☰

强制关闭 GCP VM 上的端口 22 (ssh)

tag-icon • tag-icon linux networking ssh security firewall
强制关闭 GCP VM 上的端口 22 (ssh)

出于安全原因，我想关闭 GCP 上的虚拟机的 22 端口 (ssh)。目前，如果我执行该命令，telnet xx.xx.xxx.xxx 22服务器会响应我：

Trying xx.xx.xxx.xxx...
Connected to xx.xx.xxx.xxx.
Escape character is '^]'.
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

我尝试正确配置与虚拟机接触的防火墙规则：从“default-allow-ssh”规则中的目标中删除“应用于所有”，并创建一条名为“close-ssh”的规则，拒绝自 0.0.0.0/4 以来到端口 22 的所有连接。图片如下：https://i.stack.imgur.com/8LGkW.png

我还验证了在服务器上运行该sudo iptables -L命令找不到任何公开端口 22 的规则。输出如下：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (3 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

然后执行命令，直到nmap -p 22 xx.xx.xxx.xxx出现以下输出：

Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-10 09:56 -03
Nmap scan report for xx.xx.xxx.xxx.bc.googleusercontent.com (xx.xx.xxx.xxx)
Host is up (0.32s latency).

PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

答案1

您是否希望 sshd 运行？我没有看到 iptables 中有任何规则阻止 tcp 22

如果不需要 sshd，请将其关闭。

尝试在任何地方添加类似 DROP ssh -- 的规则

如果您想允许特定访问，您可以随时添加“接受 ssh --从到”。

相关内容