VPS上新建用户禁用root登录SSH WinSCP提权登录

以搬瓦工的Ubuntu系统为例，首先先用root用户登入SSH，然后新建一个用户，并修改其密码，这里使用用户名为username：

 
Shell
 
          1 
        
          2 
        
          3 
        
         useradd 
           
         - 
         d 
           
         "/home/username" 
           
         - 
         m 
           
         - 
         s 
           
         "/bin/bash" 
           
         username 
        
         passwd  
         username 
        
         # 然后根据提示输入密码

接着将用户加入到sudo用户组中，使得该用户可以使用sudo命令提权：

接着将SSH key公钥填写在 /home/username/.ssh/authorized_keys 文件中，此时即可利用新的用户username登录了。

不过当你使用WinSCP文件管理器的时候，使用非root用户会很麻烦，因为这类软件登录后无法再提权，因此无法操作全部文件。不过有种方法可以解决。首先先看一下sftp-server在哪个位置（不同系统可能位置不同）：

 
Shell
 
          1 
        
          2 
        
          3 
        
         cat 
           
         / 
         etc 
         / 
         ssh 
         / 
         sshd_config 
           
         | 
           
         grep 
           
         sftp 
        
         # 下面是返回结果 
        
         Subsystem     
         sftp 
              
         / 
         usr 
         / 
         lib 
         / 
         openssh 
         / 
         sftp 
         - 
         server

/usr/lib/openssh/sftp-server 就是sftp-server的路径

接着用visudo命令编辑 /etc/sudoers 文件，sudoers在Ubuntu 16.04版本中默认内容如下：

#

 
  # This file MUST be edited with the 'visudo' command as root. 
 

#

 
  # Please consider adding local content in /etc/sudoers.d/ instead of 
 

 
  # directly modifying this file. 
 

#

 
  # See the man page for details on how to write a sudoers file. 
 

#

 
  Defaults  
  env_reset

 
  Defaults  
  mail_badpass

 
  Defaults  
  secure_path 
  = 
  "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" 
 

 
  # Host alias specification 
 

 
  # User alias specification 
 

 
  # Cmnd alias specification 
 

 
  # User privilege specification 
 

 
  root  
  ALL 
  = 
  ( 
  ALL 
  : 
  ALL 
  ) 
    
  ALL 
 

 
  # Members of the admin group may gain root privileges 
 

 
  % 
  admin 
    
  ALL 
  = 
  ( 
  ALL 
  ) 
    
  ALL 
 

 
  # Allow members of group sudo to execute any command 
 

 
  % 
  sudo 
    
  ALL 
  = 
  ( 
  ALL 
  : 
  ALL 
  ) 
    
  ALL 
 

 
  # See sudoers(5) for more information on "#include" directives: 
 

 
  #includedir /etc/sudoers.d 
 

在最后加入一行，此行的作用是让username用户可以在不输入用户密码的情况下提权执行sftp-server（因为sudo提权时候需要tty中输入密码，但是SFTP中无法实现，因此需要SFTP提权执行时候不输入密码才能正常连接）

#

 
  # This file MUST be edited with the 'visudo' command as root. 
 

#

 
  # Please consider adding local content in /etc/sudoers.d/ instead of 
 

 
  # directly modifying this file. 
 

#

 
  # See the man page for details on how to write a sudoers file. 
 

#

 
  Defaults  
  env_reset

 
  Defaults  
  mail_badpass

 
  Defaults  
  secure_path 
  = 
  "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" 
 

 
  # Host alias specification 
 

 
  # User alias specification 
 

 
  # Cmnd alias specification 
 

 
  # User privilege specification 
 

 
  root  
  ALL 
  = 
  ( 
  ALL 
  : 
  ALL 
  ) 
    
  ALL 
 

 
  # Members of the admin group may gain root privileges 
 

 
  % 
  admin 
    
  ALL 
  = 
  ( 
  ALL 
  ) 
    
  ALL 
 

 
  # Allow members of group sudo to execute any command 
 

 
  % 
  sudo 
    
  ALL 
  = 
  ( 
  ALL 
  : 
  ALL 
  ) 
    
  ALL 
 

 
  username  
  ALL 
  = 
  NOPASSWD 
  : 
     
  / 
  usr 
  / 
  lib 
  / 
  openssh 
  / 
  sftp 
  - 
  server 
 

 
  # See sudoers(5) for more information on "#include" directives: 
 

 
  #includedir /etc/sudoers.d 
 

然后注意这行不能添加到前面，因为后面的设置会覆盖掉前面的，比如说 %sudo ALL=(ALL:ALL) ALL 允许sudo用户组以任何用户身份执行任何程序，然而没有NOPASSWD选项，因此不能免密码，如果这行在下面就会使得前面设置的NOPASSWD失效了。

然后编辑 /etc/ssh/sshd_config ，一是禁止root用户登录，二是禁止纯密码登录，三是为sftp命令添加sudo使得SFTP连接后直接获取root权限：

 
  # Package generated configuration file 
 

 
  # See the sshd_config(5) manpage for details 
 

 
  # What ports, IPs and protocols we listen for 
 

 
  # Use these options to restrict which interfaces/protocols sshd will bind to 
 

 
  #ListenAddress :: 
 

 
  #ListenAddress 0.0.0.0 
 

 
  Protocol 
    
  2

 
  # HostKeys for protocol version 2 
 

 
  HostKey 
    
  / 
  etc 
  / 
  ssh 
  / 
  ssh_host_rsa_key 
 

 
  HostKey 
    
  / 
  etc 
  / 
  ssh 
  / 
  ssh_host_dsa_key 
 

 
  HostKey 
    
  / 
  etc 
  / 
  ssh 
  / 
  ssh_host_ecdsa_key 
 

 
  HostKey 
    
  / 
  etc 
  / 
  ssh 
  / 
  ssh_host_ed25519_key 
 

 
  #Privilege Separation is turned on for security 
 

 
  UsePrivilegeSeparation  
  yes

 
  # Lifetime and size of ephemeral version 1 server key 
 

 
  KeyRegenerationInterval 
    
  3600

 
  ServerKeyBits 
    
  1024

 
  # Logging 
 

 
  SyslogFacility  
  AUTH

 
  LogLevel  
  INFO

 
  # Authentication: 
 

 
  LoginGraceTime 
    
  120

 
  PermitRootLogin  
  no

 
  StrictModes  
  yes

 
  RSAAuthentication  
  yes

 
  PubkeyAuthentication  
  yes

 
  #AuthorizedKeysFile %h/.ssh/authorized_keys 
 

 
  # Don't read the user's ~/.rhosts and ~/.shosts files 
 

 
  IgnoreRhosts  
  yes

 
  # For this to work you will also need host keys in /etc/ssh_known_hosts 
 

 
  RhostsRSAAuthentication  
  no

 
  # similar for protocol version 2 
 

 
  HostbasedAuthentication  
  no

 
  # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication 
 

 
  #IgnoreUserKnownHosts yes 
 

 
  # To enable empty passwords, change to yes (NOT RECOMMENDED) 
 

 
  PermitEmptyPasswords  
  no

 
  # Change to yes to enable challenge-response passwords (beware issues with 
 

 
  # some PAM modules and threads) 
 

 
  ChallengeResponseAuthentication  
  no

 
  # Change to no to disable tunnelled clear text passwords 
 

 
  PasswordAuthentication  
  no

 
  # Kerberos options 
 

 
  #KerberosAuthentication no 
 

 
  #KerberosGetAFSToken no 
 

 
  #KerberosOrLocalPasswd yes 
 

 
  #KerberosTicketCleanup yes 
 

 
  # GSSAPI options 
 

 
  #GSSAPIAuthentication no 
 

 
  #GSSAPICleanupCredentials yes 
 

 
  X11Forwarding  
  yes

 
  X11DisplayOffset 
    
  10

 
  PrintMotd  
  no

 
  PrintLastLog  
  yes

 
  TCPKeepAlive  
  yes

 
  #UseLogin no 
 

 
  #MaxStartups 10:30:60 
 

 
  #Banner /etc/issue.net 
 

 
  # Allow client to pass locale environment variables 
 

 
  AcceptEnv  
  LANG  
  LC_* 
 

 
  Subsystem  
  sftp  
  sudo 
    
  / 
  usr 
  / 
  lib 
  / 
  openssh 
  / 
  sftp 
  - 
  server 
 

 
  # Set this to 'yes' to enable PAM authentication, account processing, 
 

 
  # and session processing. If this is enabled, PAM authentication will 
 

 
  # be allowed through the ChallengeResponseAuthentication and 
 

 
  # PasswordAuthentication.  Depending on your PAM configuration, 
 

 
  # PAM authentication via ChallengeResponseAuthentication may bypass 
 

 
  # the setting of "PermitRootLogin without-password". 
 

 
  # If you just want the PAM account and session checks to run without 
 

 
  # PAM authentication, then enable this but set PasswordAuthentication 
 

 
  # and ChallengeResponseAuthentication to 'no'. 
 

 
  UsePAM  
  yes

这样就可以使得WinSCP登录username的同时拥有root权限，从而可以直接访问更改所有文件。同时如果PuTTY打开的话，就是普通的使用username登录，使用sudo则可提权，sudo时候输入用户密码即可。

VPS上新建用户 禁用root登录SSH WinSCP提权登录

猜你喜欢

VPS上新建用户禁用root登录SSH WinSCP提权登录