1

Port 2222  # 修改默认SSH端口

1

ListenAddress 192.168.1.100  # 仅监听内网接口

1

2

HostKey /etc/ssh/ssh_host_ed25519_key  # 最佳选择

HostKey /etc/ssh/ssh_host_rsa_key      # 兼容性选择

1

2

PasswordAuthentication no  # 禁用密码认证

PubkeyAuthentication yes   # 启用密钥认证

1

PermitRootLogin no  # 禁止root直接登录

1

2

3

4

5

6

# 安装所需软件

sudo apt install libpam-google-authenticator

# 配置SSH使用双因素认证

ChallengeResponseAuthentication yes

AuthenticationMethods publickey,keyboard-interactive

1

2

# 允许user1在任何位置访问，user2仅限内网访问

AllowUsers user1 user2@192.168.*.*

1

2

# 仅允许内网访问SSH端口

sudo ufw allow from 192.168.1.0/24 to any port 2222

1

2

3

4

5

6

7

8

9

10

11

12

# 安装Fail2ban

sudo apt install fail2ban

# 配置示例(/etc/fail2ban/jail.local)

[sshd]

enabled = true

port = 2222

filter = sshd

logpath = /var/log/auth.log

maxretry = 3

findtime = 30

bantime = 3600

1

2

3

4

5

# 使用ed25519算法（推荐）

ssh-keygen -t ed25519 -a 100

# 使用RSA算法（兼容性更好）

ssh-keygen -t rsa -b 4096

1

2

3

4

chmod 700 ~/.ssh

chmod 600 ~/.ssh/authorized_keys

chmod 600 ~/.ssh/id_ed25519

chmod 644 ~/.ssh/id_ed25519.pub

1

2

3

4

# 加密算法配置

KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

1

2

3

4

5

6

# 客户端保持活动状态检查

ClientAliveInterval 300

ClientAliveCountMax 2

# 登录超时时间

LoginGraceTime 1m