Shulou(Shulou.com)06/01 Report--

Method 1:

Add an ip or network segment that allows ssh to log in to / etc/hosts.allow

Sshd:192.168.1.2:allow or

Sshd:192.168.1.0/24:allow

Add IP that does not allow ssh to log in to / etc/hosts.deny

Sshd:ALL # ALL indicates that except for those allowed above, all other ip refused to log in to ssh

Method 2:

Use iptables.

Iptables-An INPUT-p tcp-s 192.168.1.2-- destination-port 22-j ACCEPT

Iptables-An INPUT-p tcp-- destination-port 22-j DROP

Method 3:

Modify ssh configuration file

Vi / etc/ssh/sshd_config

Add a line:

Allowusers xxx@192.168.1.2

Note: xxx is the user name you use to log in to the server.

* * *

Hide and camouflage port banner http://kangyang.blog.51cto.com/471772/580853

* * *

Net session / delete / y

* * *

There are several representations of the Linux server:

1. High latency from external ping

two。 High latency from internal ping gateways

3. High memory and CPU footprint

4. Many requests with status of SYN_RECV are found through netstat, and the refresh is slow.

Ways to resist *:

1. Set firewall rules

1.iptables-A FORWARD-p tcp-- syn-m limit-- limit 1max s-j ACCEPT

2.iptables-A FORWARD-p tcp--tcp-flags SYN,ACK,FIN,RST RST-m limit-- limit 1max s-j ACCEPT

3.iptables-A FORWARD-p icmp--icmp-type echo-request-m limit-- limit 1max s-j ACCEPT

two。 Seal ip and ip segments

1.iptables-I INPUT-s 49.116.15.23-j DROP # seal a single ip

2.iptables-I INPUT-s 49.116.15.23 2.iptables 32-j DROP # has the same effect as the previous one, sealing a single IP

3.iptables-I INPUT-s 49.116.15.0 DROP 24-j DROP # Seal ip, specify the first three paragraphs

4.iptables-I INPUT-s 49.116.0.0According to 16-j DROP # seal ip paragraph, specify only the first two paragraphs

5.iptables-I INPUT-s 49.0.0.0According to 8-j DROP # ip paragraph, only the first paragraph is specified

Here is a question: how to know which ip to seal?

The answer is the netstat command.

When you view the current request through netstat, most of the frequent ip with a status of SYN_RECV is malicious.

The two methods should be combined to achieve significant results. This is my experience in maintaining high-concurrency and high-traffic voting websites.

* *

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.