Linux安全

实验环境：

• server:192.168.139.100 client:192.168.139.101

建立一个私有CA，为用户颁发证书

1、建立CA(server)
[root@CA CA]# cd /etc/pki/CA/
[root@CA CA]# (umask 077;openssl genrsa -out private/cakey.pem 4096)    #CA的私钥
[root@CA CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650  #CA证书
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GD
Locality Name (eg, city) [Default City]:GZ
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:IT      
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:
[root@CA CA]# touch index.txt       #存放颁发的证书
[root@CA CA]# echo 01 > serial      #颁发证书的编号

2、申请证书(client)
[root@client CA]# cd /etc/pki/CA/
[root@client CA]# (umask 066;openssl genrsa -out app.key 1024)          #私钥
[root@client CA]# openssl req -new -key app.key -out app.csr            #用私钥生成申请证书文件
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GD
Locality Name (eg, city) [Default City]:GZ
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:centos    
An optional company name []:
[root@client CA]# scp app.csr 192.168.139.100:/data

3、颁发CA(server)
[root@CA CA]# openssl ca -in /data/app.csr -out /etc/pki/CA/certs/app.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Mar  9 13:39:34 2020 GMT
            Not After : Mar  9 13:39:34 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = GD
            organizationName          = magedu
            organizationalUnitName    = IT
            commonName                = ca.magedu.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                7C:29:7D:9C:D1:0C:2B:D6:BF:47:7B:00:55:49:9C:F6:B3:B5:D5:54
            X509v3 Authority Key Identifier: 
                keyid:C9:BE:A0:61:55:C8:49:0B:D3:AC:95:4F:6B:5F:76:92:6B:D9:88:78

Certificate is to be certified until Mar  9 13:39:34 2021 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@CA CA]# tree
.
├── cacert.pem                  #CA证书
├── certs
│   └── app.crt                 #申请的证书
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 01.pem                  #颁发的证书
├── private
│   └── cakey.pem
├── serial
└── serial.old

4 directories, 9 files
[root@CA CA]# openssl x509 -in cacert.pem -noout -text      #查看CA证书文件

吊销证书

#server
openssl ca -revoke newcerts/01.pem      #吊销证书
echo 01 > crlnumber                     #吊销证书编号
openssl ca -gencrl -out crl.pem         #吊销列表

基于KEY的ssh验证

#client生成密钥对
[root@client ~]# ssh-keygen                     #生成密钥对
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:CYVWLR30rWBxUtMmvKPpisRkPjwcQMXs0E1ZfsvsTrI root@client
The key's randomart image is:
+---[RSA 2048]----+
|    .=.=+**++.   |
|   .. *.+.o=ooo  |
|    .+.  .+ o+.  |
|     ... o =oo   |
|      + S  o=.   |
|     B .  o.     |
|      O  .. o    |
|     . +  .=     |
|      . ..E .    |
+----[SHA256]-----+
[root@client ~]# ssh-copy-id root@192.168.139.100       #把公钥传给服务器
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.139.100's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.139.100'"
and check to make sure that only the key(s) you wanted were added.
[root@client ~]# ssh root@192.168.139.100
Enter passphrase for key '/root/.ssh/id_rsa': 
Last failed login: Mon Mar  9 22:33:37 CST 2020 from 192.168.139.107 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Mon Mar  9 21:14:46 2020 from 192.168.139.1
[root@CA ~]# 

基于KEY的ssh验证脚本

#!/bin/bash
PASS=centos
if [ ! -f /root/.ssh/id_rsa ];then
    ssh-keygen -t rsa -P "" -f /root/.ssh/id_rsa &> /dev/null && echo "ssh-key is created"
fi  
rpm -q expect &> /dev/null || yum install -y expect &> /dev/null
while read IP;do
expect <<EOF
set timeout 10
spawn ssh-copy-id -f -i /root/.ssh/id_rsa.pub root@$IP
expect {
    "yes/no" { send "yes\n";exp_continue}
    "password" { send "$PASS\n" }
}
EOF
echo $IP is ready
done < hosts.txt

rsync同步

#第一次全备份，第二次仅备份修改过的文件，注意拷贝文件最后需要加"/"，不加"/"表示复制目录下的文件
[root@SRV-1 ~]# rsync -av /etc/ 192.168.139.101:/root/etc_srv-1
#测试
[root@SRV-1 ~]# touch /etc/passwd                   #改变passwd文件的时间戳
[root@SRV-1 ~]# rsync -av /etc/ 192.168.139.101:/root/etc_srv-1
sending incremental file list
passwd

sent 84,978 bytes  received 829 bytes  19,068.22 bytes/sec
total size is 31,884,689  speedup is 371.59

pssh轻量化管理

# 需要输密码
[root@Client ~]# pssh -H "root@192.168.139.100" -A hostname
Warning: do not enter your password if anyone else has superuser
privileges or access to your account.
Password: 
[1] 15:53:43 [SUCCESS] root@192.168.139.100

#基于key验证
[root@Client ~]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:WgjO36Y/U6o2LgDyVWdrW8vTupK0gFkPUzTMxz6v+ww root@Client
The key's randomart image is:
+---[RSA 2048]----+
|       +o.       |
|      . *.o      |
|    .. + +       |
|o  o..+.o +      |
|.o .o+.=S+ =     |
|  o o..++ = o    |
|   .  ooo=E+     |
|    . ooB oo     |
|     +++.+o+o    |
+----[SHA256]-----+
[root@Client ~]# ssh-copy-id root@192.168.139.100
[root@Client ~]# pssh -h "/data/script/hosts.txt" -i hostname       #hosts.txt批量IP

#批量修改selinux策略
[root@Client ~]# pssh -h "/data/script/hosts.txt" -i "sed -i 's#SELINUX=enforcing#SELINUX=disabled#' /etc/sysconfig/selinux"
#输出结果重定向到指定目录
[root@Client ~]# pssh -h "/data/script/hosts.txt" -i -o /data/ hostname
# pscp复制本机文件到远程主机
[root@Client ~]# pscp.pssh -h host.txt /data/script/ssh-key.sh /data/
[root@Client ~]# pscp.pssh -h host.txt -r /data/script/ /data/
# pslurp复制远程主机文件到本机
pslurp -h host.txt -L /data /etc/passwd user    #远程主机的/etc/passwd复制到本机/data并改名为user

ssh 端口转发

环境：3台主机 
A：client 192.168.139.101
B：server 192.168.139.100
C: telnet-server 192.168.139.108

1、本地转发
  #A与C不能直接通讯，而A与B、B与C能通讯，实现A能telnet到C
    #C主机
    #centos6
    yum install telnet-server telnet -y
    vim /etc/xinetd.d/telnet
        disable = no
    service xinetd start
    iptables -A INPUT -s 192.168.1.101 -j REJECT
    
    #A主机
    #开启转发前
    [root@Client ~]# telnet 192.168.139.108
    Trying 192.168.139.108...
    telnet: connect to address 192.168.139.108: Connection refused
    #开启转发，利用B主机做跳板机
    [root@Client ~]# ssh -L 9527:192.168.139.108:23 192.168.139.100 -fN
    [root@Client ~]# ss -nt
    State       Recv-Q Send-Q                  Local Address:Port                                 Peer Address:Port              
    ESTAB       0      52                    192.168.139.101:22                                  192.168.139.1:52206              
    ESTAB       0      0                     192.168.139.101:36542                             192.168.139.100:22
    [root@Client ~]# telnet 127.0.0.1 9527
    Trying 127.0.0.1...
    Connected to 127.0.0.1.
    Escape character is '^]'.
    CentOS release 6.10 (Final)
    Kernel 2.6.32-754.el6.x86_64 on an x86_64
    centos6.localdomain login: liangjc
    Password: 
    Last login: Wed Mar 11 17:17:24 from 192.168.139.107
    [liangjc@centos6 ~]$ 
    
2、远程转发  
  #A与C不能直接通讯，而A与B、B与C能通讯，实现C能telnet到A
    
    #A主机
    yum install telnet-server telnet -y
    systemctl start telnet.scoket
    iptables -A INPUT -s 192.168.139.108 -j REJECT
    
    #B主机
    [root@SRV-1 ~]# ssh -R 9527:192.168.139.101:23 192.168.139.108 -fN
    [root@SRV-1 ~]# ss -nt
    State       Recv-Q Send-Q                  Local Address:Port                                 Peer Address:Port              
    ESTAB       0      0                     192.168.139.100:22                                  192.168.139.1:52187              
    ESTAB       0      0                     192.168.139.100:34156                             192.168.139.108:22 
    
    #C主机
    iptables -D INPUT -s 192.168.1.101 -j REJECT
    #开启转发前
    [root@centos6 ~]$ telnet 192.168.139.101
    Trying 192.168.139.101...
    telnet: connect to address 192.168.139.101: Connection refused
    [root@centos6 ~]$ telnet 127.0.0.1 9527
    Trying 127.0.0.1...
    Connected to 127.0.0.1.
    Escape character is '^]'.
    
    Kernel 3.10.0-957.el7.x86_64 on an x86_64
    񂫩ent login: LiangJC
    Password: 
    Last login: Tue Mar 10 17:55:45 from ::ffff:192.168.139.108
    [LiangJC@Client ~]$
    
3、动态转发
    #仅需要A、B共2台机器
    #B服务什么都不用配
    #A上操作
    [root@Client ~]# ssh -fND 9527 root@192.168.139.100
    [root@Client ~]# ss -nt
    State       Recv-Q Send-Q                  Local Address:Port                                 Peer Address:Port              
    ESTAB       0      52                    192.168.139.107:22                                  192.168.139.1:52206              
    ESTAB       0      0                     192.168.139.107:36548                             192.168.139.100:22
    [root@Client ~]# curl --socks5 127.0.0.1:9527 google.com
    <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
    <TITLE>301 Moved</TITLE></HEAD><BODY>
    <H1>301 Moved</H1>
    The document has moved
    <A HREF="http://www.google.com/">here</A>.
    </BODY></HTML>
    [root@Client ~]#
    
killall ssh         #关闭所有隧道连接   

sshd服务器优化安全配置

vim /etc/ssh/sshd_config
#修改默认端口
    port 9527
#使用protocol version 2
    Protocol 2
#限制可登录用户
    AllowUsers LiangJC
#设定空闲会话超时时长
    LoginGraceTime 1m
#仅监听特定的IP地址
    ListenAddress 192.168.139.100   
#使用基于密钥的认证
    PasswordAuthentication yes
#禁止使用空密码
    PermitEmptyPasswords no
#禁止root用户直接登录
    PermitRootLogin no
#限制ssh的访问频度和并发在线数
    MaxStartups
#基于口令认证时，使用强密码策略    

AIDE 检查文件完整性

#安装aide
[root@Centos7 ~]# yum install aide
[root@Centos7 ~]# vim /etc/aide.conf        #指定对哪些目录和文件检查
    /etc/passwd         #用这个测试
[root@Centos7 ~]# aide --init               #初始化,生成数据库位置/var/lib/aide

#修改文件测试
[root@Centos7 ~]# chmod +x /etc/passwd
[root@Centos7 ~]# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz  #改名才能检测
[root@Centos7 ~]# aide --check
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2020-03-10 21:30:13

Summary:
  Total number of files:    162706
  Added files:          0
  Removed files:        0
  Changed files:        1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/passwd

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /etc/passwd
 Perm     : -rw-r--r--                       , -rwxr-xr-x
 ACL      : old = A:
----
user::rw-
group::r--
other::r--
----
                  D: <NONE>
            new = A:
----
user::rwx
group::r-x
other::r-x
----
                  D: <NONE>

#修改后可以选择更新数据
aide --update

sudo

#安全隐患
vim /etc/sudoers.d/liangjc
liangjc ALL=(ALL) /bin/cat /var/log/messages*

sudo - liangjc
sudo /bin/cat /var/log/messages /etc/passwd /etc/shadow     #可以查看passwd,shadow

#解决方法
liangjc ALL=(ALL) /bin/cat /var/log/messages*,!/bin/cat /var/log/messages* *

TCP_Wrappers

#/etc/hosts.allow   优先级高
#/etc/hosts.deny

#仅允许192.168.139.0/24网段通过ssh连接
echo "sshd: 192.168.139." >> /etc/hosts.allow
echo "sshd: ALL" >> /etc/hosts.deny

pam_limits 资源限制

vim /etc/pam.d/system-auth      
    session required pam_limits.so      #查看是否被注释
vim /etc/security/limits.conf           #添加限制
* soft core unlimited
* hard core unlimited
* soft nproc 1000000
* hard nproc 1000000
* soft nofile 1000000
* hard nofile 1000000
* soft memlock 32000
* hard memlock 32000
* soft msgqueue 8192000
* hard msgqueue 8192000