CentOS/RHEL安全配置脚本

作者: PrisonerWalking | 来源:发表于2019-02-19 12:22 被阅读0次
CentOS/RHEL安全配置脚本
ansible EPRL源
CentOS7安装和配置iptables防火墙
PYENV for RHEL 6
Linux root密码破解
PHP7.0安装
Centos6 7 8 aliyun yum镜像配置
RHEL/CentOS修改hostname
绝对干货SSH web豪华版
CentOS8或RHEL8如何安装ifconfig命令
Shell Code
#! /bin/bash

# 
# Name:     lintool
# Auther:   Jon Lau
# Version:  V1.1.6 (2019/02/14)
# Usage:    chmod +x lintool
#           ./lintool
# Update:   1. Add function for print file infomation
# 

Yum(){
    echo -e "\033[01;32mYum Setting...\033[0m"
    echo -e "\033[33mDelete repo files...\033[0m"
    rm -rfv /etc/yum.repos.d/*
    echo -e "\033[33mCreate repo file...\033[0m"
    case $1 in
        el6)
            echo [os] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=os >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/os/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [extras] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=extras >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/extras/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [updates] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=updates >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/updates/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [epel] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=epel >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/epel/6/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [zabbix] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=zabbix >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/zabbix/4.0/rhel/6/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            ;;
        el7)
            echo [os] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=os >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/os/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [updates] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=updates >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/updates/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [extras] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=extras >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/extras/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [epel] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=epel >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/epel/7/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [zabbix] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=zabbix >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/zabbix/4.0/rhel/7/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            ;;
        *)
            ;;
    esac
    echo -e "\033[33mUpdate repolist...\033[0m"
    yum clean all && yum repolist all
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mYum repolist failed!\033[0m"
        return [-1]
    fi
}

InstallPackage(){
    echo -e "\033[01;32mInstall Packages...\033[0m"
    echo -e "\033[33mInstall vim...\033[0m"
    yum install -y vim-enhanced
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall vim failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mInstall bash-completion...\033[0m"
    yum install -y bash-completion
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall bash-completion failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mInstall openssh-clients...\033[0m"
    yum install -y openssh-clients
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall openssh-clients failed!\033[0m"
        return [-1]
    fi
}

DisableService(){
    echo -e "\033[01;32mDisable Services...\033[0m"
    case $1 in
        el6)
            echo -e "\033[33mDisable iptables...\033[0m"
            service iptables stop && chkconfig iptables off
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable iptables failed!\033[0m"
                return [-1]
            fi

            echo -e "\033[33mDisable postfix...\033[0m"
            service postfix stop && chkconfig postfix off
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable postfix failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            echo -e "\033[33mDisable firewalld postfix and NetworkManager...\033[0m"
            systemctl stop firewalld postfix NetworkManager && systemctl disable firewalld postfix NetworkManager
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable firewalld postfix or NetworkManager failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

Ntp(){
    echo -e "\033[01;32mNtp Setting...\033[0m"
    echo -e "\033[33mInstall ntp...\033[0m"
    yum install -y ntp
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall ntp failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mEdit ntp profile ntp.conf...\033[0m"
    N=$(grep -E "^server 10.172.113.163$" /etc/ntp.conf | wc -l)
    if [[ ${N} -eq 0 ]]; then
        sed -i 's/^server/# server/g' /etc/ntp.conf
        echo "server 10.172.113.163" >> /etc/ntp.conf
        echo "server 10.173.173.163" >> /etc/ntp.conf
    fi
    case $1 in
        el6)
            echo -e "\033[33mStart ntpd...\033[0m"
            service ntpd start && chkconfig ntpd on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart ntpd failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            echo -e "\033[33mStart ntpd...\033[0m"
            systemctl start ntpd && systemctl enable ntpd
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart ntpd failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

DisableCtrlAltDelete(){
    echo -e "\033[01;32mDisable Ctrl-Alt-Delete...\033[0m"
    case $1 in
        el6)
            sed -i 's/^start/# start/g' /etc/init/control-alt-delete.conf
            sed -i 's/^exec/# exec/g' /etc/init/control-alt-delete.conf
            ;;
        el7)
            if [[ -f /usr/lib/systemd/system/ctrl-alt-del.target ]]; then
                mv -v /usr/lib/systemd/system/ctrl-alt-del.target{,.bak}
            fi
            ;;
        *)
            ;;
    esac
}

InitMod(){
    echo -e "\033[01;32mInit Mod Setting...\033[0m"
    echo -e "\033[33mSet multi-user default...\033[0m"
    case $1 in
        el6)
            sed -i 's/id:5/id:3/g' /etc/inittab
            ;;
        el7)
            systemctl set-default multi-user.target
            ;;
        *)
            ;;
    esac
}

EditProfile(){
    echo -e "\033[01;32mProfile Setting...\033[0m"
    N=$(grep -E "^TMOUT=600$" /etc/profile | wc -l)
    if [[ ${N} -eq 0 ]]; then
        echo >> /etc/profile
        echo -e "\033[33mSet time-out...\033[0m"
        echo "TMOUT=600" >> /etc/profile
        echo -e "\033[33mSet cmd history size...\033[0m"
        echo "HISTSIZE=3000" >> /etc/profile
        echo -e "\033[33mSet cmd history format...\033[0m"
        echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S `whoami`: "' >> /etc/profile
        source /etc/profile
    fi
}

Log(){
    echo -e "\033[01;32mLogrotate Setting...\033[0m"
    echo -e "\033[33mSet rotate weeks...\033[0m"
    sed -i 's/rotate 4/rotate 52/g' /etc/logrotate.conf
}

DisableRoot(){
    echo -e "\033[01;32mDisable Root Login...\033[0m"
    echo -e "\033[33mAdd user natalia and set password...\033[0m"
    N=$(grep -E "natalia" /etc/passwd | wc -l)
    if [[ ${N} -eq 0 ]]; then
        useradd -s /bin/bash -m natalia
    fi
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mAdd user natalia failed!\033[0m"
        return [-1]
    fi
    echo dpbg123. | passwd --stdin natalia
    echo -e "\033[33mDisable root login...\033[0m"
    N=$(grep -E "^PermitRootLogin no$" /etc/ssh/sshd_config | wc -l)
    if [[ ${N} -eq 0 ]]; then
        echo >> /etc/ssh/sshd_config
        echo "PermitRootLogin no" >> /etc/ssh/sshd_config
    fi
    echo -e "\033[33mRestart sshd service...\033[0m"
    case $1 in
        el6)
            service sshd restart && chkconfig sshd on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mRestart sshd failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            systemctl restart sshd && systemctl enable sshd
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mRestart sshd failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

DisableSELinux(){
    echo -e "\033[01;32mDisable SELinux...\033[0m"
    sed -i 's/^SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    setenforce 0
}

ZabbixAgent(){
    echo -e "\033[01;32mZabbix Agent Setting...\033[0m"
    echo -ne "\033[01;33mPlease enter the Zabbix Server IP: \033[0m"
    read ZBXIP
    echo -e "\033[33mInstall zabbix-agent...\033[0m"
    yum install -y zabbix-agent
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall zabbix-agent failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mSome settings on zabbix_agentd.conf...\033[0m"
    sed -i "s/LogFileSize=0/LogFileSize=1/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^Server=127.0.0.1/Server=${ZBXIP}/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^ServerActive=127.0.0.1/ServerActive=${ZBXIP}/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^Hostname=Zabbix server/Hostname=${HOSTNAME}/g" /etc/zabbix/zabbix_agentd.conf
    echo -e "\033[33mStart zabbix-agent service...\033[0m"
    case $1 in
        el6)
            service zabbix-agent start && chkconfig zabbix-agent on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart zabbix-agent failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            systemctl start zabbix-agent && systemctl enable zabbix-agent
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart zabbix-agent failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

PrintInfo(){
    NAME='lintool'
    AUTHER='Jon Lau'
    VER='V1.1.6 (2019/02/14)'
    echo -e "\033[33mName:     ${NAME}\033[0m"
    echo -e "\033[33mAuther:   ${AUTHER}\033[0m"
    echo -e "\033[33mVersion:  ${VER}\033[0m"
    echo -e "\033[33mUsage:    chmod +x lintool\033[0m"
    echo -e "\033[33m          ./lintool\033[0m"
}

DoFunc(){
    COLS=$(stty size | awk '{print $2}')
    NN=$(echo -n $1 | wc -c)
    NS=$((${COLS} - ${NN} - 9))
    NF=$((${COLS} - ${NN} - 8))
    $1 $2 2> /dev/null
    if [[ $? -eq 0 ]]; then
        echo -n "$1"
        for i in $(seq 1 ${NS}); do
            echo -n " "
        done
        echo -e "[\033[00;32mSuccess\033[0m]"
    else
        echo -n "$1"
        for i in $(seq 1 ${NF}); do
            echo -n " "
        done
        echo -e "[\033[00;31mFaild\033[0m]"
    fi
}

SettingAll(){
    if [[ -f /root/.SETTINGALL ]]; then
        echo -e "\033[01;31mHas been execed, do nothing!\033[0m"
    else
        touch /root/.SETTINGALL
        DoFunc Yum $1
        DoFunc InstallPackage $1
        DoFunc DisableService $1
        DoFunc Ntp $1
        DoFunc DisableCtrlAltDelete $1
        DoFunc InitMod $1
        DoFunc EditProfile $1
        DoFunc Log $1
        DoFunc DisableRoot $1
        DoFunc DisableSELinux $1
        DoFunc ZabbixAgent $1
    fi
}

Print_Menu(){
    COLS=$(stty size | awk '{print $2}')
    N=$(( (${COLS} - 42) / 2 ))
    echo
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m -------------- Linux Menu -------------- \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      v) Print Version                    \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      q) Quit                             \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      0) Setting All                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      1) Yum Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      2) Install Packages                 \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      3) Disable Services                 \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      4) Ntp Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      5) Disable Ctrl-Alt-Delete          \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      6) Init Mod                         \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      7) Profile Setting                  \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      8) Log Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      9) Disable Root                     \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m     10) Disable SELinux                  \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m     11) Zabbix Agent                     \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m ---------------------------------------- \033[0m"
    echo; for i in $(seq 1 ${N}); do echo -n " "; done; echo -ne "\033[33mEnter your choice: \033[0m"
}

Menu(){
    while [ 1 -eq 1 ]; do
        RELEASE=$(uname -r | awk -F '.' '{i=NF-1; print $i}')
        Print_Menu
        read key
        case $key in
            0)
                SettingAll ${RELEASE}
                ;;
            1)
                DoFunc Yum ${RELEASE}
                ;;
            2)
                DoFunc InstallPackage ${RELEASE}
                ;;
            3)
                DoFunc DisableService ${RELEASE}
                ;;
            4)
                DoFunc Ntp ${RELEASE}
                ;;
            5)
                DoFunc DisableCtrlAltDelete ${RELEASE}
                ;;
            6)
                DoFunc InitMod ${RELEASE}
                ;;
            7)
                DoFunc EditProfile ${RELEASE}
                ;;
            8)
                DoFunc Log ${RELEASE}
                ;;
            9)
                DoFunc DisableRoot ${RELEASE}
                ;;
            10)
                DoFunc DisableSELinux ${RELEASE}
                ;;
            11)
                DoFunc ZabbixAgent ${RELEASE}
                ;;
            v | V)
                DoFunc PrintInfo ${RELEASE}
                ;;
            q | Q)
                break
                ;;
            *)
                echo -e "\033[31m[!] Please enter [0-11]\033[0m"
                ;;
        esac
    done
}

Menu
CentOS/RHEL安全配置脚本
Shell Code
ansible EPRL源
红帽（CentOS）需要配置EPEL源 RHEL/CentOS 6 yum installhttps://dl.f...
CentOS7安装和配置iptables防火墙
本文主要介绍一下CentOS7下如何安装和配置iptables防火墙。环境配置从CentOS7(RHEL7)开...
PYENV for RHEL 6
前提： 1、变更RHEL6.7源为 CENTOS 6源。可参考文档RHEL6更换CentOS源 2、原因：RHEL...
Linux root密码破解
CentOS6 CentOS7 RHEL 8
PHP7.0安装
更新yum源系统版本CentOS/RHEL 7.x: CentOS/RHEL 6.x: php7.0安装上述命...
Centos6 7 8 aliyun yum镜像配置
CentOS 镜像先附上我的centos yum源配置脚本简介CentOS，是基于 Red Hat Linux...
RHEL/CentOS修改hostname
本文主要介绍在RHEL/CentOS/6/7/8中如何修改主机的hostname。 1、CentOS6/RHEL6...
绝对干货SSH web豪华版
不想解释历史背景了，演示图说明了一切。安装 RHEL/CentOS/Fedora 配置vi /etc/sysco...
CentOS8或RHEL8如何安装ifconfig命令
本文主要讲解如何在CentOS8或RHEL8系统中安装ifconfig命令。你的RHEL 8 / CentOS ...