Boa noite,
Estou com umas idéias de coisas que planejo “desenvolver” para navegar de maneira mais segura. Como precisarei do SSH, acesso a portas das máquinas virtuais e coisas assim estou fazendo posts relacionados a estes assuntos já que precisarei dos mesmos para “desenvolver” tal segurança. E assim, o futuro post não ficará tão extenso.
Para você instalar o ssh-server no Ubuntu é muito simples:
$ sudo apt-get install openssh-server
Após isso você deve fazer algumas modificações para ficar mais seguro. Acesse o arquivo /etc/ssh/sshd_config
$ sudo vi /etc/ssh/sshd_config
AllowUsers USUARIO #habilita somente este usuario
AllowGroups GRUPO_DO_USUARIO # habilita somente este grupo
PasswordAuthentication yes
MaxStartups 2:100:2
Port XXX # Alguma porta aleatoria de sua vontade que não esteja em uso.
O que o MaxStartups faz? Especifica o número máximo de conexões não autenticadas ao servidor. Sua sintaxe é a seguinte inicio:porcentagem:maximo. Vamos supor, inicio = 10, porcentagem = 50, maximo = 20. Quando for atingidas 10 conexões ele irá iniciar com a porcentagem, ou seja, uma conexão terá chance de ser fechada de cara ou não, a mesma aumenta linearmente até o número máximo de conexões, e apartir dessa todas são negadas. Eu particularmente pensei um pouco e decidi adotar o inicio com 2, porcentagem com 100 e máximo como 2 então qualquer nova conexão apartir de 2 será automaticamente recusada. (Isso pode ser um problema caso existam pessoas tentando invadir seu servidor e provavelmente estarão utilizando todas as sessões). Talvez o recomendavel seja mais correto 10:30:60 porém prefiro deixar o meu mais restrito.
/etc/init.d/ssh
Você ainda pode adicionar o seguinte código ao /home/usuario/.profile:
echo Digite sua senha de segurança:
read senha
if [ $senha == “SUA_SENHA” ]
then
# CÓDIGOS QUE JÁ ESTÃO NO PROFILE!
else
exit
fi
Não se esqueça de bloquear acesso do root
Na minha máquina também desabilitei o comando “su” da seguinte maneira:
$ chmod 700 /usr/bin/su-to-root
Grato,
Matheus
Referencias:
Desabilitar Comando SU
Informação MaxStartups
Duas dicas que não são relacionadas com segurança, você pode descomentar a linha
Banner /etc/arquivo # Default /etc/issue.net
A mensagem que está dentro do /etc/arquivo irá ser exibida quando se conectar no SSH.
Para editar a mensagem que apareça assim que o usuario se loga você deve editar o /etc/motd.
I like to spend my free time by scaning various internet recourses. Today I came across your site and I found it is as one of the best free resources available! Well done! Keep on this quality!
Assume you are doing good linking to position you on the first pages of search engines.
Greate pieces. Keep writing such kind of information on your site. Im really impressed by your blog.
I think this is among the so much vital info for me. And i’m happy reading your article. But wanna remark on few common issues, The site style is wonderful, the articles is really excellent : D. Just right job, cheers
Most often since i look for a blog Document realize that the vast majority of blog pages happen to be amateurish. Not so,We can honestly claim for which you writen is definitely great and then your webpage rock solid.
This is without a doubt one of the greatest articles I’ve read on this topic! The author’s comprehensive knowledge and zeal for the subject are apparent in every paragraph. I’m so appreciative for finding this piece as it has enhanced my comprehension and ignited my curiosity even further. Thank you, author, for taking the time to craft such a phenomenal article!
Cześć! Mamy ogromną przyjemność powitać Cię na oficjalnej, całkowicie legalnej witrynie Vavada Net PL Casino, stworzonej specjalnie z myślą o polskich graczach! Nasze kasyno znajduje się pod adresem Szwoleżerów 1, 00-467 Warszawa, Polska. Numer telefonu: +48505490512. Możesz je odwiedzać przez całą dobę, 7 dni w tygodniu, i bez żadnych problemów grać na złoty w takie klasyczne gry jak Tetri Mania czy Lucky 81 od 1 grosza!
I was recommended this website by way of my cousin. I am not certain whether or not this publish is written via him as nobody else recognise such designated approximately my problem. You’re wonderful! Thank you!
I believe this web site has some really wonderful info for everyone : D.
Substantially, the post is really the best on this laudable topic. I concur with your conclusions and will eagerly watch forward to your future updates.Just saying thanx will not just be enough, for the wonderful lucidity in your writing.
Greate pieces. Keep writing such kind of info on your site. Im really impressed by your blog.
Just wanna admit that this is extremely helpful, Thanks for taking your time to write this.
Hey there, You have done a great job. I’ll certainly digg it and in my opinion recommend to my friends. I’m confident they’ll be benefited from this site.
Can I simply say what a relief to uncover someone that truly knows what they’re discussing on the web. You definitely realize how to bring a problem to light and make it important. More and more people ought to check this out and understand this side of your story. I was surprised that you are not more popular since you surely have the gift.
Hello, I think your blog might be having browser compatibility issues. When I look at your website in Chrome, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other than that, awesome blog!
I do not even know how I ended up here, but I thought this post was good. I do not know who you are but definitely you are going to a famous blogger if you aren’t already 😉 Cheers!
Your resources are well developed.
If most people wrote about this subject with the eloquence that you just did, I’m sure people would do much more than just read, they act. Great stuff here. Please keep it up.
These stories are so important.
What i discover troublesome is to find a weblog that may capture me for a minute however your blog is different. Bravo.
A cool post there mate ! Thank you for posting.
I’d like to be able to write like this, but taking the time and developing articles is hard…. Takes a lot of effort.
Right now it seems like Expression Engine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
I was suggested this website by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my difficulty. You are wonderful! Thanks!
Right now it sounds like Movable Type is the top blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?