linux基线加固

linux一开始是有很多安装一隐患的

所以要进行基线加固。

本人自己写的基线加固脚本

#!/bin/bash

cp /etc/login.defs /etc/login.defs.bak

cp /etc/security/limits.conf /etc/security/limits.conf.bak

cp /etc/pam.d/su  /etc/pam.d/su.bak

cp /etc/profile /etc/profile.bak

cp /etc/issue.net /etc/issue.net.bak

cp /etc/shadow /etc/shadow.bak

cp /etc/passwd /etc/passwd.bak

cp /etc/pam.d/passwd  /etc/pam.d/passwd.bak

cp /etc/pam.d/common-password /etc/pam.d/common-password.bak

cp /etc/host.conf /etc/host.conf.bak

cp /etc/hosts.allow /etc/hosts.allow.bak

cp /etc/ntp.conf /etc/ntp.conf.bak

cp -p /etc/sysctl.conf /etc/sysctl.conf.bak

echo "============备份完成=================="

a=`cat -n /etc/login.defs | grep PASS_MIN_DAYS | grep -v of | awk '{print $1}'`

sed -i ''$a' s/0/6/g' /etc/login.defs

echo "检查口令更改最小间隔天数完成"

b=`cat -n /etc/login.defs | grep PASS_WARN_AGE | grep -v of | awk '{print $1}'`

sed -i ''$b' s/7/30/g' /etc/login.defs

echo "检查口令过期前警告天数完成"

c=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $1}'`

d=`cat -n /etc/security/limits.conf | grep "#root" | awk '{print $5}'`

sed -i ''$c' s/$d/0/g' /etc/security/limits.conf

echo "设置* hard core 0完成"

e=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $1}'`

f=`cat -n /etc/security/limits.conf | grep soft | grep core | awk '{print $5}'`

sed -i ''$e' s/'$f'/0/g' /etc/security/limits.conf

echo "设置* soft core 0完成"

echo "HISTFILESIZE=5" >> /etc/profile

echo "  检查保留历史命令的记录文件大小完成"

echo "HISTSIZE=5" >> /etc/profile

echo "检查保留历史命令的条数完成"

if [ -f /etc/issue.net ]

then

mv /etc/issue.net /etc/issue.net.bak

else

echo "issue.net 文件不存在"

fi

if [ -f /etc/issue ]

then

mv /etc/issue /etc/issue.bak

else

echo "issue 文件不存在"

fi

snu=`cat /etc/host.conf | awk '{print $2}'`

if [ "$snu" = "on" ]; then

echo "没有关闭ip伪装"

fi

sed -i 's/on/off/g' /etc/host.conf

echo "  关闭IP伪装完成"

find /usr/bin/chage /usr/bin/gpasswd /usr/bin/wall /usr/bin/chfn /usr/bin/chsh /usr/bin/newgrp /usr/bin/write /usr/sbin/usernetctl /usr/sbin/traceroute /bin/mount /bin/umount /bin/ping /sbin/netreport -type f -perm +6000 2>/dev/null >file.txt

if [ -s file.txt ]; then

echo " find。。这条命令有输出"

for i in `cat file.txt`

do

chmod 755 $i

done

else

echo "find 。。这条命令没有输出"

fi

cp -p /etc/sysctl.conf /etc/sysctl.conf.bak

echo "/etc/sysctl.conf 备份完成"

sysctl -w net.ipv4.conf.all.accept_source_route="0"

h=`cat -n /etc/login.defs | grep PASS_MAX_DAYS | grep -v of | awk '{print $1}'`

sed -i ''$h' s/99999/90/g' /etc/login.defs

echo "口令生存周期设置完成"

sed -i 's/PASS_MIN_LEN/PASS_MIN_LEN  6/g' /etc/login.defs

echo "口令最小长度设置完成"

chmod 644 /etc/group

chmod 400 /etc/shadow

chmod 644 /etc/services

chmod 600 /etc/security

chmod 644 /etc/passwd

echo "文件权限设置完成"