CentOS7:SSH公開鍵認証設定のやり方
CentOS7でSSH公開鍵認証を設定し、より安全に通信を行う方法をまとめています。
SSH公開鍵認証を設定するだけでセキュリティが大きく向上すると思いますね(・ω・)ノ
サーバー構築後、必ず行いたい設定の一つです。
目次
CentOS7でSSH 公開鍵認証接続の設定を行う
tera termで鍵のペアを作成
windows環境のため、tera termを利用して鍵認証のペアを作成
「設定(S)」メニューより「SSH鍵生成(N)」を選択し、鍵生成画面を表示
鍵の種類「RSA」にチェックし、「生成」を選択
「公開鍵の保存」と「秘密鍵の保存」を行う
今回は、テスト環境作成のため、秘密鍵を「空のパスフレーズ」のまま作成
実際の運用の際は、セキュリティ上設定を行う必要がある
公開鍵の設定
サーバーに公開鍵を設置
公開鍵保管場所を作成
mkdir /home/user/.ssh
chmod 700 /home/user/.ssh
chown -R user:user /home/user/.ssh作成した「id_rsa.pub」をtera term上にドラッグ&ドロップし、SCPで公開鍵の設置
SCP「∼⁄」と入力して「SCP」を選択
転送した「id_rsa.pub」をリネームして移動
mv ~/id_rsa.pub /home/user/.ssh/authorized_keys
chmod 600 /home/user/.ssh/authorized_keys
chown -R user:user /home/user/.ssh/authorized_keysSSHの設定
SSHに関する接続の設定を変更する
configファイルのバックアップ
cp -pi /etc/ssh/sshd_config{,.`date "+%Y%m%d_%H%M%S"`}configファイルの変更
vi /etc/ssh/sshd_config #Port 22
>> Port 2202 # portを変更したい場合のみ(ここでは2202を設定した)
#PermitRootLogin yes
>> PermitRootLogin no # rootのSSHアクセス不可
#以下、末尾に追記
>> Protocol 2 # SSHのプロトコルをSSH2のみ対応とするfirewallの設定
SSHの接続portを変更した場合、firewallの設定を変更する
configファイルのバックアップ
cp /usr/lib/firewalld/services/ssh.xml{,.`date "+%Y%m%d_%H%M%S"`}configファイルの変更
vi /usr/lib/firewalld/services/ssh.xml <port protcol="tcp" port="22" />
>> <port protcol="tcp" port="2202" /> # 変更したport
firewall-cmd --reloadSELinuxの設定
SSHの接続portを変更した場合、SELinuxの設定を変更する
設定変更
yum -y install policycoreutils-python
semanage port -a -t ssh_port_t -p tcp 2202 # 変更したport
semanage port -l | grep ssh # 変更したportsshサービスの再起動
systemctl restart sshd別ターミナルより公開鍵を利用して SSH 接続確認
設定が完了したら、tera termにて公開鍵認証での接続を確認する
tera termを起動し、「ホスト」、「TCPポート」を入力し、「OK」を選択
セキュリティ警告画面が出たら、「続行」を選択
「ユーザー」を入力し、「秘密鍵」に作成した「id_rsa」を選択後、「OK」を選択
接続が成功すれば完了
SSH パスワード接続を無効化
公開鍵認証にしたため、パスワードでの接続を無効化する
設定を間違えた場合を考慮して最後にこの設定を記載しているが、
sshd_configの変更の際に設定しても問題ない
configファイルの変更
vi /etc/ssh/sshd_config PasswordAuthentication yes
>> PasswordAuthentication no # パスワード接続無効sshサービスの再起動
systemctl restart sshdその他の記事
作成日：2017/06/25
更新日：2018/08/16
プロフィール
admin
123456'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('e',2)='e
admin
123456'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('r',0)='r
admin
123456/**/and/**/2=DBMS_PIPE.RECEIVE_MESSAGE('h',2)
admin
123456/**/and/**/3=DBMS_PIPE.RECEIVE_MESSAGE('i',0)
admin
123456'and(select+1)>0waitfor/**/delay'0:0:2
admin
123456'and(select+1)>0waitfor/**/delay'0:0:0
admin
123456/**/and(select+1)>0waitfor/**/delay'0:0:2'/**/
admin
123456/**/and(select+1)>0waitfor/**/delay'0:0:0'/**/
admin
123456'/**/and(select'1'from/**/pg_sleep(2))::text>'0
admin
123456'/**/and(select'1'from/**/pg_sleep(0))::text>'0
admin
123456/**/and(select+1/**/from/**/pg_sleep(2))>0/**/
admin
123456/**/and(select+1/**/from/**/pg_sleep(0))>0/**/
admin
123456"and(select*from(select+sleep(2))a/**/union/**/select+1)="
admin
123456"and(select*from(select+sleep(0))a/**/union/**/select+1)="
admin
123456'and(select*from(select+sleep(2))a/**/union/**/select+1)='
admin
123456'and(select*from(select+sleep(0))a/**/union/**/select+1)='
admin
(select*from(select+sleep(2)union/**/select+1)a)
admin
(select*from(select+sleep(0)union/**/select+1)a)
admin
123456"and"u"="g
admin
123456"and"s"="s
admin
123456'and's'='o
admin
123456'and'f'='f
admin
123456/**/and+1=5
admin
123456/**/and+0=0
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin'"\(
123456
admin
123456
admin鎈'"\(
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456'"\(
admin
123456
admin
123456鎈'"\(
admin
123456
admin
123456'and/**/convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1156701009')))>'0
admin
123456
admin
convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1618848530')))
admin
123456
admin
123456/**/and/**/cast(md5('1074912999')as/**/int)>0
admin
123456
admin
123456'and(select'1'from/**/cast(md5(1386663467)as/**/int))>'0
admin
123456
admin
extractvalue(1,concat(char(126),md5(1188932177)))
<%- 993567348+867188748 %>
123456
admin
123456
admin
123456"and/**/extractvalue(1,concat(char(126),md5(1686843831)))and"
admin
123456
admin
123456'and/**/extractvalue(1,concat(char(126),md5(1707609667)))and'
${(816971460+887290574)?c}
123456
admin
123456
admin
123456
${854996944+882843812}
123456
admin
123456
/*1*/{{805389748+828827100}}
123456
admin
123456
admin
123456
admin
<%- 982089225+876810945 %>
admin
123456
admin
123456
admin
#set($c=923583271+971739006)${c}$c
admin
123456
admin
expr 809402544 + 918517540
admin
123456
admin
123456
admin
${(831004223+910890248)?c}
admin
123456&set /A 914529719+917754603
admin
123456
admin
123456
admin
123456$(expr 979334878 + 994579230)
admin
${914059541+928308712}
admin
123456
admin
123456
admin
123456|expr 901874782 + 810835924
admin
/*1*/{{984547370+955402429}}
admin
123456
admin
123456
admin
123456
expr 929060172 + 962122111
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
'-var_dump(md5(410842803))-'
admin
123456
admin
${913811045+945753518}
admin
123456
admin
123456
admin
${@var_dump(md5(738590098))};
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
${952661279+998251258}
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin"and"a"="d
123456
admin
123456
admin
123456
expr 800092450 + 823982500
123456
admin"and"o"="o
123456
admin
123456
admin
123456
admin'and'v'='p
123456
admin
123456
'-var_dump(md5(935558836))-'
123456
admin'and'h'='h
123456
admin
123456
${@var_dump(md5(895787871))};
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('s',2)='s
admin
123456'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('p',0)='p
admin
123456/**/and/**/2=DBMS_PIPE.RECEIVE_MESSAGE('w',2)
admin
123456/**/and/**/1=DBMS_PIPE.RECEIVE_MESSAGE('x',0)
admin
123456'and(select+1)>0waitfor/**/delay'0:0:2
admin
123456'and(select+1)>0waitfor/**/delay'0:0:0
admin
123456/**/and(select+1)>0waitfor/**/delay'0:0:2'/**/
admin
123456/**/and(select+1)>0waitfor/**/delay'0:0:0'/**/
admin
123456'/**/and(select'1'from/**/pg_sleep(2))::text>'0
admin
123456'/**/and(select'1'from/**/pg_sleep(0))::text>'0
admin
123456/**/and(select+1/**/from/**/pg_sleep(2))>0/**/
admin
123456/**/and(select+1/**/from/**/pg_sleep(0))>0/**/
admin
123456"and(select*from(select+sleep(2))a/**/union/**/select+1)="
admin
123456"and(select*from(select+sleep(0))a/**/union/**/select+1)="
admin
123456'and(select*from(select+sleep(2))a/**/union/**/select+1)='
admin
123456'and(select*from(select+sleep(0))a/**/union/**/select+1)='
admin
(select*from(select+sleep(2)union/**/select+1)a)
admin
(select*from(select+sleep(0)union/**/select+1)a)
admin
123456"and"b"="d
admin
123456"and"m"="m
admin
123456'and'y'='u
admin
123456'and'm'='m
admin
123456/**/and+3=8
admin
123456/**/and+4=4
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin'"\(
123456
admin
<%- 827282133+908389867 %>
admin
123456
admin鎈'"\(
123456
admin
#set($c=982215956+968976025)${c}$c
admin
123456
admin
${(818690423+960798914)?c}
admin
123456
admin
${861252797+822260998}
admin
123456
admin
/*1*/{{820062604+971146479}}
admin
123456
admin
123456
admin
123456
admin
expr 861746773 + 965805023
admin
123456
admin
123456
admin
123456&set /A 873547187+893337333
admin
123456
admin
123456
admin
123456$(expr 960579869 + 924762007)
admin
123456
admin
123456
admin
123456'"\(
admin
123456|expr 919188297 + 937881327
admin
123456
admin
123456鎈'"\(
admin
123456
expr 912119793 + 961024554
admin
123456
admin
123456'and/**/convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1929101476')))>'0
admin
123456
admin
123456
admin
convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1831052698')))
admin
123456
admin
123456
admin
123456/**/and/**/cast(md5('1627961763')as/**/int)>0
admin
123456
admin
123456
admin
123456'and(select'1'from/**/cast(md5(1188414113)as/**/int))>'0
admin
123456
admin
123456
admin
extractvalue(1,concat(char(126),md5(1989446482)))
admin
123456
admin
123456
admin
123456"and/**/extractvalue(1,concat(char(126),md5(1972155281)))and"
admin
123456
admin
123456
admin
123456'and/**/extractvalue(1,concat(char(126),md5(1001211094)))and'
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
123456
admin
'-var_dump(md5(529912880))-'
admin
123456
admin
123456
<%- 867720202+981048592 %>
123456
${948041485+940510036}
123456
admin
123456
admin
${@var_dump(md5(174904249))};
admin
123456
admin
123456
admin
${966916880+975815210}
admin
123456
admin
123456
admin
123456
admin
123456
${(913758559+817157031)?c}
123456
admin"and"s"="s
123456
admin
123456
admin
123456
admin
123456
${925762269+961206000}
123456
admin"and"m"="m
123456
admin
123456
admin
123456
admin
123456
/*1*/{{921502858+996680226}}
123456
admin'and't'='e
123456
admin
123456
admin
123456
admin
123456
admin'and'g'='g
123456
admin
123456
admin
123456
expr 807610021 + 833362617
123456
admin
123456
admin
123456
admin
123456
admin
123456
'-var_dump(md5(744391363))-'
123456
admin
123456
admin
123456
${@var_dump(md5(305499509))};
123456
admin
123456
admin
123456