通过配置hosts.allow和hosts.deny文件实现ssh白名单

 

reference：

centos 安全配置应用之hosts.allow和hosts.deny

https://blog.csdn.net/yangjiehuan/article/details/9253855

通过配置hosts.allow和hosts.deny文件允许或禁止ssh或telnet操作

https://www.cnblogs.com/lsdb/p/7095288.html

http://witmax.cn/linux-ip-black-list.html

说明：

1.一个IP请求连入，linux的检查策略是先看/etc/hosts.allow中是否允许，如果允许直接放行；如果没有，则再看/etc/hosts.deny中是否禁止，如果禁止那么就禁止连入。

2.实验发现对/etc/hosts.allow和/etc/hosts.deny的配置不用重启就立即生效，但不管重启不重启当前已有会话都不会受影响；也就是说对之前已经连入的，即便IP已配置为禁止登录会话仍不会强制断开。不过不知是否所有linux都一样，由此第四步标为可选。

实践：

操作环境：

Distributor ID: CentOS
Description:    CentOS Linux release 7.7.1908 (Core)
Release:        7.7.1908

[root@localhost etc]# cat hosts.allow
#
# hosts.allow   This file contains access rules which are used to
#               allow or deny connections to network services that
#               either use the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#

sshd:10.1.100.*:allow
sshd:10.2.150.*:allow
sshd:10.3.200.*:allow
sshd:10.4.230.*:allow
sshd:10.5.240.*:allow
[root@localhost etc]#
[root@localhost etc]#
[root@localhost etc]#
[root@localhost etc]# cat hosts.deny
#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a 'deny' option instead.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#
sshd:all