46 lines
1.0 KiB
Bash
46 lines
1.0 KiB
Bash
#!/bin/bash
|
||
## SSH 2016-07-22
|
||
## http://www.aqzt.com
|
||
##email: ppabc@qq.com
|
||
##robert yu
|
||
##centos 7
|
||
|
||
|
||
##SSH配置优化
|
||
cat >/etc/ssh/sshd_config<<EOF
|
||
Port 22
|
||
AddressFamily inet
|
||
ListenAddress 0.0.0.0
|
||
Protocol 2
|
||
HostKey /etc/ssh/ssh_host_rsa_key
|
||
HostKey /etc/ssh/ssh_host_ecdsa_key
|
||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||
SyslogFacility AUTHPRIV
|
||
PermitRootLogin yes
|
||
MaxAuthTries 6
|
||
RSAAuthentication yes
|
||
PubkeyAuthentication yes
|
||
AuthorizedKeysFile .ssh/authorized_keys
|
||
PasswordAuthentication yes
|
||
ChallengeResponseAuthentication no
|
||
UsePAM yes
|
||
UseDNS no
|
||
X11Forwarding yes
|
||
UsePrivilegeSeparation sandbox
|
||
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
||
AcceptEnv XMODIFIERS
|
||
Subsystem sftp /usr/libexec/openssh/sftp-server
|
||
EOF
|
||
|
||
cat /etc/ssh/sshd_config
|
||
|
||
|
||
##SSH禁止IPv6,只要ipv4
|
||
AddressFamily inet
|
||
ListenAddress 0.0.0.0
|
||
|
||
##不建议启用这两个配置，会导致SSH慢
|
||
#GSSAPIAuthentication yes
|
||
#GSSAPICleanupCredentials yes |