CentOS操作系统安装完成之后,我们需要对现有的系统进行一些简单的设置,才能使用操作系统更加安全可靠,下面我们来向大家介绍一些最基本的安全防护策略,进一步提升操作系统的安全性。
1、修改客户密码的长度
密码的安全是操作系统的第一步,所以我们必须要求有一个强壮的密码,可以通过修改/etc/login.defs文件来实现我们要求的密码长度。
/etc/login.defs原始内容如下:
[root@localhost ~]# vi /etc/login.defs # # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # QMAIL_DIR is for Qmail # #QMAIL_DIR Maildir MAIL_DIR /var/spool/mail #MAIL_FILE .mail # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_MIN_LEN 5 PASS_WARN_AGE 7 # # Min/max values for automatic uid selection in useradd # UID_MIN 500 UID_MAX 60000 # # Min/max values for automatic gid selection in groupadd # GID_MIN 500 GID_MAX 60000 # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by # the user to be removed (passed as the first argument). # #USERDEL_CMD /usr/sbin/userdel_local # # If useradd should create home directories for users by default # On RH systems, we do. This option is overridden with the -m flag on # useradd command line. # CREATE_HOME yes # The permission mask is initialized to this value. If not specified, # the permission mask will be initialized to 022. UMASK 077 # This enables userdel to remove user groups if no members exist. # USERGROUPS_ENAB yes # Use SHA512 to encrypt password. ENCRYPT_METHOD SHA512 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_MIN_LEN 5 PASS_WARN_AGE 7 # # Min/max values for automatic uid selection in useradd # UID_MIN 500 UID_MAX 60000 # # Min/max values for automatic gid selection in groupadd # GID_MIN 500 GID_MAX 60000 # # If defined, this command is run when removing a user. # It should remove any at/cron/print jobs etc. owned by # the user to be removed (passed as the first argument). # #USERDEL_CMD /usr/sbin/userdel_local # # If useradd should create home directories for users by default # On RH systems, we do. This option is overridden with the -m flag on # useradd command line. # CREATE_HOME yes # The permission mask is initialized to this value. If not specified, # the permission mask will be initialized to 022. UMASK 077 # This enables userdel to remove user groups if no members exist. # USERGROUPS_ENAB yes # Use SHA512 to encrypt password. ENCRYPT_METHOD SHA512 将密码最小的长度调整为8 PASS_MIN_LEN 8
2、注释掉操作系统不需要使用的用户和用户组
Centos 6.4操作系统安装好之后,我们需要针对一些不需要使用的用户和用户组来进行设置,减少可能发生的安全问题。
/etc/passwd原始内容如下:
[root@localhost ~]# vi /etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin pulse:x:498:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin saslauth:x:497:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin abrt:x:173:173::/etc/abrt:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin gdm:x:42:42::/var/lib/gdm:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin tcpdump:x:72:72::/:/sbin/nologin ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin 注释掉以下用户 #userdel adm:x:3:4:adm:/var/adm:/sbin/nologin #userdel lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin #userdel sync:x:5:0:sync:/sbin:/bin/sync #userdel shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown #userdel halt:x:7:0:halt:/sbin:/sbin/halt #userdel uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin #userdel operator:x:11:0:operator:/root:/sbin/nologin #userdel games:x:12:100:games:/usr/games:/sbin/nologin #userdel gopher:x:13:30:gopher:/var/gopher:/sbin/nologin #userdel ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
/etc/group原始内容如下:
[root@localhost ~]# vi /etc/group root:x:0: bin:x:1:bin,daemon daemon:x:2:bin,daemon sys:x:3:bin,adm adm:x:4:adm,daemon tty:x:5: disk:x:6: lp:x:7:daemon mem:x:8: kmem:x:9: wheel:x:10: mail:x:12:mail,postfix uucp:x:14: man:x:15: games:x:20: gopher:x:30: video:x:39: dip:x:40: ftp:x:50: lock:x:54: audio:x:63: nobody:x:99: users:x:100: dbus:x:81: usbmuxd:x:113: utmp:x:22: utempter:x:35: desktop_admin_r:x:499: desktop_user_r:x:498: floppy:x:19: vcsa:x:69: rpc:x:32: rtkit:x:497: avahi-autoipd:x:170: cdrom:x:11: tape:x:33: dialout:x:18: wbpriv:x:88: pulse:x:496: pulse-access:x:495: fuse:x:494: haldaemon:x:68:haldaemon ntp:x:38: apache:x:48: saslauth:x:76: postdrop:x:90: postfix:x:89: abrt:x:173: rpcuser:x:29: nfsnobody:x:65534: gdm:x:42: stapusr:x:156: stapsys:x:157: stapdev:x:158: sshd:x:74: tcpdump:x:72: slocate:x:21: ldap:x:55: 注释掉以下用户组 #groupdel adm:x:4:adm,daemon #groupdel lp:x:7:daemon #groupdel uucp:x:14: #groupdel games:x:20: #groupdel dip:x:40:
3、检查系统的安全登陆文件
通过检查/var/log/secure该文件的信息,我们可以了解到有哪些用户及IP地址进行登陆。
[root@localhost ~]# more /var/log/secure grep refused :::::::::::::: /var/log/secure :::::::::::::: Jan 16 22:33:29 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed esktop/ConsoleKit/Session1 (system bus name :1.23, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo cale zh_CN.UTF-8) (disconnected from bus) Jan 16 22:33:32 localhost sshd[1728]: Received signal 15; terminating. Jan 16 22:33:32 localhost sshd[2460]: Exiting on signal 15 Jan 16 22:33:32 localhost sshd[2460]: pam_unix(sshd:session): session closed for user root Jan 17 15:54:27 localhost sshd[1737]: Server listening on 0.0.0.0 port 22. Jan 17 15:54:27 localhost sshd[1737]: Server listening on :: port 22. Jan 17 15:54:35 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes ktop/ConsoleKit/Session1 (system bus name :1.24 [/usr/libexec/polkit-gnome-authentication-agent-1], object p ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) Jan 17 15:54:50 localhost sshd[2461]: Accepted password for root from 192.168.1.3 port 55918 ssh2 Jan 17 15:54:50 localhost sshd[2461]: pam_unix(sshd:session): session opened for user root by (uid=0) Jan 17 16:01:55 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed esktop/ConsoleKit/Session1 (system bus name :1.24, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo cale zh_CN.UTF-8) (disconnected from bus) Jan 17 16:01:58 localhost sshd[1737]: Received signal 15; terminating. Jan 17 16:01:58 localhost sshd[2461]: Exiting on signal 15 Jan 17 16:01:58 localhost sshd[2461]: pam_unix(sshd:session): session closed for user root Jan 29 10:49:52 localhost sshd[1728]: Server listening on 0.0.0.0 port 22. Jan 29 10:49:52 localhost sshd[1728]: Server listening on :: port 22. Jan 29 10:49:57 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes ktop/ConsoleKit/Session1 (system bus name :1.23 [/usr/libexec/polkit-gnome-authentication-agent-1], object p ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) Jan 29 10:50:02 localhost sshd[2452]: Accepted password for root from 192.168.1.4 port 53853 ssh2 Jan 29 10:50:02 localhost sshd[2452]: pam_unix(sshd:session): session opened for user root by (uid=0) Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): check pass; user unknown Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=fsdaf rhost=192.168.1.4 Jan 29 10:51:43 localhost vsftpd[2482]: pam_succeed_if(vsftpd:auth): error retrieving information about user fsdaf Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): check pass; user unknown Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=ithov rhost=192.168.1.4 Jan 29 10:51:58 localhost vsftpd[2484]: pam_succeed_if(vsftpd:auth): error retrieving information about user ithov Jan 29 10:54:35 localhost sshd[2452]: pam_unix(sshd:session): session closed for user root Jan 29 10:54:36 localhost sshd[2493]: Accepted password for root from 192.168.1.4 port 54693 ssh2 Jan 29 10:54:36 localhost sshd[2493]: pam_unix(sshd:session): session opened for user root by (uid=0) grep: 没有那个文件或目录 refused: 没有那个文件或目录
4、使用chattr命令给下列文件加上不可更改的属性
有效防止非法用户进行文件的修改。
[root@localhost ~]# chattr +i /etc/passwd [root@localhost ~]# chattr +i /etc/shadow [root@localhost ~]# chattr +i /etc/group [root@localhost ~]# chattr +i /etc/gshadow
5、更改SSH端口加强登陆安全
CentOS 6.4安装好之后,默认使用22端口进行连接,就像Windows Server 2008操作系统一样使用3389,对于一般的用户很容易就猜测到这个端口是提供什么服务的,所以建议使用10000以上的端口,这样别人在扫描的时候,能扫描到端口的机率也会降低一些。
不要允许使用低版本的SSH协议进行连接
[root@localhost ~]# vi /etc/ssh/sshd_config 将#protocol 2,1改为 protocol 2
(注:centos 6下已默认取消了低版本协议,默认值为protocol 2)
将PORT改为1000以上端口
[root@localhost ~]# vi /etc/ssh/sshd_config Port 10000
开启防火墙端口,并重新启动防火墙生效
[root@localhost ~]# vi /etc/sysconfig/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT [root@localhost ~]# service iptables restart iptables:清除防火墙规则:[确定] iptables:将链设置为政策 ACCEPT:filter [确定] iptables:正在卸载模块:[确定] iptables:应用防火墙规则:[确定] iptables:载入额外模块: ip_nat_ftp [确定]
6、防止IP欺骗
编辑/etc/host.conf文件并增加如下几行来防止IP欺骗***。
order bind, hostsmulti off nospoof on
本文转载于:http://www.centoscn.com/CentosSecurity/CentosSafe/2014/0628/3208.html
转载于:https://blog.51cto.com/bronte/1440796