在前一章节中，使用了ssh-keygen来演示如何使用金钥交换的方式进行验证，在本章节中，将会讲解该如何设定SSH相关的设定。
SSH server之相关设定都放在/etc/ssh/sshd_config中，里面设定有很多，其中有几个比较重要的是：设定是否可以以密码验证、是否允许使用root使用者进行SSH远端登入等，透过上述的这些设定，可以让SSH之远端连线更加的稳定与安全，这边举出一个例子来增强SSH server远端连线的安全性，相关的范例如下：
PermitRootLogin no，这个时候则不允许使用root使用者进行远端登入。PubkeyAuthentication yes与PasswordAuthentication no。Port 2222。其中，2222是要设定给SSH server连线的时候以哪个port number进行连线。AuthorizedKeysFile .ssh/authorized_keys。其中，.ssh/authorized_keys档案为相对路径的档案，会依照指定的远端使用者，在其家目录建立.ssh/authorized_keys这个档案。reload-or-restart之动作，相关的指令执行结果输出如下：[rockylinux@workstation ~]$ sudo systemctl reload-or-restart sshd
[rockylinux@workstation ~]$
Fail2ban是一种网路入侵系统检测的套件，可以保护SSH server避免暴力密码验证破解之攻击，相关的安装方式如下：
首先先确认，firewalld服务是不是已经正在运行了，这个服务与防火墙有关，有关防火墙部分在後面的章节中有更进一步的介绍，这边只需要确认服务是不是已经是正在运行的状态了，相关执行指令的输出讯息如下：
[rockylinux@workstation ~]$ sudo systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2021-10-02 22:39:40 CST; 1h 43min ago
Docs: man:firewalld(1)
Main PID: 919 (firewalld)
Tasks: 2 (limit: 11262)
Memory: 30.8M
CGroup: /system.slice/firewalld.service
└─919 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
Oct 02 22:39:38 workstation systemd[1]: Starting firewalld - dynamic firewall daemon...
Oct 02 22:39:40 workstation systemd[1]: Started firewalld - dynamic firewall daemon.
Oct 02 22:39:41 workstation firewalld[919]: WARNING: AllowZoneDrifting is enabled. This is considered an in>
[rockylinux@workstation ~]$
确认firewalld服务已经在背景执行之後，使用「sudo firewall-cmd --list-all」指令来确认是否已经完成
[rockylinux@workstation ~]$ sudo firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[rockylinux@workstation ~]$
接着，使用「sudo yum install -y epel-release」将此套件安装起来，因为Fail2ban不在官方预先收录的套件里面，因此需要使用此指令将此套件给安装起来，相关指令执行後输出的讯息如下：
[rockylinux@workstation ~]$ sudo yum install -y epel-release
Last metadata expiration check: 1:24:29 ago on Sat 02 Oct 2021 11:18:33 PM CST.
Dependencies resolved.
============================================================================================================
Package Architecture Version Repository Size
============================================================================================================
Installing:
epel-release noarch 8-13.el8 extras 23 k
Transaction Summary
============================================================================================================
Install 1 Package
Total download size: 23 k
Installed size: 35 k
Downloading Packages:
epel-release-8-13.el8.noarch.rpm 516 kB/s | 23 kB 00:00
------------------------------------------------------------------------------------------------------------
Total 33 kB/s | 23 kB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : epel-release-8-13.el8.noarch 1/1
Running scriptlet: epel-release-8-13.el8.noarch 1/1
Verifying : epel-release-8-13.el8.noarch 1/1
Installed products updated.
Installed:
epel-release-8-13.el8.noarch
Complete!
[rockylinux@workstation ~]$
此套件安装完之後，接着使用「sudo yum install -y fail2ban fail2ban-firewalld」指令进行安装，将Fail2ban与设定防火墙相关的套件都安装好，相关执行指令所输出的讯息如下：
[rockylinux@workstation ~]$ sudo yum install -y fail2ban fail2ban-firewalld
Last metadata expiration check: 1:25:30 ago on Sat 02 Oct 2021 11:18:43 PM CST.
Dependencies resolved.
============================================================================================================
Package Architecture Version Repository Size
============================================================================================================
Installing:
fail2ban noarch 0.11.2-1.el8 epel 19 k
fail2ban-firewalld noarch 0.11.2-1.el8 epel 19 k
Installing dependencies:
esmtp x86_64 1.2-15.el8 epel 57 k
fail2ban-sendmail noarch 0.11.2-1.el8 epel 22 k
fail2ban-server noarch 0.11.2-1.el8 epel 459 k
libesmtp x86_64 1.0.6-18.el8 epel 70 k
liblockfile x86_64 1.14-1.el8 appstream 31 k
Transaction Summary
============================================================================================================
Install 7 Packages
Total download size: 676 k
Installed size: 1.7 M
Downloading Packages:
(1/7): liblockfile-1.14-1.el8.x86_64.rpm 375 kB/s | 31 kB 00:00
(2/7): fail2ban-0.11.2-1.el8.noarch.rpm 37 kB/s | 19 kB 00:00
(3/7): fail2ban-firewalld-0.11.2-1.el8.noarch.rpm 41 kB/s | 19 kB 00:00
(4/7): fail2ban-sendmail-0.11.2-1.el8.noarch.rpm 166 kB/s | 22 kB 00:00
(5/7): esmtp-1.2-15.el8.x86_64.rpm 82 kB/s | 57 kB 00:00
(6/7): libesmtp-1.0.6-18.el8.x86_64.rpm 500 kB/s | 70 kB 00:00
(7/7): fail2ban-server-0.11.2-1.el8.noarch.rpm 1.3 MB/s | 459 kB 00:00
------------------------------------------------------------------------------------------------------------
Total 225 kB/s | 676 kB 00:03
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : fail2ban-server-0.11.2-1.el8.noarch 1/7
Running scriptlet: fail2ban-server-0.11.2-1.el8.noarch 1/7
Installing : fail2ban-firewalld-0.11.2-1.el8.noarch 2/7
Installing : libesmtp-1.0.6-18.el8.x86_64 3/7
Installing : liblockfile-1.14-1.el8.x86_64 4/7
Running scriptlet: liblockfile-1.14-1.el8.x86_64 4/7
Installing : esmtp-1.2-15.el8.x86_64 5/7
Running scriptlet: esmtp-1.2-15.el8.x86_64 5/7
Installing : fail2ban-sendmail-0.11.2-1.el8.noarch 6/7
Installing : fail2ban-0.11.2-1.el8.noarch 7/7
Running scriptlet: fail2ban-0.11.2-1.el8.noarch 7/7
Verifying : liblockfile-1.14-1.el8.x86_64 1/7
Verifying : esmtp-1.2-15.el8.x86_64 2/7
Verifying : fail2ban-0.11.2-1.el8.noarch 3/7
Verifying : fail2ban-firewalld-0.11.2-1.el8.noarch 4/7
Verifying : fail2ban-sendmail-0.11.2-1.el8.noarch 5/7
Verifying : fail2ban-server-0.11.2-1.el8.noarch 6/7
Verifying : libesmtp-1.0.6-18.el8.x86_64 7/7
Installed products updated.
Installed:
esmtp-1.2-15.el8.x86_64 fail2ban-0.11.2-1.el8.noarch
fail2ban-firewalld-0.11.2-1.el8.noarch fail2ban-sendmail-0.11.2-1.el8.noarch
fail2ban-server-0.11.2-1.el8.noarch libesmtp-1.0.6-18.el8.x86_64
liblockfile-1.14-1.el8.x86_64
Complete!
[rockylinux@workstation ~]$
接着将这两个套件安装完成之後，可以使用「systemctl」之指令查看fail2ban的服务状态，相关执行指令的输出讯息如下：
[rockylinux@workstation ~]$ sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; disabled; vendor preset: disabled)
Active: inactive (dead)
Docs: man:fail2ban(1)
当套件当套件安装好之後，预设fail2ban不会是启动的状态，因此可以使用「start」之动作将此服务进行启动，并使用「enable」将fail2ban服务进行启用，让其在开机的时候会自动启动，相关执行指令的方式如下：
[rockylinux@workstation ~]$ sudo systemctl start fail2ban
[rockylinux@workstation ~]$ sudo systemctl enable fail2ban
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /usr/lib/systemd/system/fail2ban.service.
[rockylinux@workstation ~]$ sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2021-10-03 00:49:47 CST; 7s ago
Docs: man:fail2ban(1)
Main PID: 4476 (fail2ban-server)
Tasks: 3 (limit: 11262)
Memory: 12.9M
CGroup: /system.slice/fail2ban.service
└─4476 /usr/bin/python3.6 -s /usr/bin/fail2ban-server -xf start
Oct 03 00:49:47 workstation systemd[1]: Starting Fail2Ban Service...
Oct 03 00:49:47 workstation systemd[1]: Started Fail2Ban Service.
Oct 03 00:49:47 workstation fail2ban-server[4476]: Server ready
[rockylinux@workstation ~]$
接着，就可以开始设定fail2ban之服务了，可以先将fail2ban预设的设定档案复制一份，相关的指令执行後输出的结果如下：
[rockylinux@workstation ~]$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
[rockylinux@workstation ~]$
cp这个指令是可以用来复制档案的，相关的介绍在更後面的章节会有更进一步的说明，接着使用「vim」指令进行/etc/fail2ban/jail.local之档案编辑，相关指令执行所输出的讯息如下：
[rockylinux@workstation ~]$ sudo vim /etc/fail2ban/jail.local
[rockylinux@workstation ~]$
可以看到第41行开始，是有关於预设的设定，即：[DEFAULT]，确定里面的几个设定值按照下列的方式设定：
bantime = 1h
findtime = 1h
maxretry = 5
上述分别所代表的设定意思是：
Fail2ban预设是使用iptables进行网路防火墙的设定，为了要让Fail2ban能够使用Firewalld，因此需要执行下列的指令：
[rockylinux@workstation ~]$ sudo mv /etc/fail2ban/jail.d/00-firewalld.conf /etc/fail2ban/jail.d/00-firewalld.local
执行完上述的指令之後，接着可以重启Fail2ban服务来完成相关的设定了，相关的执行指令所输出的讯息如下：
[rockylinux@workstation ~]$ sudo systemctl restart fail2ban
[rockylinux@workstation ~]$
接下来，设定Fail2ban来保护SSHD服务，可以使用「vim」指令来做到，相关执行指令的方式如下：
sudo vim /etc/fail2ban/jail.d/sshd.local
并将下列的设定内容储存到上述的档案中：
[sshd]
enabled = true
# Override the default global configuration
# for specific jail sshd
bantime = 1d
maxretry = 3
接着，再使用sudo systemctl restart fail2ban来重新启动Fail2ban服务，重新启动完成之後，接着可以使用fail2ban-client指令并搭配status动作来查看目前运行Fail2ban之状态，相关执行指令输出的讯息如下：
[rockylinux@workstation ~]$ sudo fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: sshd
[rockylinux@workstation ~]$
从上述的执行指令所输出的讯息可以得知，Fail2ban目前已经将SSHD服务进行保护了，接着可以使用fail2ban-client指令来确认对SSHD所设定的方式与里面相关的设定值，相关执行指令的方式如下：
[rockylinux@workstation ~]$ sudo fail2ban-client get sshd maxretry
3
[rockylinux@workstation ~]$
接着，可以测试一下SSH连线保护有没有成功的设定，测试相关所使用的指令以及其输出的讯息如下：
PS C:\Users\peter> ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
PS C:\Users\peter> ssh [email protected]
ssh: connect to host 192.168.0.21 port 22: Connection timed out
PS C:\Users\peter>
从上述的指令来看，尝试三次之後，便被锁住了，这时候再一次使用sudo fail2ban-client status sshd指令，则可以看到下列的输出讯息：
[rockylinux@workstation ~]$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 4
| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: 192.168.0.9
[rockylinux@workstation ~]$
从上述的输出讯息可以得知，登入失败有几次，以及总共已经失败登入了几次，还有目前动作是将超过失败次数的IP位址给Ban掉，意思就是禁止使用此IP位址进行远端的连线，若要把此IP位址重新恢复允许远端SSH连线的话，则可以使用``，相关执行指令的输出讯息如下：
[rockylinux@workstation ~]$ sudo fail2ban-client unban 192.168.0.9
1
[rockylinux@workstation ~]$
[rockylinux@workstation ~]$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 4
| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
|- Currently banned: 0
|- Total banned: 1
`- Banned IP list:
[rockylinux@workstation ~]$
这时候，就将此IP位址解除禁止访问的限制了，可以看到下列输出的指令讯息便可以验证此禁止访问的限制已经解除：
PS C:\Users\peter> ssh [email protected]
ssh: connect to host 192.168.0.21 port 22: Connection timed out
PS C:\Users\peter> ssh [email protected]
[email protected]'s password:
<<: 框架在手，工作我有：MockK的简介？真的只是简介⋯⋯
前言： 在昨天的内容中我们大致介绍了什麽是SQL以及一些Mysql的用法，那今天的目标就是要来把资...
那些曾经很红 现在也不曾被遗忘的 Bands 从小就蛮讨厌补习的 不懂为什麽学校教的东西 下课还要...
到底该为一路顺畅没出Bug高兴还是遇到难题花时间克服狂喜，都几 第三天终於该来建立专案了，我是使用I...
#12. Drawing App 这次要挑战的是比小画家还阳春的绘图app，会利用到canvas a...
Know all about types of research papers in Austral...