通过配置hosts.allow和hosts.deny文件允许或禁止ssh或telnet操作

示例:

[root@paph3 ~]# cat /etc/hosts.allow
#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See ‘man 5 hosts_options’ and ‘man 5 hosts_access’
# for information on rule syntax.
# See ‘man tcpd’ for information on tcp_wrappers
sshd:192.168.3.80

[root@paph3 ~]# cat /etc/hosts.deny
#
# hosts.deny This file contains access rules which are used to
# deny connections to network services that either use
# the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# The rules in this file can also be set up in
# /etc/hosts.allow with a ‘deny’ option instead.
#
# See ‘man 5 hosts_options’ and ‘man 5 hosts_access’
# for information on rule syntax.
# See ‘man tcpd’ for information on tcp_wrappers
#
ALL:ALL@ALL, PARANOID

1、登录主机,如果是普通账户先切换至root账号

su root

 

2编缉/etc/hosts.allow文件

vi /etc/hosts.allow
允许内容 书写格式(改成自自需要的IP或IP段)
ssh允许单个ip sshd:192.168.220.1
ssh允许ip段 sshd:192.168.220.
telnet允许单个ip in.telnetd:192.168.220.1
telnet允许ip段 in.telnetd:192.168.221.

以ssh允许192.168.220.1和telnet允许192.168.220网段为例,具体在/etc/hosts.allow加入内容如下:

 

 

3、编辑/etc/hosts.deny文件

vi /etc/hosts.deny

在文件中加入:

sshd:ALL
in.telnetd:ALL

具体在/etc/hosts.deny加入内容如下:

 

4、保存文件退出编缉后,重启ssh服务telnet服务可选

service sshd  restart
service  xinetd  restart

 

说明:

1.一个IP请求连入,linux的检查策略是先看/etc/hosts.allow中是否允许,如果允许直接放行;如果没有,则再看/etc/hosts.deny中是否禁止,如果禁止那么就禁止连入。

2.实验发现对/etc/hosts.allow和/etc/hosts.deny的配置不用重启就立即生效,但不管重启不重启当前已有会话都不会受影响;也就是说对之前已经连入的,即便IP已配置为禁止登录会话仍不会强制断开。不过不知是否所有linux都一样,由此第四步标为可选。

3.网上发现有些教程写成不是sshd而是in.sshd不是in.telnetd而是telnetd的,个人觉得应该是独立启的不用加in.托管于xinetd的需要加in.

发表评论

电子邮件地址不会被公开。 必填项已用*标注