基线修复脚本
#基线加固 #删除无关账号 sed -i '/gdm/c\gdm:x:42:42:gdm:/:/bin/false' /etc/passwd sed -i '/nobody/c\nobody:x:99:99:Nobody:/:/bin/false' /etc/passwd sed -i '/gdm/c\gdm:*LK*:17374::::::' /etc/shadow sed -i '/nobody/c\nobody:*LK*:17374::::::' /etc/shadow#限制用户su到root if [ -z "`cat /etc/pam.d/su | grep -v "^#" | grep group=wheel`" ];thensed -i "3i auth required pam_wheel.so group=wheel" /etc/pam.d/su fi #sed -i -e '7 s/^/#/' -i -e '7 s/^/#/' /etc/pam.d/su cat /etc/pam.d/su#口令复杂度 sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_cracklib.so.+$)/#\1\npassword\trequired\tpam_passwdqc.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_pwquality.so.+$)/#\1\npassword\trequired\tpam_pwquality.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth#口令生存期 sed -i '/PASS_MAX_DAYS/c\'"PASS_MAX_DAYS 90"'' /etc/login.defs sed -i '/PASS_MIN_LEN/c\'"PASS_MIN_LEN 8"'' /etc/login.defs sed -i '/PASS_MIN_DAYS/c\'"PASS_MIN_DAYS 0"'' /etc/login.defs #配置用户最小授权#文件与目录缺省权限控制 if [ -z "`cat /etc/profile | grep -v "^#" | grep "umask 027"`" ];thenecho "umask 027" >> /etc/profile fi#用户FTP访问安全配置 echo "chroot_local_user=YES" >> /etc/vsftpd/vsftpd.conf echo "chroot_list_enable=YES" >> /etc/vsftpd/vsftpd.conf echo "chroot_list_file=/etc/vsftpd/chroot_list_new" >> /etc/vsftpd/vsftpd.conf cat /etc/passwd|awk -F ':' '$3>=500{print $1}' 1>/etc/vsftpd/chroot_list_new#禁止root登陆FTP if [ -z "`cat /etc/vsftpd/ftpusers | grep -v "^#" | grep root`" ];thenecho "root" >> /etc/vsftpd/ftpusers fi#禁止匿名FTP sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf#修改FTPBanner信息 if [ -z "`cat /etc/vsftpd/vsftpd.conf | grep -v "^#" | grep ftpd_banner`" ];thenecho "ftpd_banner=Authorized users only. All activity will be monitored and reported." >>/etc/vsftpd/vsftpd.conf fi#限制root用户远程登录 echo "PermitRootLogin no" >> /etc/ssh/sshd_config sed -i '/PermitRootLogin yes/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config sed -i '/PermitRootLogin noPermitRootLogin no/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config #使用SSH协议进行远程维护#启用syslog系统日志审计 if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep authpriv.*`" ];thenecho "authpriv.* /var/log/secure" >> /etc/syslog.conf fi if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep authpriv.*`" ];thenecho "authpriv.* /var/log/secure" >> /etc/rsyslog.conf fi#日志文件安全 echo "" > /var/log/spooler chmod 600 /var/log/secure chmod 600 /var/log/maillog chmod 600 /var/log/cron chmod 600 /var/log/spooler chattr -a /var/log/boot.log chmod 600 /var/log/boot.log chattr -a /var/log/messages chmod 600 /var/log/messages#记录cron行为日志(可选) if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep cron.*`" ];thenecho "cron.* /var/log/cron" >> /etc/rsyslog.conf fi if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep cron.*`" ];thenecho "cron.* /var/log/cron" >> /etc/syslog.conf fiecho "*.* @192.168.1.1" >> /etc/syslog.conf echo "*.* @192.168.1.1" >> /etc/rsyslog.conf #关闭不必要的服务#修改系统Banner rm -rf /etc/issue*#登录超时时间设置 if [ -z "`cat /etc/profile | grep -v "^#" | grep TMOUT`" ];thenecho -e "TMOUT=300" >> /etc/profile fi sed -i 's/TMOUT=1800/TMOUT=300/' /etc/profile#删除潜在危险文件#sudo tty权限配置 sed -i 's/Defaults requiretty/#Defaults requiretty/' /etc/sudoers#配置用户最小授权 chmod 400 /etc/shadow#文件与目录缺省权限控制 sed -i 's/UMASK 022/UMASK 027/' /etc/login.defs#history记录时间 echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "' >> /etc/profile HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "