CentOS系統(tǒng)安全加固常見方法

關于Linux系統(tǒng)安全加固的具體實現(xiàn)腳本及基線檢查規(guī)范挎扰，以供主機維護人員參考學習。

其中以下腳本主要實現(xiàn)的功能包括：

*加固項包括：密碼長度、session超時時間仲锄、刪除不用的帳號和組霞丧、限制root用戶直接telnet或rlogin呢岗、ssh

*檢查是否存在除root之外UID為0的用戶、確保root用戶的系統(tǒng)路徑中不包含父目錄蛹尝，在非必要的情況下后豫，不應包含組權限為777的目錄

*檢查操作系統(tǒng)Linux用戶umask設置、檢查重要目錄和文件的權限突那、禁止除root之外的用戶su操作挫酿、查找系統(tǒng)中任何人都有寫權限的目錄

*查找系統(tǒng)中沒有屬主的文件、查找系統(tǒng)中的隱藏文件愕难、判斷日志與審計是否合規(guī)早龟、登錄超時設置、禁用不必要的服務

*linux 安全加固適用于redhat猫缭、centos5.8至6.2

具體內(nèi)容如下葱弟，請結合自身業(yè)務需求進行系統(tǒng)級加固：

#1、---------------------------------------------------------------------

echo "刪除不用的帳號和組"

echo "delete unused users and grups"

for i in lp sync shutdown halt news uucp operator games gopher

? ? echo "will delete user $i"

? ? ?userdel $i

? ? echo "user $i have delete"

done

for i in lp sync shutdown halt news uucp operator games gopher

? ? echo "will delete group $i"

? ? groupdel $i

? ? echo "group $i have delete"

done

date=`date +%F`

#2猜丹、-----------------------------------------------

#section1 密碼要求密碼長度大于8,口令90天過期/etc/login.defs

#-----------------------------------------------

#---------------------------------------------------------------------

echo "cp /etc/login.defs to /etc/login.defs.bak_%date"

echo "#-------------------------------------"

cp /etc/login.defs /etc/login.defs.bak_$date

#echo "檢查密碼的配置"

echo "Check the configure for user's password."

echo "#-------------------------------------"

for i in PASS_MAX_DAYS PASS_MIN_LEN PASS_MIN_DAYS PASS_WARN_AGE

? ? cat /etc/login.defs |grep $i|grep -v \#

done

#set password min length 8

echo "#-------------------------------------"

echo "Set user's password min length is 8"

sed ?-i '/PASS_MIN_LEN/s/5/8/g' /etc/login.defs

echo "#-------------------------------------"

#set password max day 90

#echo "set password expired 90 day"

#sed ?-i '/PASS_MAX_DAYS/s/99999/90/g' /etc/login.defs

#3芝加、---------------------------------------------------------------------

echo "#檢查是否存在空口令"

echo "Check if there have user without password!"

echo "#-------------------------------------"

awk -F: '($2 == "") { print $1 }' /etc/shadow

#4、-----------------------------------------------

#section2 限制root用戶直接telnet或rlogin射窒，ssh無效

######建議在/etc/securetty文件中配置：CONSOLE = /dev/tty01

#---------------------------------------------------------------------

#帳號與口令-檢查是否存在除root之外UID為0的用戶

#echo "#檢查系統(tǒng)中是否存在其它id為0的用戶"

echo "Check if the system have other user's id is 0"

echo "#-------------------------------------"

mesg=`awk -F: '($3 == 0) { print $1 }' /etc/passwd|grep -v root`

if [ -z $mesg ]

then

echo "There don't have other user uid=0"

else

echo

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

echo "$mesg uid=0"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

#5藏杖、-----------------------------------------------------------

echo "#確保root用戶的系統(tǒng)路徑中不包含父目錄，在非必要的情況下脉顿，不應包含組權限為777的目錄"

echo "check the Path set for root,make sure the path for root dont have father directory and 777 rights"

echo "#-------------------------------------"

echo $PATH | egrep '(^|:)(\.|:|$)'

find `echo $PATH | tr ':' ' '` -type d $ -perm -002 -o -perm -020 $ -ls

#6蝌麸、---------------------------------------------------------------------

echo "#檢查操作系統(tǒng)Linux遠程連接"

echo "Check if system have remote connection seting"

echo "#-------------------------------------"

find ?/ -name ?.netrc

find ?/ -name ?.rhosts

echo "檢查操作系統(tǒng)Linux用戶umask設置"

echo "Check the system users umask setting"

echo "#-------------------------------------"

for i in /etc/profile /etc/csh.login /etc/csh.cshrc /etc/bashrc

grep -H umask $i|grep -v "#"

done

###################設置umask為027

#7、---------------------------------------------------------------------

#echo "#檢查重要目錄和文件的權限"

##echo "Check the important files and directory rights"

echo "#-------------------------------------"

for i in /etc /etc/rc.d/init.d /tmp /etc/inetd.conf /etc/passwd /etc/shadow /etc/group /etc/security /etc/services /etc/rc*.d

ls ?-ld $i

done

echo -n "Please check if the output is ok ? yes or no :"

read i

case $i in

y|yes)

break

;;

n|no)

echo "Please recheck the output!"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

#8艾疟、-----------------------------------------------------------

#echo "#配置rc.d下腳本的權限"

echo "Configure the scripts right(750) in rc.d directory"

echo "#-------------------------------------"

chmod -R 750 /etc/rc.d/init.d/*

chmod 755 /bin/su 改了之后只能root su来吩，沒有了s位別的用戶無法成功su

chmod 664 /var/log/wtmp

#chattr +a /var/log/messages

#9、-----------------------------------------------------------

echo "#查找系統(tǒng)中存在的SUID和SGID程序"

echo "Find the files have suid or Sgid"

echo "#-------------------------------------"

for PART in `grep -v ^# /etc/fstab | awk '($6 != "0") {print $2 }'`; do

find $PART $ -perm -04000 -o -perm -02000 $ -type f -xdev -print |xargs ls ?-ld

done

echo -n "Please check if the output is ok ? yes or no :"

read i

case $i in

y|yes)

break

;;

n|no)

echo "Please recheck the output!"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

#10蔽莱、----------------------------------------------------------

echo "#查找系統(tǒng)中任何人都有寫權限的目錄"

echo "Find the directory everyone have the write right"

echo "#-------------------------------------"

for PART in `awk '($3 == "ext2" || $3 == "ext3") \

{ print $2 }' /etc/fstab`; do

find $PART -xdev -type d $ -perm -0002 -a ! -perm -1000 $ -print |xargs ls ?-ld

done

echo -n "Please check if the output is ok ? yes or no :"

read i

case $i in

y|yes)

break

;;

n|no)

echo "Please recheck the output!"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

#11误褪、----------------------------------------------------------

#echo "#查找系統(tǒng)中任何人都有寫權限的文件"

echo "Find the files everyone have write right"

echo "#-------------------------------------"

for PART in `grep -v ^# /etc/fstab | awk '($6 != "0") {print $2 }'`; do

find $PART -xdev -type f $ -perm -0002 -a ! -perm -1000 $ -print |xargs ls -ld

done

echo -n "Please check if the output is ok ? yes or no :"

read i

case $i in

y|yes)

break

;;

n|no)

echo "Please recheck the output!"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

#12、----------------------------------------------------------

echo "#查找系統(tǒng)中沒有屬主的文件"

echo "Find no owner or no group files in system"

echo "#-------------------------------------"

for PART in `grep -v ^# /etc/fstab |grep -v swap| awk '($6 != "0") {print $2 }'`; do

find $PART -nouser -o -nogroup |grep ?-v "vmware"|grep -v "dev"|xargs ls ?-ld

done

echo -n "Please check if the output is ok ? yes or no :"

read i

case $i in

y|yes)

break

;;

n|no)

echo "Please recheck the output!"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

#13碾褂、----------------------------------------------------------

###echo "#查找系統(tǒng)中的隱藏文件"

##echo " Find the hiding file in system"

##echo "#-------------------------------------"

###linux執(zhí)行報錯\排除/dev”目錄下的那些文件

####find ?/ -name $".. *" ?-o "…*" ?-o ".xx" -o ".mail" $ -print -xdev

## #find ?/ -name "…*" -print -xdev | cat -v

##find ?/ ?$ -name ".*" ?-o -name ?"…*" ?-o -name ".xx" -o -name ".mail" $ -xdev

##echo -n "If you have check all the output files if correct yes or no ? :"

##read i

## case $i in

## y|yes)

## break

## ;;

## n|no)

## echo "Please recheck the output!"

## echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

## continue

## ;;

## *)

## echo "please input yes or no"

## ;;

## esac

#14兽间、---------------------------------------------------------------------

echo "#判斷日志與審計是否合規(guī)"

echo "Judge if the syslog audition if follow the rules"

echo "#-------------------------------------"

autmesg=`cat /etc/syslog.conf |egrep ^authpriv`

if [ ! -n "$autmesg" ]

then

echo "there don't have authpriv set in /etc/syslog.conf"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

echo -n "If you have know this y or n ?"

read i

case $i in

y|yes)

break

;;

n|no)

echo "there don't have authpriv set in /etc/syslog.conf"

echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"

continue

;;

echo "please input yes or no"

;;

esac

else

# echo "日志與審計合規(guī)"

echo "syslog audition follow the rules"

#15、---------------------------------------------------------------------

echo "#關閉linux core dump"

echo "Turn off the system core dump"

echo "#-------------------------------------"

mesg1=`grep "* soft core 0" /etc/security/limits.conf`

mesg2=`grep "* hard core 0" /etc/security/limits.conf`

if [ ! -n "$mesg1" -o ! -n "$mesg2" ]

then

cp /etc/security/limits.conf /etc/security/limits.conf_$date

if [ ! -n "$mesg1" ]

then

echo "* soft core 0" >> /etc/security/limits.conf

if [ ! -n "$mesg2" ]

then

echo "* hard core 0" >> /etc/security/limits.conf

#修改login文件使limits限制生效

cp /etc/pam.d/login /etc/pam.d/login_$date

echo "session required /lib/security/pam_limits.so" >> /etc/pam.d/login

#16正塌、---------------------------------------------------------------------

#登錄超時設置

#檢查/etc/pam.d/system-auth文件是否存在account required /lib/security/pam_tally.so deny=的相關設置

#建議設置為auth required pam_tally.so onerr=fail deny=6 unlock_time=300

#17嘀略、---------------------------------------------------------------------

#su命令使用,對su命令使用進行限制設置

#檢查/etc/pam.d/su文件設置

#文件中包含

#auth sufficient /lib/security/pam_rootok.so debug

#auth required /lib/security/pam_wheel.so group=isd

#20恤溶、---------------------------------------------------------------------

echo "#登錄超時自動退出"

echo "set session time out terminal "

echo "#-------------------------------------"

tmout=`grep -i TMOUT /etc/profile`

if [ ! -n "$tmout" ]

then

echo

echo -n "do you want to set login timeout to 300s? [yes]:"

read i

case $i in

y|yes)

cp /etc/profile /etc/profile_$date

echo "export TMOUT=300" >> /etc/profile

. /etc/profile

;;

n|no)

break

;;

echo "please input yes or no"

;;

esac

else

mesg=`echo $tmout |awk -F"=" '{print $2}'`

if [ "$mesg" -ne 300 ]

then

echo "The login session timeout is $mesg now will change to 300 seconds"

cp /etc/profile /etc/profile_$date

echo "export TMOUT=300" >> /etc/profile

. /etc/profile

sed ?-i 's/HISTSIZE=1000/HISTSIZE=100/g' /etc/profile

#21、---------------------------------------------------------------------

echo "#禁用telnet啟用ssh"

echo "Stop telnet and start up sshd"

echo "#-------------------------------------"

mesg1=`lsof -i:23`

mesg2=`lsof -i:22`

if [ ! -n "$mesg2" ]

then

service start sshd

chkconfig sshd on

mesg2=`lsof -i:22`

if [ ! -n "$mesg1" -a ! -n "$mesg2" ]

then

echo

echo "Will Deactive telnet"

chkconfig krb5-telnet off

chkconfig ekrb5-telnet off

#22帜羊、---------------------------------------------------------------------

#echo "#設置終端超時咒程，使系統(tǒng)10分鐘后自動退出不活動的Shell"

#echo "#-------------------------------------"

#mesg=`grep "export TMOUT=600" /etc/profile`

#if [ -z $mesg ]

#then

#echo "export TMOUT=600" >>/etc/profile

#. /etc/profile

#fi

#23、---------------------------------------------------------------------

echo "#禁用不必要的服務"

echo "Stop unuseing services"

echo "#-------------------------------------"

list="avahi-daemon bluetooth cups firstboot hplip ip6tables iptables iscsi iscsid isdn kudzu pcscd rhnsd rhsmcertd rpcgssd rpcidmapd sendmail smartd ?yum-updatesd netfs portmap autofs nfslock nfs"

for i in $list

chkconfig $i off

service $i stop

done

echo "change kernel parameter for network secure"

cp ?/etc/sysctl.conf /etc/sysctl.conf.$date

#echo "net.ipv4.icmp_echo_ignore_all = 1">>/etc/sysctl.conf

sysctl -a |grep arp_filter|sed -e 's/\=\ 0/\=\ 1/g' >>/etc/sysctl.conf

sysctl -a |grep accept_redirects|sed -e 's/\=\ 1/\=\ 0/g' >>/etc/sysctl.conf

sysctl -a |grep send_redirects|sed -e 's/\=\ 1/\=\ 0/g' >>/etc/sysctl.conf

sysctl -a |grep log_martians |sed -e 's/\=\ 0/\=\ 1/g'>>/etc/sysctl.conf

sysctl -p

#24讼育、---------------------------------------------------------------------

echo "設置熱鍵"

#ctrl+alt+del

if [ -d ?/etc/init ]

then

sed ?-i 's/^[^#]/#&/g' /etc/control-alt-delete.conf

else

sed -i 's/^ca::/#&/g' /etc/inittab

#25帐姻、---------------------------------------------------------------------

echo "demo:禁止除了db2inst1的用戶su到root"

usermod -G wheel db2inst1

sed -i '/pam_wheel.so use_uid/s/^#//g' /etc/pam.d/su

echo "SU_WHEEL_ONLY yes">>/etc/login.defs

最后編輯于：2017.11.27 05:07:57

?著作權歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者

人面猴
序言：七十年代末，一起剝皮案震驚了整個濱河市奶段，隨后出現(xiàn)的幾起案子饥瓷，更是在濱河造成了極大的恐慌，老刑警劉巖痹籍，帶你破解...
沈念sama閱讀 206,723評論 6贊 481
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件呢铆，死亡現(xiàn)場離奇詭異，居然都是意外死亡蹲缠，警方通過查閱死者的電腦和手機棺克，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 88,485評論 2贊 382
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進店門，熙熙樓的掌柜王于貴愁眉苦臉地迎上來线定，“玉大人娜谊，你說我怎么就攤上這事〗锛ィ” “怎么了纱皆？”我有些...
開封第一講書人閱讀 152,998評論 0贊 344
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵，是天一觀的道長周偎。經(jīng)常有香客問我，道長撑帖，這世上最難降的妖魔是什么蓉坎？我笑而不...
開封第一講書人閱讀 55,323評論 1贊 279
?港島之戀（遺憾婚禮）
正文為了忘掉前任，我火速辦了婚禮胡嘿，結果婚禮上蛉艾，老公的妹妹穿的比我還像新娘。我一直安慰自己衷敌，他們只是感情好勿侯，可當我...
茶點故事閱讀 64,355評論 5贊 374
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布。她就那樣靜靜地躺著缴罗，像睡著了一般助琐。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上面氓，一...
開封第一講書人閱讀 49,079評論 1贊 285
城市分裂傳說
那天兵钮，我揣著相機與錄音蛆橡，去河邊找鬼。笑死掘譬，一個胖子當著我的面吹牛泰演，可吹牛的內(nèi)容都是我干的。我是一名探鬼主播葱轩，決...
沈念sama閱讀 38,389評論 3贊 400
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼睦焕，長吁一口氣：“原來是場噩夢啊……” “哼！你這毒婦竟也來了靴拱？” 一聲冷哼從身側(cè)響起垃喊，我...
開封第一講書人閱讀 37,019評論 0贊 259
萬榮殺人案實錄
序言：老撾萬榮一對情侶失蹤，失蹤者是張志新（化名）和其女友劉穎缭嫡，沒想到半個月后缔御，有當?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
沈念sama閱讀 43,519評論 1贊 300
?護林員之死
正文獨居荒郊野嶺守林人離奇死亡妇蛀，尸身上長有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點故事閱讀 35,971評論 2贊 325
?白月光啟示錄
正文我和宋清朗相戀三年耕突，在試婚紗的時候發(fā)現(xiàn)自己被綠了。大學時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片评架。...
茶點故事閱讀 38,100評論 1贊 333
活死人
序言：一個原本活蹦亂跳的男人離奇死亡眷茁，死狀恐怖，靈堂內(nèi)的尸體忽然破棺而出纵诞，到底是詐尸還是另有隱情上祈，我是刑警寧澤，帶...
沈念sama閱讀 33,738評論 4贊 324
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布浙芙，位于F島的核電站登刺，受9級特大地震影響，放射性物質(zhì)發(fā)生泄漏嗡呼。R本人自食惡果不足惜纸俭，卻給世界環(huán)境...
茶點故事閱讀 39,293評論 3贊 307
男人毒藥：我在死后第九天來索命
文/蒙蒙一、第九天我趴在偏房一處隱蔽的房頂上張望南窗。院中可真熱鬧揍很，春花似錦、人聲如沸万伤。這莊子的主人今日做“春日...
開封第一講書人閱讀 30,289評論 0贊 19
一樁弒父案，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽敌买。三九已至简珠，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間虹钮，已是汗流浹背北救。一陣腳步聲響...
開封第一講書人閱讀 31,517評論 1贊 262
情欲美人皮
我被黑心中介騙來泰國打工荐操，沒想到剛下飛機就差點兒被人妖公主榨干…… 1. 我叫王不留，地道東北人珍策。一個月前我還...
沈念sama閱讀 45,547評論 2贊 354
代替公主和親
正文我出身青樓托启，卻偏偏與公主長得像，于是被迫代替她去往敵國和親攘宙。傳聞我的和親對象是個殘疾皇子屯耸，可洞房花燭夜當晚...
茶點故事閱讀 42,834評論 2贊 345

CentOS系統(tǒng)安全加固常見方法

#1、---------------------------------------------------------------------

#2猜丹、-----------------------------------------------

#3芝加、---------------------------------------------------------------------

#4、-----------------------------------------------

#5藏杖、-----------------------------------------------------------

#6蝌麸、---------------------------------------------------------------------

#7、---------------------------------------------------------------------

#8艾疟、-----------------------------------------------------------

#9、-----------------------------------------------------------

#10蔽莱、----------------------------------------------------------

#11误褪、----------------------------------------------------------

#12、----------------------------------------------------------

#13碾褂、----------------------------------------------------------

#14兽间、---------------------------------------------------------------------

#15、---------------------------------------------------------------------

#16正塌、---------------------------------------------------------------------

#17嘀略、---------------------------------------------------------------------

#20恤溶、---------------------------------------------------------------------

#21、---------------------------------------------------------------------

#22帜羊、---------------------------------------------------------------------

#23、---------------------------------------------------------------------

#24讼育、---------------------------------------------------------------------

#25帐姻、---------------------------------------------------------------------

推薦閱讀更多精彩內(nèi)容