FreeBSD之ssh服务配置（学习记录）

FreeBSD之SSH服务
工作就怕闲着，看着时间慢慢的走动，什么时候才能下班！正好想起来前一段时间下载的FreeBSD的光盘镜像还躺在我的分区，反正无事，刻录成盘，找台破机器安装上（丢人的事，以前安装过，但心思没有全用上，一直没有安装明白，现在安装上了也是小白一个。），一边看着官网的手册，一边操作着旁边的机器。这脑袋转来转去这个累啊，不过对脖子有好处哦。想起来在安装的时候配置SSH的服务器，但一起连接错误。正好找找资料把服务配置完成。

FreeBSD下面配置SSH服务，共要修改三个文件，
1.inetd.conf 2.rc.conf  3.sshd_config
这三个文件目录分别为：
1：inetd.conf  /etc/inetd.confi
2:   rc.conf  /etc/rc.conf
3:   sshd_config /etc/ssh
修改文件配置：1.  vi  /etc/inetd.conf

xxr# cat /etc/inetd.conf |grep ssh
#ssh     stream  tcp     nowait  root    /usr/sbin/sshd          sshd -i -4
#ssh    stream  tcp6    nowait  root    /usr/sbin/sshd          sshd -i -6
把第一条前面的#删除掉

xxr# cat /etc/inetd.conf |grep ssh
ssh     stream  tcp     nowait  root    /usr/sbin/sshd          sshd -i -4
#ssh    stream  tcp6    nowait  root    /usr/sbin/sshd          sshd -i -6
保存退出
2：修改rc.d文件
在文件最后，添加上：sshd_enable="yes" 保存退出
3.启动服务查看SSH 22商品是否在监听状态下
启动服务
/etc/rc.d/sshd start
查看商品
xxr# netstat -na | grep 22
tcp4       0     52 192.168.1.250.22       192.168.1.88.18134     ESTABLISHED
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN
4.修改sshd_config文件
#       $OpenBSD: sshd_config,v 1.81 2009/10/08 14:03:41 markus Exp $
#       $FreeBSD: src/crypto/openssh/sshd_config,v 1.49.2.2.2.1 2010/06/14 02:09:06 kensmith Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#VersionAddendum FreeBSD-20100308

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# The default requires explicit activation of protocol 1
#Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# Change to yes to enable built-in password authentication.
PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable PAM authentication
#ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'no' to disable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem       sftp    /usr/libexec/sftp-server
添加如下内容：
ignorerhosts yes
ignoreuserknownhosts yes
printmotd yes
strictmodes no
RSAAuthentication yes
permitRootlogin yes
PermitEmptypasswords no
passwordauthentication yes

保存退出。重新启动SSH服务
/etc/rc.d/sshd restart
完成。