Linux主机安全配置的几个脚本【转载】

vim /etc/login.defs
PASS_MAX_DAYS 90 //口令最大有效天数
PASS_MIN_DAYS 10 //口令最小有效天数
PASS_MIN_LEN 8 //口令最少字符数
PASS_WARN_AGE 5 //口令过期提前警告天数

echo ‘ONLY Authorized users only! All accesses logged‘ > /etc/motd
rm -f /etc/issue
rm -f /etc/issue.net
touch /etc/issue
touch /etc/issue.net

find / -name *.rhosts
touch /.rhosts && chmod 0 /.rhosts

防止IP SPOOF
echo "nospoof on" >>/etc/host.conf

chkconfig bluetooth off
chkconfig firstboot off
chkconfig cups off
chkconfig ip6tables off
chkconfig iptables off
chkconfig isdn off
chkconfig kudzu off
chkconfig sendmail off
chkconfig smartd off
chkconfig autofs off
service vncserver off
service bluetooth stop
service firstboot stop
service cups stop
service ip6tables stop
service iptables stop
service isdn stop
service kudzu stop
service sendmail stop
service smartd stop
service autofs stop
service vncserver stop
锁定不需要的用户
usermod -L adm
usermod -L lp
usermod -L sync
usermod -L shutdown
usermod -L halt
usermod -L news
usermod -L uucp
usermod -L operator
usermod -L ftp
usermod -L rpc
usermod -L rpcuser
usermod -L gopher
usermod -L nscd

删除不需要的组
groupdel lp
groupdel news
groupdel games
groupdel gopher
groupdel uucp

本次必须要保留的用户是：
root、bin、nobody、ntp、ssh、uucp
必须保留的组包括：
root、nobody、ntp、uucp

useradd jboss
passwd jboss
usermod -g jboss -G wheel jboss
vim /etc/pam.d/su
auth required pam_wheel.so use.uid 把这一行的注释去掉，只有wheel组的用户才能su到root
chown -R jboss.jboss /usr/local/jboss-4.2.3.GA

#!/bin/bash
cd /usr/local/jboss-4.2.3.GA/server/default/deploy/
rm -rf bsh-deployer.xml
rm -rf client-deployer-service.xml
rm -rf ear-deployer.xml
rm -rf ejb-deployer.xml
rm -rf http-invoker.sar
rm -rf jboss-bean.deployer
rm -rf jms
rm -rf jsr88-service.xml
rm -rf schedule-manager-service.xml
rm -rf scheduler-service.xml
rm -rf sqlexception-service.xml
rm -rf uuid-key-generator.sar
rm -rf jmx-console.war
rm -rf management
cd /usr/local/jboss-4.2.3.GA/server/default/deploy/jboss-web.deployer/ROOT.war
rm -rf *
exit
隐藏jboss版本信息
vim /usr/local/jboss-4.2.3.GA/server/default/deploy/jboss-web.deployer/server.xml

<Connector port="8080" address="${jboss.bind.address}"
maxThreads="250" maxHttpHeaderSize="8192"
emptySessionPath="true" protocol="HTTP/1.1"
enableLookups="false" redirectPort="8443" acceptCount="100"
connectionTimeout="20000" disableUploadTimeout="true"
server="ESB" />
在这一段最后加上一个server="ESB"/>
vim /usr/local/jboss-4.2.3.GA/server/default/deploy/jboss-web.deployer/conf/web.xml

<init-param>
<param-name>X-Powered-By</param-name>
<param-value>ESB2.0</param-value>
</init-param>
vim /etc/ssh/sshd_config
把PermitRootLogin yes前面的"#"去掉，把"yes"改为"no"
#ClientAliveCountMax 3
把这个前面的"#"去掉，就是超过3分钟闲置，就自动断开session
service sshd restart
sed -i -e ‘s/^LANG=.*/LANG="en_US.UTF-8"/‘ /etc/sysconfig/i18n
source /etc/sysconfig/i18n

vim /etc/hosts.allow
sshd:192.168.0.199,192.168.0.201,192.168.0.121
vim /etc/hosts.deny
sshd:all
service xinetd restart

截短~/.bash_history文件
vim /etc/profile
HISTSIZE=1000改成20

vim /etc/skel/.bash_logout
在/etc/skel/.bash_logout在文件中添加这行
rm -rf $HOME/.bash_history
这样当用户注销时，.bash_history被删除

DenyHosts是用Python2.3写的一个程序，它会分析/var/log/secure（redhat，Fedora Core）等日志文件，当发现同一IP在进行多次SSH密
码尝试时就会记录IP到/etc/hosts.deny文件，从而达到自动屏蔽该IP的目的。
wget http://downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fdenyhosts%2Ffiles%2F&ts=1281580068&mirror=ncu
tar -zxvf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install

cd /usr/share/denyhosts/
grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg
cp daemon-control-dist daemon-control
vim denyhosts.cfg
PURGE_DENY = 5m //5分钟清除
DENY_THRESHOLD_INVALID = 1 //允许无效用户失败的次数
DENY_THRESHOLD_VALID = 5 //允许普通用户登陆失败的次数
DENY_THRESHOLD_ROOT = 5 //允许root登陆失败的次数

chown root daemon-control
chmod 700 daemon-control

vim /etc/rc.local
/usr/share/denyhosts/daemon-control start
vim /etc/audit/audit.rules 最后增加一行，对该目录审计
-w /usr/local/jboss-4.2.3.GA/server/default/deploy -pwa
service auditd restart
查看审计规则 auditctl -l
查看audit运行状态 auditctl -s
审计工具
wget http://www.rootkit.nl/files/lynis-1.2.9.tar.gz
给关键文件加root权限
chmod 744 /etc/passwd
chmod 740 /etc/shadow
chmod 744 /etc/rc3.d
chmod 744 /etc/profile
chmod 1777 /tmp
chmod 644 /etc/exports
chmod -R 700 /etc/rc.d/init.d/*
Control-Alt-Delete 键盘关机命令
vim /etc/inittab
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
这一行前面加#,改成
#ca::ctrlaltdel:/sbin/shutdown -t3 -r now

给文件加锁(暂时不实施)
chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/group
chattr +i /etc/services
chmod 600 /etc/xinetd.conf
当chattr +i时就是禁止对文件进行修改,当我们要添加用户时,就会有麻烦,因为passwd文件禁止修改写入.
所以我们还要该掉它的属性.chattr -i.

脚本如下：
init_sysctl.sh

#!/bin/bash
cp /etc/sysctl.conf /etc/sysctl.conf.bak
echo "####add by hx10###">> /etc/sysctl.conf
echo "net.ipv4.ip_local_port_range = 1024 65536" >> /etc/sysctl.conf
echo "net.core.rmem_max=16777216" >> /etc/sysctl.conf
echo "net.core.wmem_max=16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_rmem=4096 87380 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_wmem=4096 65536 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_fin_timeout = 15" >> /etc/sysctl.conf
echo "net.ipv4.tcp_keepalive_time = 600" >> /etc/sysctl.conf
echo "net.ipv4.tcp_tw_recycle = 1" >> /etc/sysctl.conf
echo "net.core.netdev_max_backlog = 30000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_no_metrics_save=1" >> /etc/sysctl.conf
echo "net.core.somaxconn = 262144" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_orphans = 8000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_syn_backlog = 8000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_synack_retries = 2" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syn_retries = 2" >> /etc/sysctl.conf
sysctl -p
###change max open files
ulimit -SHn 102400
echo "ulimit -SHn 102400" >>/etc/rc.local
ulimit -a
exit

init_system.sh

#!/bin/bash
#change password policy
cp /etc/login.defs /etc/login.defs.bak
sed -i ‘s/^PASS_MAX_DAYS\s*99999/PASS_MAX_DAYS 90/‘ /etc/login.defs
sed -i ‘s/^PASS_MIN_DAYS\s*0/PASS_MIN_DAYS 10/‘ /etc/login.defs
sed -i ‘s/^PASS_MIN_LEN\s*5/PASS_MIN_LEN 8/‘ /etc/login.defs
sed -i ‘s/^PASS_WARN_AGE\s*7/PASS_WARN_AGE 5/‘ /etc/login.defs
#stop Linux detection
echo ‘ONLY Authorized users only! All accesses logged‘ > /etc/motd
cp /etc/issue /etc/issue.bak
cp /etc/issue.net /etc/issue.net.bak
rm -f /etc/issue
rm -f /etc/issue.net
touch /etc/issue
touch /etc/issue.net
#stop rhosts
#find / -name *.rhosts
touch /.rhosts && chmod 0 /.rhosts
#stop ip spoof
cp /etc/host.conf /etc/host.conf.bak
echo "nospoof on" >>/etc/host.conf
#stop service
chkconfig bluetooth off
chkconfig firstboot off
chkconfig cups off
chkconfig ip6tables off
chkconfig iptables off
chkconfig isdn off
chkconfig kudzu off
chkconfig sendmail off
chkconfig smartd off
chkconfig autofs off
chkconfig ntpd off
chkconfig snmpd on
chkconfig portmap on
chkconfig nfs on
#service vncserver off
/etc/init.d/vncserver stop
service bluetooth stop
service firstboot stop
service cups stop
service ip6tables stop
service iptables stop
service isdn stop
service kudzu stop
service sendmail stop
service smartd stop
service autofs stop
service vncserver stop
service ntpd stop
service snmpd restart
service portmap restart
service nfs restart
#lock user unnecessary
usermod -L adm
usermod -L lp
usermod -L sync
usermod -L shutdown
usermod -L halt
usermod -L news
usermod -L uucp
usermod -L operator
usermod -L ftp
usermod -L rpc
usermod -L rpcuser
usermod -L gopher
usermod -L nscd
#add jboss user
useradd jboss && echo "23adjfajskdfja" | passwd --stdin jboss
usermod -g jboss -G wheel jboss
#chown -R jboss.jboss /usr/local/jboss-4.2.3.GA
#change system character
cp /etc/sysconfig/i18n /etc/sysconfig/i18n.bak
cat /dev/null> /etc/sysconfig/i18n
echo ‘LANG="en_US.UTF-8"‘ >/etc/sysconfig/i18n
#echo ‘LANG="zh_CN.GB18030"‘ >/etc/sysconfig/i18n
#sed -i -e ‘s/^LANG=.*/LANG="en_US.UTF-8"/‘ /etc/sysconfig/i18n
source /etc/sysconfig/i18n
#add ssh user
cp /etc/hosts.allow /etc/hosts.allow.bak
cp /etc/hosts.deny /etc/hosts.deny.bak
echo "sshd:192.168.0.199,192.168.0.201,192.168.0.121" >>/etc/hosts.allow
echo "sshd:all" >>/etc/hosts.deny
#Limit ROOT from Remote server
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
echo "ClientAliveCountMax 2" >> /etc/ssh/sshd_config
#clean history
cp /etc/skel/.bash_logout /etc/skel/.bash_logout.bak
cp /etc/profile /etc/profile.bak
sed -i ‘s/^HISTSIZE=1000/HISTSIZE=20/‘ /etc/profile
echo "rm -rf \$HOME/.bash_history " >>/etc/skel/.bash_logout
#install DenyHosts
cd /usr/local/src
wget ftp://192.168.0.21/pub/DenyHosts-2.6.tar.gz
tar -zxvf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
cd /usr/share/denyhosts/
grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg
cp daemon-control-dist daemon-control
cp denyhosts.cfg denyhosts.cfg.bak
sed -i ‘s/^PURGE_DENY =/PURGE_DENY = 5m/‘ /usr/share/denyhosts/denyhosts.cfg
sed -i ‘s/^DENY_THRESHOLD_INVALID = 5/DENY_THRESHOLD_INVALID = 1/‘ /usr/share/denyhosts/denyhosts.cfg
sed -i ‘s/^DENY_THRESHOLD_VALID = 10/DENY_THRESHOLD_VALID = 5/‘ /usr/share/denyhosts/denyhosts.cfg
sed -i ‘s/^DENY_THRESHOLD_ROOT = 1/DENY_THRESHOLD_ROOT = 5/‘ /usr/share/denyhosts/denyhosts.cfg
chown root daemon-control
chmod 700 daemon-control
cp /etc/rc.local /etc/rc.local.bak
echo "/usr/share/denyhosts/daemon-control start" >>/etc/rc.local
/usr/share/denyhosts/daemon-control start
#limit alt-ctl-delete
cp /etc/inittab /etc/inittab.bak
sed -i ‘s/^ca::ctrlaltdel:\/sbin\/shutdown -t3 -r now/\#ca::ctrlaltdel:\/sbin\/shutdown -t3 -r now/g‘ /etc/inittab
#limit key file
chmod 744 /etc/passwd
chmod 740 /etc/shadow
chmod 744 /etc/rc3.d
chmod 744 /etc/profile
chmod 1777 /tmp
chmod 644 /etc/exports
chmod -R 700 /etc/rc.d/init.d/*
chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/group
chattr +i /etc/services
chmod 600 /etc/xinetd.conf
#remove
#chattr -i /etc/passwd
#chattr -i /etc/shadow
service sshd restart
service xinetd restart
ps -ef |grep vnc |grep ‘/usr/share/vnc/classes‘ |awk ‘{print $2}‘ |xargs kill -9
echo "congratulations!"
sleep 2
exit

时间： 2024-10-31 09:44:42

Linux主机安全配置的几个脚本【转载】的相关文章

Linux/Centos Tomcat 配置日志切分以及脚本自动清理

Tomcat是Apache软件基金会(Apache Software Foundation)的Jakarta项目中的一个核心项目,由Apache,Sun和其他一些公司及个人共同开发而成.由于有了Sun的参与和支持,最新的Servlet和JSP规范总是能在Tomcat中得到体现,Tomcat 5支持最新的Servlet 2.4和JSP 2.0规范.因为Tomcat技术先进,性能稳定,而且免费,因而深受Java爱好者的喜爱并得到了部分软件开发商的认可,成为目前比较流行的Web应用服务器. Tomca

全面inux主机安全配置详解--系统OS安全（第一部分）

Linux主机安全配置详解 系统安全分为: 第一部分: BIOS密码,更改合适启动选项(禁止改bios/禁止更改第一启动选项,防止恶意的引导) GRUB密码 系统密码(密码策略) 分区加密 第二部分: 最小权限法(su/sudo) 最小服务法 文件安全(suid/sgid/stick/chattr) pam模块的使用 升级系统和软件 系统安全: BIOS密码(bios/cmos) 调整BIOS引导设置 修改启动顺序,正确做法:第一启选项为磁盘 设置管理密码 禁用Ctrl+Alt+Del重启热键

windows上配置rsync服务器收集linux主机巡检报告

客户这里,有很多linux主机,都是centos7的,我们需要定期每天对linux主机进行巡检,然后把巡检结果集中保存,方便对主机状态检查.为了巡检工作需要,需要在linux主机上编写巡检脚本,配置rsync客户端.. linux巡检脚本 我收集了一个巡检脚本,如下所示: #!bin/bash #主机信息每日巡检 IPADDR=$(ifconfig eth0 | grep '\<inet\>' | awk '{print $2}') #环境变量PATH没设好,在cron里执行时有很多命令会找不

配置Linux主机SSH无密码访问

通过证书签名达到Linux主机SSH无密码访问,使用ssh-keygen与ssh-copy-id来实现快速证书的生成及公钥下发,其中ssh-keygen生成一对密钥,使用ssh-copy-id来下发生成的公钥.具体操作如下: 在主机A(192.168.0.100)创建密钥,执行: ssh-keygen -t rsa ,有询问直接按回车键即可,将在/root/.ssh/下生成一对密钥,其中id_rsz为私钥,id_rsa.pub为公钥(需要下发到B主机用户.ssh目录,同时要求重名成authori

linux笔记之Nginx虚拟主机的配置

1.源码编译安装Nginx.并配置基于端口的虚拟主机 配置要求:主机ip地址为172.16.249.96,要求分别为本机的80端口.8080端口做虚拟主机. 在第一章中已经讲解怎么编译安装Nginx,所有这里就不再演示安装过程了,直接基于已经安装的基础上,配置基于端口的虚拟主机. 步骤一:安装nginx.vim使得使用vim编辑nginx配置文件时有语法高亮(这不是必须的,只是为了方便编辑配置文件). (1)下载nginx.vim(下载页面:http://www.vim.org/scripts/

Linux主机配置网卡桥接之后出现报错

操作系统:CentOS 6.5 ,最小化安装 装完系统之后开始装KVM虚拟机,当所有的环境安装完成时,网卡的配置文件也都完正无误的配置好了,重启网络的时候却出现报错:Bring up interface eth0:Device eth0 does not seem to be present,delaying initialization. 在网上搜了半天终于解决了: 解决方法:    进入目录:/etc/udev/rules.d/    删除文件:70-persistent-net.rules

linux环境下配置虚拟主机域名

linux环境下面配置虚拟主机域名 第一步:在root目录下面(即根目录)ls(查看文件)cd进入etc目录find hosts文件vi hosts 打开hosts文件并进行编辑在打开的文件最下面添加:192.168.8.115 domain.com.cn 第二步:cd /usr/local/apache2/conf/  进入该目录下面ls  查看当前目录下面的所有文件以及目录vi httpd.conf 打开并编辑这个文件编辑:使用键盘上的PgDn将光标拉到最低端,然后添加如下代码: NameV

Linux主机 NFS文件共享服务配置

网络文件系统共享是Linux系统中一种简单的文件共享服务,它的特点是配置简单.易于使用:缺点是没有安全验证机制,安全性比较低. 一般应用在服务器的集群中相互信任的小范围的场景. 步骤一:安装服务 1. 准备网络环境:2台Linux主机,一台为服务器端,另一台为客户端.在服务器端配好yum仓库 2．NFS服务主要依赖于rpcbind.nfs2个服务,这2个服务默认已经安装. 3.查看服务是否启用 [[email protected]桌面]# service rpcbind status rpcbi

linux主机下的Vmware Workstation配置NAT设置 端口映射-Ubuntu为例

最近折腾虚拟机,由于是在linux下进行的,而相关资料比较少,所以遇到了一些问题. 一个就是配置vmware workstation的NAT设置.因为一般来说,NAT可以共享主机的ip,从而能以主机身份访问互联网,不需要单独为虚拟机配置IP了,另外,vmware workstation中的NAT设置里是可以进行端口转发的,所以添加了端口映射后,是很容易通过宿主机的某个端口访问到虚拟机的资源.我觉得是非常实用便捷的.所以配置虚拟机首选NAT方式.我是在linux宿主机上配置一台linux虚拟机.