Linux服务器安全配置：SSH加固与入侵检测

# === 基础安全 ===
# 使用SSH协议v2
Protocol 2

# 更改默认端口
Port 58222

# 禁用root登录
PermitRootLogin no

# 禁用密码认证
PasswordAuthentication no
ChallengeResponseAuthentication no

# 启用公钥认证
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# === 访问控制 ===
# 仅允许特定用户
AllowUsers admin deployer
# 或按组限制
# AllowGroups ssh-users

# 最大认证尝试次数
MaxAuthTries 3

# 最大并发未认证连接
MaxStartups 10:30:60

# === 会话安全 ===
# 客户端活动检测
ClientAliveInterval 300
ClientAliveCountMax 2

# 登录超时
LoginGraceTime 60

# 禁用X11转发
X11Forwarding no

# 禁用Agent转发
AllowAgentForwarding no

# 禁用TCP转发（除非需要SSH隧道）
AllowTcpForwarding no

# === 加密算法 ===
KexAlgorithms curve25519-sha256,[email protected]
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256

# 生成Ed25519密钥（推荐）
ssh-keygen -t ed25519 -C "admin@server" -f ~/.ssh/id_ed25519

# 如需RSA密钥，至少4096位
ssh-keygen -t rsa -b 4096 -C "admin@server"

# 设置正确的权限
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

# 安装AIDE
sudo apt install aide -y

# 初始化数据库
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# 运行检查
sudo aide --check

# 设置每日检查的定时任务
echo "0 4 * * * root /usr/bin/aide --check | mail -s 'AIDE Report' [email protected]" | sudo tee /etc/cron.d/aide-check

# 安装OSSEC
wget https://github.com/ossec/ossec-hids/archive/3.7.0.tar.gz
tar xzf 3.7.0.tar.gz
cd ossec-hids-3.7.0
sudo ./install.sh
# 选择 "local" 安装模式

# 启动OSSEC
sudo /var/ossec/bin/ossec-control start

# 检查状态
sudo /var/ossec/bin/ossec-control status

<!-- /var/ossec/etc/ossec.conf -->
<ossec_config>
  <syscheck>
    <!-- 监控关键目录 -->
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin</directories>

    <!-- 忽略频繁变化的文件 -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/resolv.conf</ignore>

    <!-- 检查间隔（秒） -->
    <frequency>7200</frequency>
  </syscheck>

  <rootcheck>
    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
  </rootcheck>
</ossec_config>

# 安装auditd
sudo apt install auditd audispd-plugins -y

# 监控规则 /etc/audit/rules.d/security.rules

# 监控用户认证相关文件
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions

# 监控SSH配置
-w /etc/ssh/sshd_config -p wa -k sshd_config

# 监控可执行文件权限变更
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm_mod

# 监控网络连接
-a always,exit -F arch=b64 -S connect -k network

# 重载规则
sudo augenrules --load

# 查看审计日志
sudo ausearch -k identity --start today
sudo aureport --auth --start today

#!/bin/bash
# security-check.sh - 快速安全检查脚本

echo "=== 最近登录的用户 ==="
last -n 20

echo -e "\n=== 当前登录用户 ==="
who

echo -e "\n=== 可疑的SUID文件 ==="
find / -perm -4000 -type f 2>/dev/null

echo -e "\n=== 异常的cron任务 ==="
for user in $(cut -f1 -d: /etc/passwd); do
    crontab -l -u $user 2>/dev/null
done

echo -e "\n=== 异常的网络连接 ==="
ss -tlnp

echo -e "\n=== 最近修改的系统文件 ==="
find /etc -mtime -1 -type f 2>/dev/null

echo -e "\n=== 可疑进程 ==="
ps auxf | head -50