linux一开始是有很多安装一隐患的
所以要进行基线加固。
本人自己写的基线加固脚本
#!/bin/bash
cp /etc/login.defs /etc/login.defs.bak
cp /etc/security/limits.conf /etc/security/limits.conf.bak
cp /etc/pam.d/su /etc/pam.d/su.bak
cp /etc/profile /etc/profile.bak
cp /etc/issue.net /etc/issue.net.bak
cp /etc/shadow /etc/shadow.bak
cp /etc/passwd /etc/passwd.bak
cp /etc/pam.d/passwd /etc/pam.d/passwd.bak
cp /etc/pam.d/common-password /etc/pam.d/common-password.bak
cp /etc/host.conf /etc/host.conf.bak
cp /etc/hosts.allow /etc/hosts.allow.bak
cp /etc/ntp.conf /etc/ntp.conf.bak
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak
echo "============备份完成=================="
a=`cat -n /etc/login.defs | grep PASS_MIN_DAYS | grep -v of | awk '{print $1}'`
sed -i ''$a' s/0/6/g' /etc/login.defs
echo "检查口令更改最小间隔天数完成"
b=`cat -n /etc/login.defs | grep PASS_WARN_AGE | grep -v of | awk '{print $1}'`
sed -i ''$b' s/7/30/g' /etc/login.defs
echo "检查口令过期前警告天数完成"
c=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $1}'`
d=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $5}'`
sed -i ''$c' s/$d/0/g' /etc/security/limits.conf
echo "设置* hard core 0完成"
e=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $1}'`
f=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $5}'`
sed -i ''$e' s/'$f'/0/g' /etc/security/limits.conf
echo "设置* soft core 0完成"
echo "HISTFILESIZE=5" >> /etc/profile
echo " 检查保留历史命令的记录文件大小完成"
echo "HISTSIZE=5" >> /etc/profile
echo "检查保留历史命令的条数完成"
if [ -f /etc/issue.net ]
then
mv /etc/issue.net /etc/issue.net.bak
else
echo "issue.net 文件不存在"
fi
if [ -f /etc/issue ]
then
mv /etc/issue /etc/issue.bak
else
echo "issue 文件不存在"
fi
snu=`cat /etc/host.conf | awk '{print $2}'`
if [ "$snu" = "on" ]; then
echo "没有关闭ip伪装"
fi
sed -i 's/on/off/g' /etc/host.conf
echo " 关闭IP伪装完成"
find /usr/bin/chage /usr/bin/gpasswd /usr/bin/wall /usr/bin/chfn /usr/bin/chsh /usr/bin/newgrp /usr/bin/write /usr/sbin/usernetctl /usr/sbin/traceroute /bin/mount /bin/umount /bin/ping /sbin/netreport -type f -perm +6000 2>/dev/null >file.txt
if [ -s file.txt ]; then
echo " find。。这条命令有输出"
for i in `cat file.txt`
do
chmod 755 $i
done
else
echo "find 。。这条命令没有输出"
fi
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak
echo "/etc/sysctl.conf 备份完成"
sysctl -w net.ipv4.conf.all.accept_source_route="0"
h=`cat -n /etc/login.defs | grep PASS_MAX_DAYS | grep -v of | awk '{print $1}'`
sed -i ''$h' s/99999/90/g' /etc/login.defs
echo "口令生存周期设置完成"
sed -i 's/PASS_MIN_LEN/PASS_MIN_LEN 6/g' /etc/login.defs
echo "口令最小长度设置完成"
chmod 644 /etc/group
chmod 400 /etc/shadow
chmod 644 /etc/services
chmod 600 /etc/security
chmod 644 /etc/passwd
echo "文件权限设置完成"
