云服务器的22端口直接暴露公网，所有人可以访问，会不会有什么风险？
如果有风险的话，都有哪些风险，如何进行规避或者降低（主要是本地机所在的网络ip不固定，导致安全组设置很麻烦）
6 Likes
改端口 只允许密钥登录
还怕就上堡垒机
3 Likes
会有来自世界各地的IP疯狂尝试登录你的机器
5 Likes
不怕贼偷就怕贼惦记，换个端口是要换的
先把防火墙规则加上（iptables和云服务器的控台）
然后修改sshd_config里的Port，文件路径一般来说是/etc/ssh/sshd_config
下附一个我用的，我是22222端口，我想你以前应该没改过，那么我建议你挨个查一查/看一看每个启用的参数的作用，然后再根据实际情况修改
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Include /etc/ssh/sshd_config.d/*.conf
Port 22222
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
MaxAuthTries 6
#MaxSessions 10
PubkeyAuthentication yes
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
KbdInteractiveAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# override default of no subsystems
Subsystem sftp /usr/lib/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
然后重启服务生效
sudo systemctl restart sshd
5 Likes
端口看来必须要改了
3 Likes
用非22端口加秘钥登录
3 Likes
害怕怕
3 Likes
一会儿就参考试一下
3 Likes
安全组，最好只放行给部分ip访问你的ssh端口
3 Likes
就是ip不固定，比较麻烦
3 Likes
楼上给你加了个参数作用的图
IP不固定就装个ddns的服务咯
3 Likes
写点小代码啦，国内厂商基本都有API给你改安全组，我自己就是这么干的 
2 Likes
我有看到这类的文档说明，可以作为方案之一，感谢建议 
2 Likes
会导致你的服务器连夜被老鼠搬入
- 建议改成冷门的端口且不要太靠前、中、后，挑个至少得死命破解一段时间的比如 45321
- 安全组只开特点端口可以被访问，SSH 仅密码登录且密码和用户名都改到 12 位以上，推荐 16 位
- 但你的月流量还是会被一点一点吃光……
3 Likes
不用那么麻烦，改端口也是没用的，用私钥登录就够了。
3 Likes
改什么端口都能被扫出来，还是密钥登陆
4 Likes
天天被别人爆密码
2 Likes
禁用密码登录，改为证书登录。一般还好。注意openssh安全漏洞提醒，别出现 0day
3 Likes
搞个密钥对访问他们就没辙了