因為網路安全問題，需要對centos7下的ssh服務進行安全加固，下面會給出詳細操作步驟及思路。

     由於centos7系統預設安裝啟用了系統高階防火牆，ssh服務預設開啟是22埠，如果直接在ssh的配置檔案中對監聽埠進行更改，重啟sshd服務後不會成功，提示無法繫結埠，所以要修改ssh的埠，需要首先修改系統防火牆配置

    一、ssh登陸埠修改

        1、防火牆上新增ssh監聽埠

              firewall-cmd --permanent --zone=public --add-port=3333/tcp  #對public區域新增一個埠3333協議為tcp

              firewall-cmd --reload   #新增完成後需要過載配置檔案生效配置

       2、檢視新增情況

              firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: ssh
  ports: 3333tcp
  protocols: 
  masquerade: no
  forward-ports: 
  sourceports: 
  icmp-blocks: 
  rich rules: 

     3、修改ssh配置檔案中的監聽埠為3333

          vim /etc/ssh/sshd_config

          找到port 22，替換為Port 3333，並且把前面的#號去掉

          完成修改後儲存退出。

         service sshd restart   #重啟服務使監聽埠更換為3333

     4、這時通過nmap對主機進行掃描可以發現ssh 22已經關閉

        PORT   STATE  SERVICE VERSION
             22/tcp closed ssh    

      5、對22埠進行流量處理，使nmap無法探測出任何資訊

  firewall-cmd --permanent --zone=public --remove-port=22/tcp     #防火牆刪除原來的22埠

      firewall-cmd --permanen --zone=public --add-forward-port=port=22:proto=tcp:toport=22:toaddr=127.0.0.1  #將 22 埠的訪問流量轉向訪問者本地

   firewall-cmd --reload   

       6、此時再次掃描，無任何埠資訊顯示，埠已經完美更改

   二、網路層IP地址限制

      埠隱藏無法完全保障安全，最好可以基於服務+IP地址的限制，通過對/etc/hosts.allow檔案進行編輯，規則是隻允許白名單內的IP地址可以訪問本機的ssh，其它IP地址一律不允許；

     [[email protected] ~]# vim  /etc/hosts.allow 
#
# hosts.allow   This file contains access rules which are used to
#               allow or deny connections to network services that
#               either use the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#
sshd:192.168.1.11:allow    #允許192.168.1.11通過訪問本機的ssh服務
sshd:192.168.1.12:allow   #允許192.168.1.12通過訪問本機的ssh服務
sshd:all:deny                       #預設全部拒絕訪問

   三、應用層對賬號+IP進行限制

    通過對/etc/ssh/sshd_config檔案進行配置，可以實現比hosts.allow更加豐富的限制，hosts.allow是基於網路層的限制，這裡可以實現業務層限制，限制規則是IP+賬號，限制指定登陸IP只能通過指定賬號登陸。

Allowusers [email protected]   #192.168.1.11可以使用root登陸
Allowusers [email protected]   #192.168.1.12只能使用test賬號登陸

  四、加固總結

   加固思路，首先要確保資訊洩露的越少越好，不要洩露服務型別，系統型別，通過第一步修改埠加引流操作，使得外部探測失去準星，然後還要在作業系統中基於網路層對可以訪問的IP地址列白名單，最後是對白名單使用者進行賬號許可權登陸指定，通過三步操作，完成對centos7作業系統ssh業務的加固。

   加固效果要隨時通過nmap進行掃描確認，下面是加固以後的效果。所有操作涉及ssh配置檔案/etc/ssh/sshd_config，作業系統網路層ip限制檔案/etc/hosts.allow,測試加固效果的軟體是nmap。

nmap -sS -v -A 192.168.1.1


Starting Nmap 6.49BETA5 ( https://nmap.org ) at 2017-05-11 21:58 CST
NSE: Loaded 122 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Initiating Ping Scan at 21:58
Scanning 192.168.1.1 [4 ports]
Completed Ping Scan at 21:58, 0.07s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:58
Completed Parallel DNS resolution of 1 host. at 21:58, 0.01s elapsed
Initiating SYN Stealth Scan at 21:58
Scanning 192.168.1.1 [1000 ports]
Completed SYN Stealth Scan at 21:58, 14.38s elapsed (1000 total ports)
Initiating Service scan at 21:58
Initiating OS detection (try #1) against 192.168.1.1
Initiating Traceroute at 21:58
Completed Traceroute at 21:58, 0.01s elapsed
Initiating Parallel DNS resolution of 1 host. at 21:58
Completed Parallel DNS resolution of 1 host. at 21:58, 0.01s elapsed
NSE: Script scanning 192.168.1.1
Initiating NSE at 21:58
Completed NSE at 21:58, 0.01s elapsed
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Nmap scan report for 192.168.1.1
Host is up (0.00064s latency).
All 1000 scanned ports on 192.168.1.1 are filtered
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|firewall
Running: Asus embedded, Palo Alto embedded
OS CPE: cpe:/h:asus:rt-53n cpe:/h:paloalto:pa-500
OS details: Asus RT-53N WAP, Palo Alto PA-500 firewall  #如果不做加固，會直接識別為linux具體版本和服務，暴露非常多的資訊
Network Distance: 1 hop


TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   0.86 ms 192.168.1.1


NSE: Script Post-scanning.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.11 seconds
           Raw packets sent: 2021 (90.330KB) | Rcvd: 35 (2.570KB)

--------------------下面顯示加固前的nmap掃描結果

22/tcp open  ssh     OpenSSH 6.6.1 (protocol 2.0)               #直接顯示埠服務及具體openssh的版本資訊
| ssh-hostkey: 
|   2048 79:38:a3:18:ce:9d:a7:16:5c:bd:61:12:95:30:aa:6c (RSA)
|_  256 2f:a7:3e:d8:fd:b1:2b:9a:af:03:38:44:73:f2:55:ad (ECDSA)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|storage-misc|WAP|load balancer|firewall
Running (JUST GUESSING): Linux 2.6.X (94%), Netgear Linux 2.6.X (93%), Linksys embedded (91%), Ubiquiti Linux 2.6.X (90%), F5 Networks embedded (87%), Palo Alto embedded (87%), F5 Networks TMOS 11.1.X (85%)
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:netgear:linux_kernel:2.6 cpe:/h:linksys:befw11s4 cpe:/o:ubiquiti:linux_kernel:2.6 cpe:/h:paloalto:pa-500 cpe:/o:f5:tmos:11.1
Aggressive OS guesses: Linux 2.6.32 (94%), Netgear ReadyNAS 3200 NAS device (Linux 2.6) (93%), Linksys BEFW11S4 WAP (91%), Linux 2.6.11 - 2.6.18 (90%), Ubiquiti WAP (Linux 2.6.32) (90%), F5 BIG-IP load balancer (87%), Palo Alto PA-500 firewall (87%), F5 3600 LTM load balancer (85%), Netgear WNDAP660 WAP (Linux 2.6.36) (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 1.245 days (since Thu May 11 08:42:05 2017)