server 基本安全 证书登录

1. 创建非 root 用户

# ubuntu
adduser user1
# 将用户加入 root 组
usermod -a  -G sudo user1

# centos
adduser user1
# 设置密码
passwd user1
# 添加到 wheel 用户组
usermod -a -G wheel user1

2. ssh 秘钥对认证

# 本地执行
ssh-keygen # 将会生成 ~/.ssh/id_rsa.pub (公钥) 和 ~/.ssh/id_rsa (私钥)

# 将公钥复制到服务器
scp -P port ~/.ssh/id_rsa.pub user@server-ip:~ 

# ssh 登录服务器
mkdir ~/.ssh
touch ~/.ssh/authorized_keys

# 将公钥添加到 authorized_keys
cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
# 修改目录权限
chown -R user1:user1 ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

3. 禁止密码, root 用户登录

# 登录服务器
 vim /etc/ssh/sshd_config
# 查找 
PasswordAuthentication no
PermitRootLogin no
# 重启 ssh 服务
# ubuntu
sudo service ssh restart
# centos
sudo systemctl restart ssh.service

# centos 7
systemctl restart sshd

4. 禁止 ping

vim /etc/sysctl.conf
net.ipv4.icmp_echo_ignore_all = 0
sysctl -p