适用于一般Linux主机基线安全扫描设定
#!/bin/bash
#date:2021-11-13
#writed by Xu
null=>/dev/null 2>&1
date=`date +%F.%T`
useradd hdlh
echo "Hdlh@2605" | passwd --stdin hdlh
echo "weihu ALL=(ALL) NOPASSWD:ALL" >>/etc/sudoers
echo "hdlh ALL=(ALL) NOPASSWD:ALL" >>/etc/sudoers
###账号管理###
#禁止登陆
usermod -s /bin/false lp ${null}
usermod -s /bin/false sync ${null}
usermod -s /bin/false halt ${null}
usermod -s /bin/false news ${null}
usermod -s /bin/false uucp ${null}
usermod -s /bin/false operator ${null}
usermod -s /bin/false games ${null}
usermod -s /bin/false gopher ${null}
usermod -s /bin/false smmsp ${null}
usermod -s /bin/false nfsnobody ${null}
usermod -s /bin/false nobody ${null}
###口令策略###
#口令锁定
cp /etc/pam.d/system-auth /etc/pam.d/system-auth_back
echo "auth required pam_tally2.so deny=5 unlock_time=300 even_deny_root root_unlock_time=60 audit" >>/etc/pam.d/system-auth
#口令过期
cp -p /etc/login.defs /etc/login.defs_bak
sed -i '/PASS_MAX_DAYS/s/99999/90/g' /etc/login.defs
sed -i '/PASS_MIN_DAYS/s/0/10/g' /etc/login.defs
#口令复杂
cp /etc/pam.d/passwd /etc/pam.d/passwd.bak
echo "password required pam_pwquality.so retry=3" >> /etc/pam.d/passwd
cp /etc/security/pwquality.conf /etc/security/pwquality.conf.bak
echo "minlen=8" >>/etc/security/pwquality.conf
echo "dcredit=-1" >>/etc/security/pwquality.conf
echo "ucredit=-1" >>/etc/security/pwquality.conf
echo "lcredit=-1" >>/etc/security/pwquality.conf
echo "ocredit=-1" >>/etc/security/pwquality.conf
#口令重复锁定
cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
cp -p /etc/pam.d/passwd /etc/pam.d/passwd.bak
cp -p /etc/pam.d/common-password /etc/pam.d/common-password.bak
sed -i '/use_authtok/ s/$/ remember=5/' /etc/pam.d/system-auth
###认证授权###
echo "auth required pam_wheel.so use_uid">>/etc/pam.d/su
echo "SU_WHEEL_ONLY yes" >>/etc/login.defs
usermod -G wheel weihu
usermod -G wheel hdlh
###系统服务###
#限制root远程登录
sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
#修改ssh的banner信息
echo " Authorized users only. All activity may be monitored and reported " > /etc/motd
#修改ssh的banner警告信息
touch /etc/ssh_banner
chown bin:bin /etc/ssh_banner
chmod 644 /etc/ssh_banner
echo " Authorized only. All activity will be monitored and reported " > /etc/ssh_banner
echo " Banner /etc/ssh_banner" >>/etc/ssh_banner
#systemctl restart sshd
###文件权限###
#文件与目录权限
cp /etc/profile /etc/profile.bak
echo "umask 027" >> /etc/profile
#配置用户最小授权
chmod 644 /etc/passwd
chmod 600 /etc/shadow
chmod 644 /etc/group
chmod 644 /etc/services
chmod 600 /etc/xinetd.conf
chmod 600 /etc/security
#禁止ICMP重定向
cp -p /etc/sysctl.conf /etc/sysctl.conf_bak
echo "net.ipv4.conf.all.accept_redirects=0" >> /etc/sysctl.conf
sysctl -p
###日志审计###
#日志文件安全
chmod 640 filename
#远程日志
echo "*.* @10.142.254.176" >>/etc/rsyslog.conf
#安全事件日志
mkdir -p /var/adm/messages
echo "*.err;kern.debug;daemon.notice /var/adm/messages" >> /var/adm/messages
chmod 640 /var/adm/messgaes
#systemctl restart rsyslog
###网络通信###
#远程访问的 IP
cp -p /etc/hosts.allow /etc/hosts.allow_bak
cp -p /etc/hosts.deny /etc/hosts.deny_bak
echo "all:10.142.254.*:allow" >> /etc/hosts.allow
echo "all:10.142.133.*:allow" >> /etc/hosts.allow
#IP源路由
for f in /proc/sys/net/ipv4/conf/*/accept_source_route
do
echo 0 > $f
done
#主机解析地址的顺序
cp /etc/host.conf /etc/host.conf.bak
echo "order hosts,bind" >> /etc/host.conf
echo "multi on">> /etc/host.conf
echo "nospoof on" >> /etc/host.conf
###系统漏洞###
#系统core dump状态
echo "* soft core 0" >> /etc/security/limits.conf
echo "* hard core 0">> /etc/security/limits.conf
echo "#ulimit -S -c 0 > /dev/null 2>&1">>/etc/profile
###其他配置###
#登陆时间超时
echo "TMOUT=300"
source /etc/profile
#关机快捷键
rm -f /usr/lib/systemd/system/ctrl-alt-del.target
#屏幕锁定
yum install -y GConf2 ${null}
# 2、启用空闲激活
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/gnome-screensaver/idle_activation_enabled true
# 3、启用屏幕锁定
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/gnome-screensaver/lock_enabled true
# 4、设置屏保模式
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type string --set /apps/gnome-screensaver/mode blank-only
# 5、设置空闲激活时间
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /apps/gnome-screensaver/idle_delay 15
#关键文件的属性
chattr +a /var/log/messages
#历史命令设置
echo "HISTFILESIZE=5" >> /etc/profile
echo "HISTSIZE=5" >> /etc/profile
#对 root 为ls、rm设置别名
echo "alias ls='ls -al'">>~/.bashrc
echo "alias rm='rm -i'">>~/.bashrc