替换不安全协议：Telnet 对比 SSH、FTP 对比 SFTP

明文协议的问题

# What an attacker sees on the wire with Telnet
# (captured via Wireshark or tcpdump)

tcpdump -i eth0 -A port 23

# Sample Telnet capture output:
..login: admin..
..password: S3cr3tPa$$...
..$ ls -la /etc/passwd..

# Every keystroke is visible in plaintext
# Credentials, commands, and file contents - all exposed

Telnet 与 SSH

# SSH connection (encrypted, server authenticated)
ssh admin@192.168.1.10

# SSH key-based authentication (no password)
ssh -i ~/.ssh/id_rsa admin@192.168.1.10

# Generate SSH key pair
ssh-keygen -t ed25519 -C 'admin@company.com'

# Copy public key to server
ssh-copy-id -i ~/.ssh/id_rsa.pub admin@192.168.1.10

# Disable Telnet on network devices (Cisco IOS)
no service telnet
line vty 0 4
  transport input ssh
  login local

SSH 密钥交换与身份验证

# Harden SSH server configuration
# /etc/ssh/sshd_config
Port 22
PermitRootLogin no
PasswordAuthentication no    # Require key auth only
ChallengeResponseAuthentication no
MaxAuthTries 3
AllowUsers admin deploy
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
ClientAliveInterval 300      # Disconnect idle sessions
ClientAliveCountMax 0

# Restart SSH after changes
systemctl restart sshd

FTP、SFTP 与 FTPS

# SFTP usage (over SSH, single connection)
sftp admin@fileserver.company.com
sftp> put localfile.zip /uploads/
sftp> get /reports/monthly.pdf .
sftp> ls /uploads/
sftp> exit

# Automated SFTP transfer with key auth
sftp -i ~/.ssh/id_rsa admin@fileserver.company.com <<EOF
put /tmp/report.csv /incoming/
EOF

# Disable FTP on Linux (remove vsftpd)
apt purge vsftpd
# Verify no FTP listener:
ss -tlnp | grep ':21'

HTTP 与 HTTPS

# nginx: force HTTPS redirect
server {
  listen 80;
  server_name example.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/example.crt;
  ssl_certificate_key /etc/ssl/example.key;
  add_header Strict-Transport-Security
    'max-age=31536000; includeSubDomains; preload';
  add_header X-Content-Type-Options nosniff;
  add_header X-Frame-Options SAMEORIGIN;
}

SNMP v1/v2 与 SNMPv3

# SNMPv3 configuration (Cisco IOS)
snmp-server group MYGROUP v3 priv
snmp-server user MONITORUSER MYGROUP v3 \
  auth sha MyAuthP@ss priv aes 128 MyPrivP@ss

# SNMPv3 query from monitoring server
snmpwalk -v3 -l authPriv \
  -u MONITORUSER \
  -a SHA -A MyAuthP@ss \
  -x AES -X MyPrivP@ss \
  192.168.1.1 sysDescr

# Disable SNMPv1/v2c:
no snmp-server community public ro
no snmp-server community private rw

LDAP 与 LDAPS

POP3/IMAP 与加密电子邮件收取

# Protocol port reference card
Protocol    Insecure Port  Secure Port  Replacement
---------   ------------   ----------  -----------
Telnet      23             22           SSH
FTP         20/21          22           SFTP
HTTP        80             443          HTTPS
SMTP        25             587/465      SMTPS
POP3        110            995          POP3S
IMAP        143            993          IMAPS
LDAP        389            636          LDAPS
SNMP        161/162        161/162      SNMPv3
RDP         3389           3389         RDP+NLA+TLS

实际替换协议

# Audit for insecure protocol usage
# Nmap: find all Telnet listeners on network
nmap -p 23 10.0.0.0/24 --open -sV

# Find FTP listeners
nmap -p 21 10.0.0.0/24 --open

# Find HTTP (not HTTPS) web services
nmap -p 80 --open 10.0.0.0/24

# Check for SNMPv1/v2c community strings
nmap -sU -p 161 --script snmp-info 10.0.0.0/24

# Block Telnet at firewall after migration
iptables -A FORWARD -p tcp --dport 23 -j DROP
iptables -A INPUT -p tcp --dport 23 -j DROP

远程桌面协议安全

分阶段弃用不安全协议

# Phase 4: Disable and block Telnet permanently

# Disable Telnet service on Linux
systemctl stop telnet.socket
systemctl disable telnet.socket

# Block Telnet at iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
iptables -A OUTPUT -p tcp --dport 23 -j DROP
# Save rules
iptables-save > /etc/iptables/rules.v4

# Block at network firewall (Cisco ASA)
access-list OUTSIDE_IN deny tcp any any eq 23

# Verify: should timeout / connection refused
nc -zv 192.168.1.10 23

快速 Check

课程回顾