CentOS5生产环境系统安全加固配置-脚本实例二

#!/bin/bash

echo "updata V1.0 by csc  2014-11-10"

VER="v1.3d"

VERSION="System Security configuration "${VER}", by WuHan Tianyu, 2013-07-19."

echo $VERSION

SET_NTP()

{

#set ntp

echo -e "\n>>>>>  begin to set ntp ..."

ntpstatus=`ps -ef|grep ntp|grep -v grep|wc -l`

if [ $ntpstatus != 0 ];then

grep "^server" /etc/ntp.conf|grep -v "127.127.1.0";

echo "ntpserver No. is "`grep "^server" /etc/ntp.conf|grep -v "127.127.1.0"|wc -l`;

else

crontab -l|grep -v "^#"|grep ntp > /dev/null

if test $? -eq 0;then

crontab -l|grep -v "^#"|grep ntp

echo "ntpserver No. is "`crontab -l|grep -v "^#"|grep ntp|wc -l`;

else

echo "0 12 * * * ntpdate 127.0.0.1" >> /var/spool/cron/root

crontab -l|grep -v "^#"|grep ntp

echo "ntpserver No. is "`crontab -l|grep -v "^#"|grep ntp|wc -l`;

fi

fi

}

SET_TIMEOUT_LOGOUT()

{

#system timeout auto logout

echo -e "\n>>>>>  begin to set system timeout auto logout ..."

cat /etc/profile |grep -v ^\#|grep .|grep -i tmout >> /dev/null

if test $? -ne 0;then

echo "export TMOUT=180" >> /etc/profile

else

sed -i "s/.*TMOUT.*/TMOUT=180/" /etc/profile

fi

echo "your system will auto logout at 180s"

}

SET_IDLE_LOGOUT()

{

#system idle auto logout

echo -e "\n>>>>>  begin to set system idle auto logout ..."

cat /etc/csh.cshrc |grep -v ^\#|grep .|grep -i autologout >> /dev/null

if test $? -ne 0;then

echo "set autologout=30" >> /etc/csh.cshrc

fi

echo "your system will auto logout at idle "`cat /etc/csh.cshrc |grep -v ^\#|grep .|grep -i autologout|awk -F= ‘{printf $2}‘`"m"

}

SET_ICMP_REDIRECTS()

{

#disable icmp redirects

echo -e "\n>>>>>  begin to set disable icmp redirects ..."

n=`sysctl -a|grep net.ipv4.conf.all.accept_redirects|sed ‘s/\(.*\)\(.\)$/\2/‘`

if [ $n != 0 ];then

echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf

fi

sysctl -p > /dev/null

echo "icmp redirects disabled"

}

SET_LOGON_BANNER()

{

#set logon banner

echo -e "\n>>>>>  begin to set disable logon banner ..."

if [ ! -s /etc/motd ];then

echo "This is TianYu‘s Server!" >> /etc/motd

fi

echo -e "system logon banner is:\n--------\n"`cat /etc/motd`"\n--------"

}

SET_SSH_BANNER()

{

#set ssh logon banner

echo -e "\n>>>>>  begin to set ssh logon banner ..."

BANNER="Welcome -- set_secure "${VER}

SSHBANNER=`grep -v ^\# /etc/ssh/sshd_config|grep -i banner`

if [ $? -eq 1 ];then

echo "Banner /etc/sshbanner" >> /etc/ssh/sshd_config

fi

echo $BANNER > /etc/sshbanner

chmod 644 /etc/sshbanner

echo -e "system ssh banner is:\n--------\n"`cat /etc/sshbanner`"\n--------"

}

SET_SELINUX_DISABLE()

{

#disable selinux

echo -e "\n>>>>>  begin to set disable selinux ..."

grep SELINUX=disabled /etc/selinux/config >/dev/null

if test $? -ne 0 ;then

sed -i -e "s/SELINUX=.*/SELINUX=disabled/g"  /etc/selinux/config

fi

setenforce 0 2> /dev/null

echo "SELINUX is disabled"

}

SET_TIMEMASK_HISTORY()

{

#time mark for history

echo -e "\n>>>>>  begin to set time mark for history ..."

grep -i histtimeformat /etc/profile > /dev/null

if [[ $? == 1 ]];then

echo "export HISTTIMEFORMAT=\"%F %T \"" >> /etc/profile

fi

echo "history is marked by time"

}

SET_UMASK()

{

#set all user‘s umask

echo -e "\n>>>>>  begin to set user‘s umask ..."

grep -v ^\# /etc/profile|grep -i ^umask > /dev/null

if test $? -eq 1;then

echo "umask 027" >> /etc/profile

else

sed -i "s/^umask.*/umask 027/" /etc/profile

fi

echo "set user‘s umask eq 027"

}

SET_SYS_CORE_DUMP()

{

#set system core dump

echo -e "\n>>>>>  begin to set system core dump ..."

cat /etc/security/limits.conf|grep -v ^\#|grep .|grep -e "soft.*core"

if test $? -eq 1;then

echo "* soft core 0" >> /etc/security/limits.conf

else

sed -i "s/[^\#].*soft.*core.*/\* soft core 0/" /etc/security/limits.conf

fi

cat /etc/security/limits.conf|grep -v ^\#|grep .|grep -e "hard.*core"

if test $? -eq 1;then

echo "* hard core 0" >> /etc/security/limits.conf

else

sed -i "s/.*hard.*core.*/\* hard core 0/" /etc/security/limits.conf

fi

echo "set system core dump done"

}

#旧密码不能使用 5次之内

SET_OLD_PASSWD_SAVE()

{

#set old passwd save

echo -e "\n>>>>>  begin to set old passwd save ..."

grep -v ^\# /etc/pam.d/system-auth|grep "password.*pam_unix.so.*remember.*" > /dev/null

if test $? -eq 1;then

touch /etc/security/opasswd

chown root:root /etc/security/opasswd

chmod 600 /etc/security/opasswd

sed -i "s/password.*pam_unix.so.*/password\tsufficient\tpam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5/" /etc/pam.d/system-auth

fi

echo "the old passwd will save in /etc/security/opasswd"

}

SET_PASSWD_STRENGTH()

{

#set passwd strength

echo -e "\n>>>>>  begin to set passwd strength ..."

grep -v ^\# /etc/pam.d/system-auth|grep "password.*pam_cracklib.so.*" > /dev/null

if test $? -eq 0;then

sed -i "s/password.*pam_cracklib.so.*/password\trequisite\tpam_cracklib.so minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 minclass=2/g" /etc/pam.d/system-auth

else

echo "set passwd strength failed"

exit 1

fi

echo "set passwd strength success"

}

SET_DEL_USER()

{

#delete unused users

echo -e "\n>>>>>  begin to delete unused users ..."

userdel adm

userdel lp

userdel sync

userdel shutdown

userdel halt

userdel news

userdel uucp

userdel operator

userdel gopher

userdel games

userdel smmsp

groupdel adm

groupdel lp

groupdel news

groupdel uucp

groupdel dip

}

SET_DEL_SERVICE()

{

#delete unused services

echo -e "\n>>>>>  begin to delete unused services ..."

chkconfig chargen-dgram off

chkconfig chargen-stream off

chkconfig daytime-dgram off

chkconfig daytime-stream off

chkconfig echo-dgram off

chkconfig echo-stream off

chkconfig eklogin off

chkconfig ekrb5-telnet off

chkconfig gssftp off

chkconfig klogin off

chkconfig krb5-telnet off

chkconfig kshell off

chkconfig rsync off

chkconfig tcpmux-server off

chkconfig tftp off

chkconfig time-dgram off

chkconfig time-stream off

chkconfig postfix off

chkconfig rsyncd off

chkconfig rlogin off

chkconfig rsh off

chkconfig rexec  off

chkconfig snmpd off

chkconfig sendmail off

chkconfig telnet off

chkconfig smartd off

chkconfig cups off

chkconfig cups-config-daemon off

}

SET_PASSWD_VALIDITY()

{

echo -e "\n>>>>>  begin to set passwork validity ..."

sed -i "s/PASS_MAX_DAYS.*[0-9]/PASS_MAX_DAYS\t90/g" /etc/login.defs

sed -i "s/PASS_MIN_DAYS.*[0-9]/PASS_MIN_DAYS\t6/g" /etc/login.defs

sed -i "s/PASS_MIN_LEN.*[0-9]/PASS_MIN_LEN\t6/g" /etc/login.defs

sed -i "s/PASS_WARN_AGE.*[0-9]/PASS_WARN_AGE\t30/g" /etc/login.defs

echo "your password will expired erery 90 days"

}

#登入失败5次后，锁定10秒

SET_SYSTEM_AUTOLOCK()

{

#system will lock after input bad passwd 6 time

echo -e "\n>>>>>  begin to set system autolock ..."

grep -v ^\# /etc/pam.d/system-auth|grep "auth.*pam_tally2.so.*" > /dev/null

if test $? -eq 0;then

sed -i "s/auth.*pam_tally2.so.*/auth\trequired\tpam_tally2.so deny=5  unlock_time=300 even_deny_root root_unlock_time=10/g" /etc/pam.d/system-auth

else

n=`cat -n /etc/pam.d/system-auth|grep "auth.*pam_unix.so"|awk ‘{print $1}‘`

sed -i "${n:=5}i\auth\trequired\tpam_tally2.so deny=5  unlock_time=300 even_deny_root root_unlock_time=10" /etc/pam.d/system-auth

fi

echo "system will lock after input bad passwd 5 times"

}

SET_SYSTEM_LOGFILE()

{

echo -e "\n>>>>>  begin to set system log file ..."

#set system save users action

touch /var/log/pacct

accton /var/log/pacct

echo "system will save users‘s action , you can use command ‘lastcomm [user name] -f /var/log/pacct‘ to see it"

#设备应配置日志功能，记录对与设备相关的安全事件

grep -v ^\# /etc/syslog.conf|grep "/var/adm/message" > /dev/null

if test $? -eq 0;then

sed -i "s#.*/var/adm/message.*#*.err;kern.debug;daemon.notice;\t/var/adm/message#" /etc/syslog.conf

else

echo -e "*.err;kern.debug;daemon.notice;\t/var/adm/message" >> /etc/syslog.conf

fi

echo "system will save security events in /var/adm/message"

#设备应配置日志功能，记录用户使用SU命令的情况，记录不良的尝试记录

touch /var/log/secure

grep -v ^\# /etc/syslog.conf|grep "/var/log/secure" > /dev/null

if test $? -eq 0;then

sed -i "s#.*/var/log/secure.*#authpriv.*\t/var/log/secure#" /etc/syslog.conf

else

echo -e "authpriv.*\t/var/log/secure" >> /etc/syslog.conf

fi

echo "system will save normal user‘s SU action in /var/log/secure"

service syslog restart > /dev/null

}

SET_PERMIT_ROOTLOGIN()

{

echo -e "\n>>>>>  begin to set permit root login ..."

#set allow root login

sed -i "s#PermitRootLogin\s*[y n Y N].*#PermitRootLogin yes#" /etc/ssh/sshd_config

echo "system will permit root login"

}

##############################################################################

USER=`whoami`

if [ $USER != root ]; then

echo "Must be root to run this script, please login as root and re-try!"

exit

fi

# see if configuration is already being applied

if [ -f "/etc/set_secure.conf" ]; then

echo "************************************************************************************************"

LAST_SET=`tail -n 1 /etc/set_secure.conf`

echo "LAST SETTING: "${LAST_SET}

echo "************************************************************************************************"

echo -n "System Security configuration has already been applied, do you want to set again?(Y/N)"

read RET_SURE

if [ "$RET_SURE" != "Y" ] && [ "$RET_SURE" != "y" ]; then

echo "Abort Setting!"

exit;

fi

else

if [ "$1" != "yes" ]; then

echo -n "Starting to system security setting, are you sure?(Y/N)"

read RET_SURE

if [ "$RET_SURE" != "Y" ] && [ "$RET_SURE" != "y" ]; then

echo "Abort Setting!"

exit;

fi

fi

fi

###################  Beging to security setting ###################

SET_NTP

SET_TIMEOUT_LOGOUT

SET_IDLE_LOGOUT

SET_ICMP_REDIRECTS

SET_LOGON_BANNER

SET_SSH_BANNER

SET_PERMIT_ROOTLOGIN

SET_SELINUX_DISABLE

SET_TIMEMASK_HISTORY

SET_UMASK

SET_SYS_CORE_DUMP

SET_OLD_PASSWD_SAVE

SET_PASSWD_STRENGTH

SET_DEL_USER

SET_DEL_SERVICE

SET_PASSWD_VALIDITY

SET_SYSTEM_AUTOLOCK

SET_SYSTEM_LOGFILE

###################  End security setting ###################

echo -e "\n>>>>>  restart sshd ..."

service sshd restart

NOW_TIME=`date +%Y%m%d-%H:%M.%S`

echo $NOW_TIME"  "$VERSION >> /etc/set_secure.conf

echo ""

echo "**********************************************"

echo "              All Finished!"

echo "**********************************************"

时间： 2024-10-29 09:16:45

CentOS5生产环境系统安全加固配置-脚本实例二的相关文章

生产环境Linux二进制安装配置MySQL

生产环境Linux二进制安装配置MySQL 一.环境检查rpm -qa |grep libaio #如果没有安装libaio则需要安装.df -hmount /dev/sr0 /mnt二.安装过程1)上传安装程序通过FTP/SFTP上传安装包2)创建创用户,组,创建目录groupadd mysqluseradd -r -g mysql -s /bin/false mysqlmkdir -p /mysql/data/3306/data这里的3306是MySQL默认端口号,/mysql/data目录

Kubernetes二进制方式v1.13.2生产环境的安装与配置（HTTPS+RBAC） ?

Kubernetes二进制方式v1.13.2生产环境的安装与配置(HTTPS+RBAC) 一 背景 由于众所周知的原因,在国内无法直接访问Google的服务.二进制包由于其下载方便.灵活定制而深受广大kubernetes使用者喜爱,成为企业部署生产环境比较流行的方式之一,Kubernetes v1.13.2是目前的最新版本.安装部署过程可能比较复杂.繁琐,因此在安装过程中尽可能将操作步骤脚本话.文中涉及到的脚本已经通过本人测试. 二 环境及架构图 2.1 软件环境 OS(最小化安装版): cat

spring boot--日志、开发和生产环境切换、自定义配置

Spring Boot日志常用配置: # 日志输出的地址:Spring Boot默认并没有进行文件输出,只在控制台中进行了打印 logging.file=/home/zhou # 日志级别 debug-> info -> warning -> error # 默认级别为 info # 如果设置了debug=true的时候,日志级别会自动降低为debug # ROOT代表默认全局设置 logging.level.ROOT=INFO # 可以设置指定包的输出级别,这样的话,指定的包,级别以下

linux生产环境精华优化实战配置（亲测）

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 编写人:陈飞 邮箱:[email protected] +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CentOS系统安装之后并不能立即投入生产环境使用,往往需要先经过我们运维人员的优化才行.在此讲解几

生产环境中tomcat的配置

生产环境中要以daemon方式运行tomcat 通常在开发环境中,我们使用$CATALINA_HOME/bin/startup.sh来启动tomcat, 使用$CATALINA_HOME/bin/shutdown.sh来关闭tomcat. 而在生产环境中,我们要配置tomcat使其以daemon方式运行,这是因为: 以daemon运行不受终端影响,不会因为退出终端而停止运行 可以让tomcat以普通用户身份运行,可以让tomcat随linux启动而启动 如何将tomcat配置成守护进程 将tom

生产环境搭建ftp并配置虚拟用户

虚拟用户的特点是只能访问服务器为其提供的FTP服务,而不能访问系统的其它资源.所以,如果想让用户对FTP服务器站内具有写权限,但又不允许访问系统其它资源,可以使用虚拟用户来提高系统的安全性.在VSFTP中,认证这些虚拟用户使用的是单独的口令库文件(pam_userdb),由可插入认证模块(PAM)认证. 虚拟用户并非系统上的用户,但它必须映射到系统上的某个用户,虚用户的家目录属主和属组就这系统上的这个用户.并且每个虚用户有自己的用户名和密码,每个虚用户也可以单独设定对家目录的访问权限.使用文件的

[No0000105]java sdk 开发环境变量powershell 自动配置脚本

# 设置Java SDK 环境变量 $softwares = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* #$jdk = $softwares | Where-Object DisplayName -Match 'Java SE Development Kit' #$RegPath = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr

MySQL5.5.32生产环境大内存优化配置实例

[client] port    = 3306 socket    = /tmp/mysql.sock default-character-set = utf8 #设置客户端的字符编码 [mysqld] # generic configuration options port    = 3306 socket    = /tmp/mysql.sock #*** char set *** character-set-server = utf8 #设置服务器端的字符编码              #

Python 生产环境Mysql数据库增量备份脚本

Mysql数据库常用的办法是通过mysqldump导出sql进行备份,但是不适合数据量很大的数据库,速度,锁表是两个严重的问题.前面写了一遍blog介绍xtrabackup的热备工具.下面的脚本是基于xtrabackup实现自动备份数据库的功能. 需求描述: 每天晚上23点,对数据库进行一次完整备份.第二天0-22点,每小时进行一次增量备份.每次备份前把上次的完整备份和23次增量备份移动到指定目录里,保留7天的数据. ps:不要问我,为什么是23点执行完整备份,0点不更好处理吗?bingo,这是