OpenSSH optimization
1, do not use the default port
2, prohibit the use of protocol version 1
3, users can log limit
man sshd_config
AllowUsers user1 user2 user3 // specified user whitelist
AllowGroups // possible to specify a list of white group
DenyGroups // set blacklist
DenyUsers // user blacklist
vim /etc/ssh/sshd_conf AllowUsers root test
/etc/init.d/sshd reload
4, the session timeout length is set Idle
5, use a firewall -iptables set of access policies ssh
6, monitor only specific IP addresses
7, when password-based authentication, to use a strong password policy
Randomly generated password strings:
tr -dc A-Za-z0-9 < /dev/urandom | head -c 30 | xargs
8, using a password-based authentication
9, prohibit the use of blank password
10, prohibits the root user directly landing
11, limiting ssh access to the frequency and the number of concurrent
12. Well logs, regular analysis