معمل 20.1: Harden the SSH server

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

الهدف

Lock down sshd on server2: no root login, another port, only one group, idle timeout and keys — without locking yourself out.

قبل أن تبدأ

Keep one root session open on server2 (console or SSH) during the whole lab.
You need the user student on both servers.

المهام

On server2, put all your sshd settings in /etc/ssh/sshd_config.d/10-lab.conf.
root may not log in over SSH.
sshd listens on port 2022 only. Make SELinux and the firewall accept it.
Only members of the group sshusers may log in. Add student to it.
Idle sessions are closed after about 10 minutes without an answer from the client.
On server1, create a key with a passphrase for student, copy it to server2, and log in with the help of ssh-agent.
Turn off password logins on server2 and test that the key login still works.

تحقّق من عملك

#sshd -T | grep -E '^(port|permitrootlogin|allowgroups|clientalive|passwordauthentication)'
#semanage port -l | grep ssh_port_t
#firewall-cmd --list-ports
$ssh -p 2022 student@server2 hostname
$ssh -p 2022 root@server2

sshd -T shows port 2022, permitrootlogin no, allowgroups sshusers, passwordauthentication no.
student logs in with the key; root is refused.

تلميحات

اعرض التلميحات

First value wins: drop-in files beat the main file.
semanage port -a -t ssh_port_t -p tcp 2022, firewall-cmd --add-port=2022/tcp --permanent.
ClientAliveInterval 300 + ClientAliveCountMax 2.
ssh-copy-id -p 2022, eval "$(ssh-agent)", ssh-add.

الحل

اعرض الحل

The drop-in file (tasks 1–5) on server2.

/etc/ssh/sshd_config.d/10-lab.conf

Port 2022
PermitRootLogin no
AllowGroups sshusers
ClientAliveInterval 300
ClientAliveCountMax 2

Group, SELinux, firewall, restart.

#groupadd sshusers; usermod -aG sshusers student
#semanage port -a -t ssh_port_t -p tcp 2022
#firewall-cmd --add-port=2022/tcp --permanent; firewall-cmd --reload
#sshd -t && systemctl restart sshd

Key with passphrase on server1 (as student).

$ssh-keygen -t ed25519
$ssh-copy-id -p 2022 student@server2
$eval "$(ssh-agent)"; ssh-add
$ssh -p 2022 student@server2 hostname

No passwords anymore (on server2).

#echo "PasswordAuthentication no" >> /etc/ssh/sshd_config.d/10-lab.conf
#sshd -t && systemctl reload sshd

Harden the SSH server

الهدف

قبل أن تبدأ

المهام

تحقّق من عملك

تلميحات

الحل

ملاحظاتي

دروس هذا المعمل

الأوامر في هذا المعمل