forum.lissyara.su

Код: Выделить всё

[root@pcbsd]/home/user1(9)# ssh -v user1@hostname2
OpenSSH_5.1p1 FreeBSD-20080901, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to hostname2 [b.b.b.b] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host 

Код: Выделить всё

andreyv@relay:~> cat /etc/ssh/ssh_config
#       $OpenBSD: ssh_config,v 1.20 2005/01/28 09:45:53 dtucker Exp $

Host *
ForwardX11Trusted yes

# This enables sending locale enviroment variables LC_* LANG, see ssh_config(5).
SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
SendEnv LC_IDENTIFICATION LC_ALL

Код: Выделить всё

#       $OpenBSD: ssh_config,v 1.23 2007/06/08 04:40:40 pvalchev Exp $
#       $FreeBSD: src/crypto/openssh/ssh_config,v 1.32.2.1 2008/09/01 20:03:13 des Exp $

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.                                             

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP no
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VersionAddendum FreeBSD-20080901

Код: Выделить всё

[andreyv@site]/home/andreyv(9)% telnet 127.0.0.1 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 FreeBSD-20080901

Protocol mismatch.
Connection closed by foreign host.

Код: Выделить всё

andreyv@relay:~> telnet site 22
Trying ip.ip.ip.ip...
Connected to site
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 FreeBSD-20080901

Protocol mismatch.
Connection closed by foreign host.
andreyv@relay:~>

Код: Выделить всё

[andreyv@pcbsd]/home/andreyv(13)% telnet SUSE 22
Trying ip.ip.ip...
Connected to relay.ubcua.tv.
Escape character is '^]'.
SSH-1.99-OpenSSH_4.2

Protocol mismatch.
Connection closed by foreign host.
[andreyv@pcbsd]/home/andreyv(14)%

Код: Выделить всё

[andreyv@pcbsd]/home/andreyv(14)% telnet site 22
Trying ip.ip.ip...
Connected to site.ubcua.tv.
Escape character is '^]'.


Connection closed by foreign host.
[andreyv@pcbsd]/home/andreyv(15)%

Код: Выделить всё

..
May 24 01:23:30 site sshd[29536]: warning: /etc/hosts.allow, line 35: can't verify hostname: getaddrinfo(82.193.97.ХХ.usernat.ip.PP.ua, AF_INET) failed
May 24 01:23:50 site sshd[29536]: refused connect from 82.193.97.ХХ (82.193.97.ХХ)
May 24 01:26:54 site sshd[30413]: warning: /etc/hosts.allow, line 35: can't verify hostname: getaddrinfo(82.193.97.Х.usernat.ip.PP.ua, AF_INET) failed
May 24 01:27:15 site sshd[30413]: refused connect from 82.193.97.ХХ (82.193.97.ХХ)
May 24 01:28:01 site sshd[30666]: Accepted keyboard-interactive/pam for andreyv from 217.25.199.ХХ port 25601 ssh2
May 24 01:28:08 site su: andreyv to root on /dev/ttyp0
May 24 01:34:56 site sshd[32510]: warning: /etc/hosts.allow, line 35: can't verify hostname: getaddrinfo(82.193.97.ХХ.usernat.ip.PP.ua, AF_INET) failed
May 24 01:35:17 site sshd[32510]: refused connect from 82.193.97.ХХ (82.193.97.ХХ)

Код: Выделить всё

[andreyv@site]/home/andreyv(14)% cat /etc/hosts.allow                                                                                                        
#                                                                                                                                                            
# hosts.allow access control file for "tcp wrapped" applications.                                                                                            
# $FreeBSD: src/etc/hosts.allow,v 1.19.8.1 2006/02/19 14:57:01 ume Exp $                                                                                     
#                                                                                                                                                            
# NOTE: The hosts.deny file is deprecated.                                                                                                                   
#       Place both 'allow' and 'deny' rules in the hosts.allow file.                                                                                         
#       See hosts_options(5) for the format of this file.                                                                                                    
#       hosts_access(5) no longer fully applies.                                                                                                             
                                                                                                                                                             
#        _____                                      _          _                                                                                             
#       | ____| __  __   __ _   _ __ ___    _ __   | |   ___  | |                                                                                            
#       |  _|   \ \/ /  / _` | | '_ ` _ \  | '_ \  | |  / _ \ | |                                                                                            
#       | |___   >  <  | (_| | | | | | | | | |_) | | | |  __/ |_|                                                                                            
#       |_____| /_/\_\  \__,_| |_| |_| |_| | .__/  |_|  \___| (_)                                                                                            
#                                          |_|                                                                                                               
# !!! This is an example! You will need to modify it for your specific                                                                                       
# !!! requirements!                                                                                                                                          
                                                                                                                                                             
                                                                                                                                                             
# Start by allowing everything (this prevents the rest of the file                                                                                           
# from working, so remove it when you need protection).                                                                                                      
# The rules here work on a "First match wins" basis.                                                                                                         
#ALL : ALL : allow                                                                                                                                           
                                                                                                                                                             
# Wrapping sshd(8) is not normally a good idea, but if you                                                                                                   
# need to do it, here's how                                                                                                                                  
#sshd : .evil.cracker.example.com : deny                                                                                                                     
                                                                                                                                                             
# Protect against simple DNS spoofing attacks by checking that the                                                                                           
# forward and reverse records for the remote host match. If a mismatch                                                                                       
# occurs, access is denied, and any positive ident response within                                                                                           
# 20 seconds is logged. No protection is afforded against DNS poisoning,                                                                                     
# IP spoofing or more complicated attacks. Hosts with no reverse DNS                                                                                         
# pass this rule.                                                                                                                                            
ALL : PARANOID : RFC931 20 : deny                                                                                                                            
                                                                                                                                                             
# Allow anything from localhost.  Note that an IP address (not a host                                                                                        
# name) *MUST* be specified for rpcbind(8).                                                                                                                  
ALL : localhost 127.0.0.1 : allow                                                                                                                            
# Comment out next line if you build libwrap with NO_INET6=yes.                                                                                              
ALL : [::1] : allow                                                                                                                                          
#ALL : my.machine.example.com 192.0.2.35 : allow                                                                                                             
                                                                                                                                                             
# To use IPv6 addresses you must enclose them in []'s                                                                                                        
#ALL : [fe80::%fxp0]/10 : allow                                                                                                                              
#ALL : [fe80::]/10 : deny                                                                                                                                    
#ALL : [2001:db8:2:1:2:3:4:3fe1] : deny                                                                                                                      
#ALL : [2001:db8:2:1::]/64 : allow                                                                                                                           
                                                                                                                                                             
# Sendmail can help protect you against spammers and relay-rapers                                                                                            
sendmail : localhost : allow                                                                                                                                 
#sendmail : .nice.guy.example.com : allow
#sendmail : .evil.cracker.example.com : deny
sendmail : ALL : allow

# Exim is an alternative to sendmail, available in the ports tree
exim : localhost : allow
#exim : .nice.guy.example.com : allow
#exim : .evil.cracker.example.com : deny
exim : ALL : allow

# Rpcbind is used for all RPC services; protect your NFS!
# (IP addresses rather than hostnames *MUST* be used here)
#rpcbind : 192.0.2.32/255.255.255.224 : allow
#rpcbind : 192.0.2.96/255.255.255.224 : allow
rpcbind : ALL : deny

# NIS master server. Only local nets should have access
ypserv : localhost : allow
#ypserv : .unsafe.my.net.example.com : deny
#ypserv : .my.net.example.com : allow
ypserv : ALL : deny

# Provide a small amount of protection for ftpd
ftpd : localhost : allow
#ftpd : .nice.guy.example.com : allow
#ftpd : .evil.cracker.example.com : deny
ftpd : ALL : allow

# You need to be clever with finger; do _not_ backfinger!! You can easily
# start a "finger war".
fingerd : ALL \
        : spawn (echo Finger. | \
         /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
        : deny

# The rest of the daemons are protected.
#ALL : ALL \
#       : severity auth.info \
#       : twist /bin/echo "You are not welcome to use %d from %h."

# denyhosts
sshd : /etc/hosts.deniedssh \
     : severity auth.info \
     : twist /bin/echo "Server %d denied from %h"
     : deny
sshd : ALL : allow

Код: Выделить всё

                                                                                                                                                             
# Start by allowing everything (this prevents the rest of the file                                                                                           
# from working, so remove it when you need protection).                                                                                                      
# The rules here work on a "First match wins" basis.                                                                                                         
[color=#00BF40]ALL : ALL : allow    [/color]