#! /bin/bash
#作者:技术管理 张浩
#73958468
#只适用于cetos7.X版本
a='yes'
b='y'
#创建普通账号
while true
do
read -p "是否需要创建普通用户" c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
read -p "enter_name" username
read -p "enter_password" password
`useradd $username`
echo $password | passwd --stdin $username
else
echo "stop to add users"
break
fi
done
#禁用root直接登录
read -p "是否禁用root直接登录 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
sed -i "s/# PermitRootLogin yes/ PermitRootLogin no/g" '/etc/ssh/sshd_config'
else
echo "you can use the user_root"
fi
# 给系统文件加锁,防止未经许可的删除或添加
read -p "是否给系统用户文件枷锁 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
`chattr +ia /etc/passwd`
`chattr +ia /etc/shadow`
`chattr +ia /etc/group`
`chattr +ia /etc/gshadow`
`chattr +ia /etc/services`
else
echo "you can also use host_user file"
fi
# 关闭SELINUX
read -p "是否关闭沙盒 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" '/etc/selinux/config'
sed -i "s/SELINUXTYPE=targeted/# SELINUXTYPE=targeted/g" '/etc/selinux/config'
`setenforce 0`
else
echo "the selinux = enforcing"
fi
#修改ssh默认端口
read -p "是否更改ssh端口 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
sed -i "s/# Port 22/Port 222/g" '/etc/ssh/ssh_config'
`systemctl restart sshd`
else
echo "ssh_port is not change"
fi
#修改主机名称
read -p "是否修改主机名 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
read -p "enter the hostname" d
`hostname $d`
sed -i "s/localhost.localdomain/$d/g" '/etc/hostname'
`echo -e "127.0.0.1 $d localhost" >> /etc/hosts`
else
echo "the hostname is not change"
fi
# 同步系统时间
read -p "是否同步系统时间 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
`rm -rf /etc/localtime` #先删除默认的时区设置
`ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime` #替换上海/北京作为默认
# ` /usr/bin/yum -y install ntp ` # 安装ntp
`/usr/sbin/ntpdate time1.aliyun.com` #执行时间同步
`/usr/sbin/hwclock --systohc` #系统时钟和硬件时钟同步
`echo -e "0 0 * * * /usr/sbin/ntpdate time1.aliyun.com &>/dev/null" >> /var/spool/cron/root` #添加计划任务
`service crond restart` #重启服务
else
echo "the hosttime is not change"
fi
# 安装基础软件包
read -p "是否安装基础软件包 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
`yum install -y apr* autoconf automake bison cloog-ppl compat* cpp curl curl-devel fontconfig fontconfig-devel freetype freetype* freetype-devel gcc gcc-c++ gtk+-devel gd gettext`
else
echo "未安装"
fi
linux系统安检脚本
于 2023-05-11 15:44:47 首次发布
![](https://img-home.csdnimg.cn/images/20240711042549.png)