linux一開始是有很多安裝一隱患的
所以要進行基線加固苦丁。
本人自己寫的基線加固腳本
#!/bin/bash
cp /etc/login.defs /etc/login.defs.bak
cp /etc/security/limits.conf /etc/security/limits.conf.bak
cp /etc/pam.d/su? /etc/pam.d/su.bak
cp /etc/profile /etc/profile.bak
cp /etc/issue.net /etc/issue.net.bak
cp /etc/shadow /etc/shadow.bak
cp /etc/passwd /etc/passwd.bak
cp /etc/pam.d/passwd? /etc/pam.d/passwd.bak
cp /etc/pam.d/common-password /etc/pam.d/common-password.bak
cp /etc/host.conf /etc/host.conf.bak
cp /etc/hosts.allow /etc/hosts.allow.bak
cp /etc/ntp.conf /etc/ntp.conf.bak
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak
echo "============備份完成=================="
a=`cat -n /etc/login.defs | grep PASS_MIN_DAYS | grep -v of | awk '{print $1}'`
sed -i ''$a' s/0/6/g' /etc/login.defs
echo "檢查口令更改最小間隔天數(shù)完成"
b=`cat -n /etc/login.defs | grep PASS_WARN_AGE | grep -v of | awk '{print $1}'`
sed -i ''$b' s/7/30/g' /etc/login.defs
echo "檢查口令過期前警告天數(shù)完成"
c=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $1}'`
d=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $5}'`
sed -i ''$c' s/$d/0/g' /etc/security/limits.conf
echo "設置* hard core 0完成"
e=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $1}'`
f=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $5}'`
sed -i ''$e' s/'$f'/0/g' /etc/security/limits.conf
echo "設置* soft core 0完成"
echo "HISTFILESIZE=5" >> /etc/profile
echo "? 檢查保留歷史命令的記錄文件大小完成"
echo "HISTSIZE=5" >> /etc/profile
echo "檢查保留歷史命令的條數(shù)完成"
if [ -f /etc/issue.net ]
then
mv /etc/issue.net /etc/issue.net.bak
else
echo "issue.net 文件不存在"
fi
if [ -f /etc/issue ]
then
mv /etc/issue /etc/issue.bak
else
echo "issue 文件不存在"
fi
snu=`cat /etc/host.conf | awk '{print $2}'`
if [ "$snu" = "on" ]; then
echo "沒有關閉ip偽裝"
fi
sed -i 's/on/off/g' /etc/host.conf
echo "? 關閉IP偽裝完成"
find /usr/bin/chage /usr/bin/gpasswd /usr/bin/wall /usr/bin/chfn /usr/bin/chsh /usr/bin/newgrp /usr/bin/write /usr/sbin/usernetctl /usr/sbin/traceroute /bin/mount /bin/umount /bin/ping /sbin/netreport -type f -perm +6000 2>/dev/null >file.txt
if [ -s file.txt ]; then
echo " find歹啼。座菠。這條命令有輸出"
for i in `cat file.txt`
do
chmod 755 $i
done
else
echo "find 。浴滴。這條命令沒有輸出"
fi
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak
echo "/etc/sysctl.conf 備份完成"
sysctl -w net.ipv4.conf.all.accept_source_route="0"
h=`cat -n /etc/login.defs | grep PASS_MAX_DAYS | grep -v of | awk '{print $1}'`
sed -i ''$h' s/99999/90/g' /etc/login.defs
echo "口令生存周期設置完成"
sed -i 's/PASS_MIN_LEN/PASS_MIN_LEN? 6/g' /etc/login.defs
echo "口令最小長度設置完成"
chmod 644 /etc/group
chmod 400 /etc/shadow
chmod 644 /etc/services
chmod 600 /etc/security
chmod 644 /etc/passwd
echo "文件權限設置完成"
