s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

Lab 20.1RHCSA 10, Hoofdstuk 20

Harden the SSH server

Niveau
Gemiddeld
35 min
Machines
server1, server2
Status
Nog niet begonnen

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Doel

Lock down sshd on server2: no root login, another port, only one group, idle timeout and keys — without locking yourself out.

Voordat je begint

  • Keep one root session open on server2 (console or SSH) during the whole lab.
  • You need the user student on both servers.

Taken

  1. On server2, put all your sshd settings in /etc/ssh/sshd_config.d/10-lab.conf.
  2. root may not log in over SSH.
  3. sshd listens on port 2022 only. Make SELinux and the firewall accept it.
  4. Only members of the group sshusers may log in. Add student to it.
  5. Idle sessions are closed after about 10 minutes without an answer from the client.
  6. On server1, create a key with a passphrase for student, copy it to server2, and log in with the help of ssh-agent.
  7. Turn off password logins on server2 and test that the key login still works.

Controleer je werk

sshd -T | grep -E '^(port|permitrootlogin|allowgroups|clientalive|passwordauthentication)'
semanage port -l | grep ssh_port_t
firewall-cmd --list-ports
ssh -p 2022 student@server2 hostname
ssh -p 2022 root@server2
  • sshd -T shows port 2022, permitrootlogin no, allowgroups sshusers, passwordauthentication no.
  • student logs in with the key; root is refused.

Hints

Toon de hints

Oplossing

Toon de oplossing
  1. The drop-in file (tasks 1–5) on server2.
    /etc/ssh/sshd_config.d/10-lab.conf
    Port 2022
PermitRootLogin no
AllowGroups sshusers
ClientAliveInterval 300
ClientAliveCountMax 2
  2. Group, SELinux, firewall, restart.
    groupadd sshusers; usermod -aG sshusers student
semanage port -a -t ssh_port_t -p tcp 2022
firewall-cmd --add-port=2022/tcp --permanent; firewall-cmd --reload
sshd -t && systemctl restart sshd
  3. Key with passphrase on server1 (as student).
    ssh-keygen -t ed25519
ssh-copy-id -p 2022 student@server2
eval "$(ssh-agent)"; ssh-add
ssh -p 2022 student@server2 hostname
  4. No passwords anymore (on server2).
    echo "PasswordAuthentication no" >> /etc/ssh/sshd_config.d/10-lab.conf
sshd -t && systemctl reload sshd

Mijn notities

Nog geen notities.

Lessen voor dit lab

Commando's in dit lab