydalanuvchining o'zi.
• Ruxsat noto'g'ri bo'lsa, sshd kalitni jimgina rad etadi.
• ~/.ssh/config + IdentitiesOnly yes - kalitlar chalkashmaydi.
• ssh -G mijoz sozlamasini, sshd -T server sozlamasini ko'rsatadi.
• Sozlamani doim sshd -t bilan tekshiring, keyin reload qiling.
• PasswordAuthentication no dan oldin ikkinchi sessiya ochiq tursin.
• known_hosts ogohlantirishini sababini bilmasdan o'chirmang.
• Ochiq kalitni yopiq kalitdan tiklash mumkin, teskarisi - yo'q.
• Kalitni bekor qilish - authorized_keys dan satrni o'chirish.

Keyingi bo'limda paket boshqaruvini ko'ramiz: apt, dpkg, xavfsizlik yangilanishlari va ombor manbalari.