{"id":2846,"date":"2017-10-30T21:20:50","date_gmt":"2017-10-30T13:20:50","guid":{"rendered":"http:\/\/cn.hostease.com\/xueyuan\/?p=2846"},"modified":"2024-11-15T14:53:02","modified_gmt":"2024-11-15T06:53:02","slug":"%e4%bf%ae%e6%94%b9-centos-7-ssh-%e7%ab%af%e5%8f%a3-2","status":"publish","type":"post","link":"https:\/\/cn.hostease.com\/xueyuan\/hemanual\/%e4%bf%ae%e6%94%b9-centos-7-ssh-%e7%ab%af%e5%8f%a3-2\/","title":{"rendered":"\u4fee\u6539 CentOS 7 SSH \u7aef\u53e3"},"content":{"rendered":"

\u4fee\u6539 sshd_config \u7aef\u53e3<\/b><\/strong><\/h1>\n

$\u00a0vi\u00a0\/etc\/ssh\/sshd_config<\/p>\n

\u53d6\u6d88\u00a0#Port 22\u00a0\u7684\u6ce8\u91ca\uff0c\u5728\u4e0b\u4e00\u884c\u6dfb\u52a0\u4f60\u9700\u8981\u4fee\u6539\u7684\u65b0\u7aef\u53e3\u00a0Port 2048\u3002\uff08\u8fd9\u91cc\u4e0d\u5220\u9664 22 \u7aef\u53e3\u662f\u4e3a\u4e86\u9632\u6b62\u4fee\u6539\u540e\u65b0\u7aef\u53e3\u65e0\u6cd5\u8bbf\u95ee\uff0c\u9020\u6210\u65e0\u6cd5\u7528 ssh \u8fde\u63a5\u670d\u52a1\u5668\u3002\uff09<\/p>\n

Port\u00a022<\/p>\n

Port\u00a02048<\/p>\n

\u4fee\u6539\u4fdd\u5b58 sshd_config \u6587\u4ef6\u540e\u91cd\u542f sshd \u670d\u52a1\uff1a<\/p>\n

$\u00a0\u00a0systemctl\u00a0restart\u00a0sshd<\/p>\n

\u9000\u51fa ssh \u4f1a\u8bdd\u540e\uff0c\u518d\u7528\u65b0\u7684\u7aef\u53e3\u8fde\u63a5\uff1a<\/p>\n

$\u00a0ssh\u00a0-p\u00a02048\u00a0root@example.com<\/p>\n

ssh:\u00a0connect\u00a0to\u00a0host\u00a00.0.0.0\u00a0port\u00a02048:\u00a0Connection\u00a0refused<\/p>\n

\u597d\u5427\uff0cnative \u4e86\u2026\u2026\u5bf9\u4e8e CentOS 7 \u8fd9\u4e00\u5957\u4fee\u6539\u7aef\u53e3\u7684\u65b9\u6cd5\u5df2\u7ecf\u4e0d\u80fd\u751f\u6548\u4e86\u3002<\/p>\n

\u00a0<\/b><\/strong><\/h1>\n

\u6253\u5f00\u00a0SELinux\u00a0\u7aef\u53e3<\/b><\/strong><\/h1>\n

SELinux \u5168\u79f0 Security Enhanced Linux (\u5b89\u5168\u5f3a\u5316 Linux)\uff0c\u662f MAC (Mandatory Access Control\uff0c\u5f3a\u5236\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf)\u7684\u4e00\u4e2a\u5b9e\u73b0\uff0c\u76ee\u7684\u5728\u4e8e\u660e\u786e\u7684\u6307\u660e\u67d0\u4e2a\u8fdb\u7a0b\u53ef\u4ee5\u8bbf\u95ee\u54ea\u4e9b\u8d44\u6e90(\u6587\u4ef6\u3001\u7f51\u7edc\u7aef\u53e3\u7b49)\u3002<\/i><\/em><\/p>\n

\u5bf9\u4e8e ssh\uff0cSELinux \u9ed8\u8ba4\u53ea\u5141\u8bb8 22 \u7aef\u53e3\uff0c\u6211\u4eec\u53ef\u4ee5\u7528 SELinux \u7ba1\u7406\u914d\u7f6e\u5de5\u5177 semanage\uff0c\u6765\u4fee\u6539 ssh \u53ef\u8bbf\u95ee\u7684\u7aef\u53e3\u3002<\/p>\n

\u5b89\u88c5 semanage \u5de5\u5177<\/b><\/strong><\/h6>\n

$\u00a0yum\u00a0provides\u00a0semanage<\/p>\n

$\u00a0yum\u00a0-y\u00a0install\u00a0policycoreutils-python<\/p>\n

\u4e3a ssh \u6253\u5f00 2048 \u7aef\u53e3<\/b><\/strong><\/h6>\n

#\u00a0\u4e3a\u00a0ssh\u00a0\u6dfb\u52a0\u65b0\u7684\u5141\u8bb8\u7aef\u53e3$\u00a0semanage\u00a0port\u00a0-a\u00a0-t\u00a0ssh_port_t\u00a0-p\u00a0tcp\u00a02048#\u00a0\u67e5\u770b\u5f53\u524d\u00a0SELinux\u00a0\u5141\u8bb8\u7684\u7aef\u53e3$\u00a0semanage\u00a0port\u00a0-l\u00a0|\u00a0grep\u00a0sshssh_port_t\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02048,\u00a022<\/p>\n

\u9519\u8bef\u5904\u7406<\/b><\/strong><\/h6>\n

\u5f53 SELINUX \u914d\u7f6e\u4e3a\u7981\u7528\u72b6\u6001\u65f6\uff0c\u4f7f\u7528 semanage \u4f1a\u62a5\u9519\u63d0\u793a\u65e0\u6cd5\u8bfb\u53d6 policy \u6587\u4ef6\uff1a<\/p>\n

SELinux:\u00a0\u00a0Could\u00a0not\u00a0downgrade\u00a0policy\u00a0file\u00a0\/etc\/selinux\/targeted\/policy\/policy.30,\u00a0searching\u00a0for\u00a0an\u00a0older\u00a0version.<\/p>\n

SELinux:\u00a0\u00a0Could\u00a0not\u00a0open\u00a0policy\u00a0file\u00a0<=\u00a0\/etc\/selinux\/targeted\/policy\/policy.30:\u00a0\u00a0No\u00a0such\u00a0file\u00a0or\u00a0directory<\/p>\n

\/sbin\/load_policy:\u00a0\u00a0Can’t\u00a0load\u00a0policy:\u00a0\u00a0No\u00a0such\u00a0file\u00a0or\u00a0directory<\/p>\n

libsemanage.semanage_reload_policy:\u00a0load_policy\u00a0returned\u00a0error\u00a0code\u00a02.\u00a0(No\u00a0such\u00a0file\u00a0or\u00a0directory).<\/p>\n

FileNotFoundError:\u00a0[Errno\u00a02]\u00a0No\u00a0such\u00a0file\u00a0or\u00a0directory<\/p>\n

\u4fee\u6539\u00a0\/etc\/selinux\/config\u00a0\u914d\u7f6e\uff0c\u542f\u7528 SELinux\uff1a<\/p>\n

 <\/p>\n

$\u00a0vi\u00a0\/etc\/selinux\/config<\/p>\n

SELINUX=permissive<\/p>\n

#\u00a0\u91cd\u542f\u670d\u52a1\u5668$\u00a0init\u00a06#\u00a0\u91cd\u542f\u540e\u67e5\u770b\u00a0SELinux\u00a0\u72b6\u6001$\u00a0sestatus#\u00a0if\u00a0it\u00a0shows\u00a0disable,\u00a0you\u00a0can\u00a0run$\u00a0load_policy\u00a0-qi<\/p>\n

\u68c0\u67e5\u914d\u7f6e\uff1a<\/b><\/strong><\/h6>\n

$\u00a0semanage\u00a0port\u00a0-a\u00a0-t\u00a0ssh_port_t\u00a0-p\u00a0tcp\u00a02048<\/p>\n

$\u00a0semanage\u00a0port\u00a0-l\u00a0|\u00a0grep\u00a0sshssh_port_t\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02048,\u00a022<\/p>\n

#\u00a0\u91cd\u542f\u00a0ssh\u00a0\u670d\u52a1systemctl\u00a0restart\u00a0sshd<\/p>\n

\u6ce8\uff1asemange \u4e0d\u80fd\u7981\u7528 ssh \u7684 22 \u7aef\u53e3\uff1a<\/i><\/em><\/p>\n

$\u00a0semanage\u00a0port\u00a0-d\u00a0-t\u00a0ssh_port_t\u00a0-p\u00a0tcp\u00a022<\/p>\n

ValueError:\u00a0\u5728\u7b56\u7565\u4e2d\u5b9a\u4e49\u4e86\u7aef\u53e3\u00a0tcp\/22\uff0c\u65e0\u6cd5\u5220\u9664\u3002<\/p>\n

\u914d\u7f6e\u9632\u706b\u5899 firewalld<\/b><\/strong><\/h1>\n
\u542f\u7528\u9632\u706b\u5899 && \u67e5\u770b\u9632\u706b\u5899\u72b6\u6001\uff1a<\/b><\/strong><\/h6>\n

$\u00a0systemctl\u00a0enable\u00a0firewalld<\/p>\n

$\u00a0systemctl\u00a0start\u00a0firewalld<\/p>\n

$\u00a0systemctl\u00a0status\u00a0firewalld<\/p>\n