Linux辦事器一向就是以不變、高效、安但是著稱。安然是比較首要的一個(gè)環(huán)節(jié)，這關(guān)系到商業(yè)奧秘，更關(guān)系到企業(yè)的存亡。本文介紹了若何利用optw生成一次性口令及只承諾履行特定號令，以下為譯文：
我想承諾我的伴侶登錄我的辦事器下載一些資料，可是只承諾他登錄10次，登岸后只承諾履行scp號令，不準(zhǔn)干別的工作，該如何辦呢?
回納起來，完成以下2件工作：
生成一次性口令
只承諾用戶履行scp任務(wù)
實(shí)現(xiàn)方針1：生成一次性口令
安裝otpw
sudo apt-get install otpw-bin libpam-otpw
建設(shè)common-auth
nano /etc/pam.d/common-auth
查找以下行:
auth [success=1 default=ignore] pam_unix.so nullok_secure
在上述行上加進(jìn):
auth sufficient pam_otpw.so
session optional pam_otpw.so
用戶登錄時(shí)，起首測驗(yàn)測驗(yàn)利用一次性口令登錄，掉敗后，利用正常登錄編制。
建設(shè)sshd辦事
增加一個(gè)otpw建設(shè)文件:
nano /etc/pam.d/otpw
內(nèi)容以下:
auth sufficient pam_otpw.so
session optional pam_otpw.so
建設(shè)sshd建設(shè)文件包含otpw建設(shè)文件：
nano /etc/pam.d/sshd
查找:
@include common-auth
在上述行上增加一行:
@include otpw
點(diǎn)竄sshd建設(shè)文件后，確保以下3個(gè)參數(shù)設(shè)置為yes:
UsePrivilegeSeparation yes
ChallengeResponseAuthentication yes
UsePAM yes
從頭啟動(dòng)sshd辦事
service ssh restart
這是根基的otpw建設(shè). 確保用戶home目次下存在文件建設(shè)文件 (~/.otpw) 的用戶才會(huì)啟用一次性口令認(rèn)證. 所有其它用戶不受影響。
以下號令產(chǎn)生4個(gè)一次性口令:
otpw-gen -h 5 -w 64
以下號令產(chǎn)生10個(gè)一次性口令:
otpw-gen -h 6 -w 79
號令輸出以下：
Generating random seed ...
If your *** password list is stolen, the thief should not gain
access to your account with this information alone. Therefore, you
need to memorize and enter below a prefix password. You will have to
enter that each time directly before entering the one-time password
(on the same line).
When you log in, a 3-digit password number will be displayed. It
identifies the one-time password on your list that you have to append
to the prefix password. If another login to your account is in progress
at the same time, several password numbers may be shown and all
corresponding passwords have to be appended after the prefix
password. Best generate a new password list when you have used up half
of the old one.
Overwrite existing password list '~/.otpw' (Y/n)?
Enter new prefix password:
Reenter prefix password:
Creating '~/.otpw'.
Generating new one-time passwords ...
OTPW list generated 2014-02-27 01:31 on kali
000 IT4U V3Bk 002 cfFE g=Gj 004 +2ML Ff92 006 kaag Ar:Y 008 VZY8 iGsp
001 9H7n aPhV 003 fcIJ zf/P 005 Qxqf OhgF 007 zPY/ QJOV 009 :N7K 3zEu
!!! REMEMBER: Enter the PREFIX PASSWORD first !!!
SSH登錄:
login as: test
Using keyboard-interactive authentication.
Password 003:
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.46-1 i686
The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Jul 9 20:03:23 2013 from 192.168.200.10
test@debian:~$
假定你的前綴口令是 "pass" 實(shí)際輸進(jìn)的003號暗碼是:
passfcIJ zf/P
(前綴暗碼后不需要輸進(jìn)空格)。
成立optw一次性口令的用戶組并添加用戶:
addgroup optw
adduser test optw
點(diǎn)竄文件權(quán)限:
chown root:optw /home/test/.otpw
chmod 640 /home/test/.otpw
避免其它用戶重置口令:
chmod 750 /usr/bin/otpw-gen
方針2.限制用戶只承諾履行scp任務(wù):
apt-get install rssh
apt-get install scponly
2個(gè)定制的shell別離完成以下任務(wù):
rssh限制用戶的行動(dòng)
scponly時(shí)獨(dú)一scp號令的一個(gè)shell.
此刻，可以點(diǎn)竄用戶的shell:
usermod -s /usr/sbin/scponly test
usermod -s /usr/sbin/rssh test
And you can confiure rssh quite descent:
nano /etc/rssh.conf
Content:
# Leave these all commented out to make the default action for rssh to lock
# users out completely...
allowscp
#allowsftp
#allowcvs
#allowrdist
#allowrsync
#allowsvnserve
# if your chroot_path contains spaces, it must be quoted...
# In the following examples, the chroot_path is "/usr/local/my chroot"
user=test:011:000010:"/opt/scpspace/test chroot" # scp with chroot
譯者注：
1、optw是linux上的一次性口令的開源實(shí)現(xiàn)，近似于RSA公司Secure ID功能。
2、rssh是受限的shell，供給良多合用的功能。建設(shè)簡單。
[譯自vpsboard]