带来一篇CentOS克制某些用户利用ssh近程登录

如果您觉得本篇CentOSLinux教程讲得好，请记得点击右边漂浮的分享程序，把好文章分享给你的小伙伴们！[root@localhost~]#vi/etc/pam.d/sshd


在第一行到场authrequiredpam_listfile.soitem=usersense=denyfile=/etc/sshdusersonerr=succeed，注重必定要在第一行，由于pam中实行按次是下面优先

authrequiredpam_listfile.soitem=usersense=denyfile=/etc/sshdusersonerr=succeed
#%PAM-1.0
authrequiredpam_sepermit.so
authincludepassword-auth
accountrequiredpam_nologin.so
accountincludepassword-auth
passwordincludepassword-auth
#pam_selinux.socloseshouldbethefirstsessionrule
sessionrequiredpam_selinux.soclose
sessionrequiredpam_loginuid.so
#pam_selinux.soopenshouldonlybefollowedbysessionstobeexecutedintheusercontext
sessionrequiredpam_selinux.soopenenv_params
sessionoptionalpam_keyinit.soforcerevoke
sessionincludepassword-auth


#检察此办事器下是甚么用户

[root@localhost~]#cd/home/
[root@localhosthome]#ls

将此用户的名字到场设置文件
git[root@localhosthome]#vi/etc/sshdusers
git
在文件中到场git#git是个当地用户

#重启sshd办事
[root@localhosthome]#servicesshdrestart
Stoppingsshd:[OK]
Startingsshd:[OK]

在另外一个终端测试

Lastlogin:WedSep414:45:192013from10.191.197.161
root@Git-Ubutntu:~#sshgit@202.205.161.48
Theauthenticityofhost202.205.161.48(202.205.161.48)cantbeestablished.
RSAkeyfingerprintis40:2a:10:80:c3:20:e6:ea:fe:4a:4d:cd:79:df:86:29.
Areyousureyouwanttocontinueconnecting(yes/no)?yes
Warning:Permanentlyadded202.205.161.48(RSA)tothelistofknownhosts.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied(publickey,gssapi-keyex,gssapi-with-mic,password).



也看到有人如许办理“在/etc/ssh/sshd_config里，设置DenyUsers”可是我编纂此文件时没有找到DenyUsers字段呢。。。以是没做成。。

测试了局为用户git没法举行近程SSH登录。。。


上面再试一下root的SSH近程登录是不是一般。。
root@Git-Ubutntu:~#sshroot@202.205.161.48
root@202.205.161.48spassword:
Lastlogin:WedSep415:00:452013from10.191.197.39
[root@localhost~]#ifconfig
eth0Linkencap:EthernetHWaddr00:15:5D:A1:58:09
inetaddr:202.205.161.48Bcast:202.205.161.255Mask:255.255.254.0
inet6addr:fe80::215:5dff:fea1:5809/64Scope:Link
UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1
RXpackets:11199428errors:0dropped:0overruns:0frame:0
TXpackets:191501errors:0dropped:0overruns:0carrier:0
collisions:0txqueuelen:1000
RXbytes:2603340038(2.4GiB)TXbytes:13760114(13.1MiB)

loLinkencap:LocalLoopback
inetaddr:127.0.0.1Mask:255.0.0.0
inet6addr:::1/128Scope:Host
UPLOOPBACKRUNNINGMTU:16436Metric:1
RXpackets:226errors:0dropped:0overruns:0frame:0
TXpackets:226errors:0dropped:0overruns:0carrier:0
collisions:0txqueuelen:0
RXbytes:29132(28.4KiB)TXbytes:29132(28.4KiB)

[root@localhost~]#

以上测试root用户已一般经由过程SSH近程登录！


################################################################################
上面测试禁用git用户SSH近程登录的情形下，git客户端利用SSH是不是还可用。

root@Git-Ubutntu:~#cd/home/git/
root@Git-Ubutntu:/home/git#ls
myworkplace
root@Git-Ubutntu:/home/git#cdmyworkplace/
root@Git-Ubutntu:/home/git/myworkplace#ls
git-test
root@Git-Ubutntu:/home/git/myworkplace#cdgit-test/
root@Git-Ubutntu:/home/git/myworkplace/git-test#ls
file.txt
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitlog
commitdfe7feafbe3f95f6217cb59eda3c117e7057e852
Author:user<user@qq.com>
Date:TueSep316:25:102013+0800

version1.1user.qq

commit7fdbd209fa4278d26ac544e6a3ed327129ad236e
Author:Jeffery<Jeffery@localhost.localdomain>
Date:WedSep400:18:502013+0800

version1.0(zhangwj)
root@Git-Ubutntu:/home/git/myworkplace/git-test#vifile.txt
version1.0(zhangwj);
version1.1(user.qq);
version1.2(user.qq);TesttheSshisOK?
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
"file.txt"3L,90Cwritten
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitaddfile.txt
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitcommit-a-m"testthessh
isok"

***Pleasetellmewhoyouare.

Run

gitconfig--globaluser.email"you@example.com"
gitconfig--globaluser.name"YourName"

tosetyouraccountsdefaultidentity.
Omit--globaltosettheidentityonlyinthisrepository.

fatal:unabletoauto-detectemailaddress(gotroot@Git-Ubutntu.(none))

#让我设置git的全局设置。。。设置用户名及邮箱

root@Git-Ubutntu:/home/git/myworkplace/git-test#gitconfig--globaluser.email
"user@qq.com"
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitconfig--globaluser.name"
user"
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitcommit-a-m"testthesshisok"
[master84386d7]testthesshisok
1filechanged,1insertion(+)
#以上，提交到当地代码堆栈一般。。

上面重点测试是不是能够推送到办事器上往。。

root@Git-Ubutntu:/home/git/myworkplace/git-test#gitpush
warning:push.defaultisunset;itsimplicitvalueischangingin
Git2.0frommatchingto***.Tosquelchthismessage
andmaintainthecurrentbehaviorafterthedefaultchanges,use:

gitconfig--globalpush.defaultmatching

Tosquelchthismessageandadoptthenewbehaviornow,use:

gitconfig--globalpush.default***

Seegithelpconfigandsearchforpush.defaultforfurtherinformation.
(the***modewasintroducedinGit1.7.11.Usethesimilarmode
currentinsteadof***ifyousometimesuseolderversionsofGit)

git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied(publickey,gssapi-keyex,gssapi-with-mic,password).
fatal:Couldnotreadfromremoterepository.

测试失利。。。。不克不及毗连近程代码堆栈。。。

登录/注册后可看大图

Pleasemakesureyouhavethecorrectaccessrights
andtherepositoryexists.


上面是提交乐成了，这是由于我在gitserver上作废了git用户的SSH登录限定。。
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitpush
warning:push.defaultisunset;itsimplicitvalueischangingin
Git2.0frommatchingto***.Tosquelchthismessage
andmaintainthecurrentbehaviorafterthedefaultchanges,use:

gitconfig--globalpush.defaultmatching

Tosquelchthismessageandadoptthenewbehaviornow,use:

gitconfig--globalpush.default***

Seegithelpconfigandsearchforpush.defaultforfurtherinformation.
(the***modewasintroducedinGit1.7.11.Usethesimilarmode
currentinsteadof***ifyousometimesuseolderversionsofGit)

git@202.205.161.48spassword:
Countingobjects:5,done.
Compressingobjects:100%(2/2),done.
Writingobjects:100%(3/3),297bytes,done.
Total3(delta0),reused0(delta0)
Togit@202.205.161.48:/home/git/git-test
dfe7fea..84386d7master->master


root@Git-Ubutntu:/home/git/myworkplace/git-test#gitlog
commit84386d7e6c4b4fc506efbd02e402fc993c15e011
Author:user<user@qq.com>
Date:WedSep415:16:162013+0800

testthesshisok

commitdfe7feafbe3f95f6217cb59eda3c117e7057e852
Author:user<user@qq.com>
Date:TueSep316:25:102013+0800

version1.1user.qq

commit7fdbd209fa4278d26ac544e6a3ed327129ad236e
Author:Jeffery<Jeffery@localhost.localdomain>
Date:WedSep400:18:502013+0800

version1.0(zhangwj)






结论。克制用户SSH近程登录后，git利用口令体例考证时，也将没法利用！！

下一步，测试利用公钥私钥体例举行git登录！
在第一行到场authrequiredpam_listfile.soitem=usersense=denyfile=/etc/sshdusersonerr=succeed，注重必定要在第一行，由于pam中实行按次是下面优先

authrequiredpam_listfile.soitem=usersense=denyfile=/etc/sshdusersonerr=succeed
#%PAM-1.0
authrequiredpam_sepermit.so
authincludepassword-auth
accountrequiredpam_nologin.so
accountincludepassword-auth
passwordincludepassword-auth
#pam_selinux.socloseshouldbethefirstsessionrule
sessionrequiredpam_selinux.soclose
sessionrequiredpam_loginuid.so
#pam_selinux.soopenshouldonlybefollowedbysessionstobeexecutedintheusercontext
sessionrequiredpam_selinux.soopenenv_params
sessionoptionalpam_keyinit.soforcerevoke
sessionincludepassword-auth


#检察此办事器下是甚么用户

[root@localhost~]#cd/home/
[root@localhosthome]#ls

将此用户的名字到场设置文件
git[root@localhosthome]#vi/etc/sshdusers
git
在文件中到场git#git是个当地用户

#重启sshd办事
[root@localhosthome]#servicesshdrestart
Stoppingsshd:[OK]
Startingsshd:[OK]

在另外一个终端测试

Lastlogin:WedSep414:45:192013from10.191.197.161
root@Git-Ubutntu:~#sshgit@202.205.161.48
Theauthenticityofhost202.205.161.48(202.205.161.48)cantbeestablished.
RSAkeyfingerprintis40:2a:10:80:c3:20:e6:ea:fe:4a:4d:cd:79:df:86:29.
Areyousureyouwanttocontinueconnecting(yes/no)?yes
Warning:Permanentlyadded202.205.161.48(RSA)tothelistofknownhosts.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied(publickey,gssapi-keyex,gssapi-with-mic,password).



也看到有人如许办理“在/etc/ssh/sshd_config里，设置DenyUsers”可是我编纂此文件时没有找到DenyUsers字段呢。。。以是没做成。。

测试了局为用户git没法举行近程SSH登录。。。


上面再试一下root的SSH近程登录是不是一般。。
root@Git-Ubutntu:~#sshroot@202.205.161.48
root@202.205.161.48spassword:
Lastlogin:WedSep415:00:452013from10.191.197.39
[root@localhost~]#ifconfig
eth0Linkencap:EthernetHWaddr00:15:5D:A1:58:09
inetaddr:202.205.161.48Bcast:202.205.161.255Mask:255.255.254.0
inet6addr:fe80::215:5dff:fea1:5809/64Scope:Link
UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1
RXpackets:11199428errors:0dropped:0overruns:0frame:0
TXpackets:191501errors:0dropped:0overruns:0carrier:0
collisions:0txqueuelen:1000
RXbytes:2603340038(2.4GiB)TXbytes:13760114(13.1MiB)

loLinkencap:LocalLoopback
inetaddr:127.0.0.1Mask:255.0.0.0
inet6addr:::1/128Scope:Host
UPLOOPBACKRUNNINGMTU:16436Metric:1
RXpackets:226errors:0dropped:0overruns:0frame:0
TXpackets:226errors:0dropped:0overruns:0carrier:0
collisions:0txqueuelen:0
RXbytes:29132(28.4KiB)TXbytes:29132(28.4KiB)

[root@localhost~]#

以上测试root用户已一般经由过程SSH近程登录！


################################################################################
上面测试禁用git用户SSH近程登录的情形下，git客户端利用SSH是不是还可用。

root@Git-Ubutntu:~#cd/home/git/
root@Git-Ubutntu:/home/git#ls
myworkplace
root@Git-Ubutntu:/home/git#cdmyworkplace/
root@Git-Ubutntu:/home/git/myworkplace#ls
git-test
root@Git-Ubutntu:/home/git/myworkplace#cdgit-test/
root@Git-Ubutntu:/home/git/myworkplace/git-test#ls
file.txt
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitlog
commitdfe7feafbe3f95f6217cb59eda3c117e7057e852
Author:user<user@qq.com>
Date:TueSep316:25:102013+0800

version1.1user.qq

commit7fdbd209fa4278d26ac544e6a3ed327129ad236e
Author:Jeffery<Jeffery@localhost.localdomain>
Date:WedSep400:18:502013+0800

version1.0(zhangwj)
root@Git-Ubutntu:/home/git/myworkplace/git-test#vifile.txt
version1.0(zhangwj);
version1.1(user.qq);
version1.2(user.qq);TesttheSshisOK?
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
"file.txt"3L,90Cwritten
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitaddfile.txt
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitcommit-a-m"testthessh
isok"

***Pleasetellmewhoyouare.

Run

gitconfig--globaluser.email"you@example.com"
gitconfig--globaluser.name"YourName"

tosetyouraccountsdefaultidentity.
Omit--globaltosettheidentityonlyinthisrepository.

fatal:unabletoauto-detectemailaddress(gotroot@Git-Ubutntu.(none))

#让我设置git的全局设置。。。设置用户名及邮箱

root@Git-Ubutntu:/home/git/myworkplace/git-test#gitconfig--globaluser.email
"user@qq.com"
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitconfig--globaluser.name"
user"
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitcommit-a-m"testthesshisok"
[master84386d7]testthesshisok
1filechanged,1insertion(+)
#以上，提交到当地代码堆栈一般。。

上面重点测试是不是能够推送到办事器上往。。

root@Git-Ubutntu:/home/git/myworkplace/git-test#gitpush
warning:push.defaultisunset;itsimplicitvalueischangingin
Git2.0frommatchingto***.Tosquelchthismessage
andmaintainthecurrentbehaviorafterthedefaultchanges,use:

gitconfig--globalpush.defaultmatching

Tosquelchthismessageandadoptthenewbehaviornow,use:

gitconfig--globalpush.default***

Seegithelpconfigandsearchforpush.defaultforfurtherinformation.
(the***modewasintroducedinGit1.7.11.Usethesimilarmode
currentinsteadof***ifyousometimesuseolderversionsofGit)

git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied,pleasetryagain.
git@202.205.161.48spassword:
Permissiondenied(publickey,gssapi-keyex,gssapi-with-mic,password).
fatal:Couldnotreadfromremoterepository.

测试失利。。。。不克不及毗连近程代码堆栈。。。


Pleasemakesureyouhavethecorrectaccessrights
andtherepositoryexists.


上面是提交乐成了，这是由于我在gitserver上作废了git用户的SSH登录限定。。
root@Git-Ubutntu:/home/git/myworkplace/git-test#gitpush
warning:push.defaultisunset;itsimplicitvalueischangingin
Git2.0frommatchingto***.Tosquelchthismessage
andmaintainthecurrentbehaviorafterthedefaultchanges,use:

gitconfig--globalpush.defaultmatching

Tosquelchthismessageandadoptthenewbehaviornow,use:

gitconfig--globalpush.default***

Seegithelpconfigandsearchforpush.defaultforfurtherinformation.
(the***modewasintroducedinGit1.7.11.Usethesimilarmode
currentinsteadof***ifyousometimesuseolderversionsofGit)

git@202.205.161.48spassword:
Countingobjects:5,done.
Compressingobjects:100%(2/2),done.
Writingobjects:100%(3/3),297bytes,done.
Total3(delta0),reused0(delta0)
Togit@202.205.161.48:/home/git/git-test
dfe7fea..84386d7master->master


root@Git-Ubutntu:/home/git/myworkplace/git-test#gitlog
commit84386d7e6c4b4fc506efbd02e402fc993c15e011
Author:user<user@qq.com>
Date:WedSep415:16:162013+0800

testthesshisok

commitdfe7feafbe3f95f6217cb59eda3c117e7057e852
Author:user<user@qq.com>
Date:TueSep316:25:102013+0800

version1.1user.qq

commit7fdbd209fa4278d26ac544e6a3ed327129ad236e
Author:Jeffery<Jeffery@localhost.localdomain>
Date:WedSep400:18:502013+0800

version1.0(zhangwj)






结论。克制用户SSH近程登录后，git利用口令体例考证时，也将没法利用！！

下一步，测试利用公钥私钥体例举行git登录！如果您觉得本篇CentOSLinux教程讲得好，请记得点击右边漂浮的分享程序，把好文章分享给你的好朋友们！

我是学习嵌入式方向的，这学期就选修了这门专业任选课。

老实说，第一个程序是在C中编译好的，调试好了才在Linux下运行，感觉用vi比较麻烦，因为有错了不能调试，只是提示错误。

对Linux命令熟悉后，你可以开始搭建一个小的Linux网络，这是最好的实践方法。Linux是网络的代名词，Linux网络服务功能非常强大，不论是邮件服务器、Web服务器、DNS服务器等都非常完善。

熟悉并掌握安装Linux，安装是学习的前提。目前较常见的安装方法有二种：

以前觉得Linux就跟dos一样，全是用命令窗口，相对于窗口界面来说多麻烦呀。

写学习日记，这是学习历程的见证，同时我坚持认为是增强学习信念的法宝。

有疑问前，知识学习前，先用搜索。

我感觉linux的学习,学习编程~!~!就去学习C语言编程!!