每天一博--第七天 CnetOS8安全加固

最新推荐文章于 2024-10-30 14:31:03 发布

Superjay09

最新推荐文章于 2024-10-30 14:31:03 发布

阅读量308

点赞数

本文链接：https://blog.csdn.net/weixin_42543813/article/details/103307323

版权

本文详述了如何对CentOS8系统进行安全加固，将加固方案转化为可执行脚本，包括安装过程、配置文件和最终结果展示，旨在提升服务器的安全性。

摘要由CSDN通过智能技术生成

服务器安全加固

目前已经将加固方案写成了脚本，方面后面的服务器加固

第一部分脚本内容

#########################################################################
# File Name: security_backup.sh
# Author:Superjay09
# mail: xxxxxxxxx.com
# Created Time: 2019-12-11
#########################################################################
#!/bin/bash
WORKDIR=$(cd $(dirname $0);pwd)
BACKUPDIR=/opt/backup 

FILE=(/etc/passwd /etc/shadow \
	  /etc/group /etc/gshadow \
	  /etc/profile /etc/bashrc \
	  /etc/motd /etc/sysctl.conf \
	  /etc/rsyslog.conf /etc/inittab \
	  /etc/init.d/* /etc/aliases \
	  /etc/sudoers /etc/ssh/sshd_config \
	  /etc/login.defs /etc/pam.d/sudo \
	  /etc/pam.d/system-auth /etc/pam.d/systemd-user \
	  /etc/pam.d/su /etc/pam.d/cockpit \
	  /etc/cron* /var/log/btmp \
	  /var/log/wtmp /var/log/messages \
	  /etc/security/* /var/log/lastlog \
	  /var/spool/cron /var/log/firewalld)

write(){
   
	if [ ! -d "$BACKUPDIR" ];then
		mkdir -p $BACKUPDIR
	fi 
	
	PER_FILE=$BACKUPDIR/per-file
	SPE_FILE=$BACKUPDIR/spe-file
	for per in ${FILE[@]};do
			FILE_PER=$(stat -c "%a" $per)
			FILE_SPE=$(lsattr -l $per | awk '{print $2}')
			cp -r $per $BACKUPDIR
			echo $per $FILE_PER >>$PER_FILE 
			echo $per $FILE_SPE >>$SPE_FILE 
	done
}

zip(){
   
	tar cf backfile.tar.gz $BACKUPDIR/* > /dev/null  2>&1
	mv backfile.tar.gz /opt
	rm -rf $BACKUPDIR
} 

ask(){
   
	read -p "Do you need to secure the system? [Y|y/N|n] " answer
	case $answer in 
		Y|y)
			source $WORKDIR/UG-operation.sh
		;;
		N|n)
			break
		;;
	esac
}`

NTPDATE_STATE=$(rpm -qa ntpdate)
if [ "$?" != "0" ];then
	echo -e "\033[32mSynchronizing time.....Please wait."
	echo ""
	yum -y install ntpdate > /dev/null  2>&1
	ntpdate ntp1.aliyun.com > /dev/null  2>&1
	echo -e "\033[32mTime synchronization complete\033[0m"
	echo ""
else 
	echo -e "\033[32mSynchronizing time.....Please wait."
	echo ""
	ntpdate ntp1.aliyun.com > /dev/null  2>&1
	echo -e "\033[32mTime synchronization complete\033[0m"
	echo ""
fi

if [ ! -f "/opt/backfile.tar.gz" ];then
	write
	zip
	source $WORKDIR/security_config.sh 
else 
	SYS_DATE=$(date +"%Y%m%d%H%M%S")
	PER_FILE_DATE=$(stat /opt/backfile.tar.gz | grep Modify | awk -F. '{print $1}' | awk '{print $2 $3}' | sed 's/\-//g' | sed 's/\://g')

	if (($SYS_DATE-$PER_FILE_DATE>1339200));then 
		write
		zip 
		echo ""
		ask

	else
		echo -e "\033[32mSystem security has been strengthened.Please select another operation\033[0m"
		echo ""
		ask
	fi
fi

第二部分

#########################################################################
# File Name: security_config.sh
# Author:Superjay09
# mail: xxxx@qq.com
# Created Time: 2019-11-27
#########################################################################
#/bin/bash

WORKDIR=$(cd "$(dirname $0)";pwd)

if [ `whoami` == "root" ];then 
####################GET SYSTEM INFORMATION####################
SYSTEM_VERSION=$(cat /etc/redhat-release)
SYSTEM_CPU_MODEL=$(cat /proc/cpuinfo | grep "model name" | awk -F: '{print $2}')
SYSTEM_CPU_NUMBERS=$(grep 'physical id' /proc/cpuinfo | sort -u | wc -l)
SYSTEM_CPU_CORE=$(grep 'core id' /proc/cpuinfo | sort -u | wc -l)
SYSTEM_CPU_PROCESSOR=$(grep 'processor' /proc/cpuinfo | sort -u | wc -l)
AVAILABLE_MEMORY_SIZE=$(free -m | grep "Mem" | awk '{print $2}')
SYSTEM_DISK_SIZE=$(lsblk | grep disk | awk '{print $4}')

echo ""
echo "#----------------------SYSTEM BRIEF INFORMATION-----------------------#"
echo -e "\033[32mSystem_version: $SYSTEM_VERSION\033[0m"
echo -e "\033[32mSystem_cpu_model: $SYSTEM_CPU_MODEL\033[0m"
echo -e "\033[32mSystem_cpu_numbers: $SYSTEM_CPU_NUMBERS\033[0m"
echo -e "\033[32mSystem_cpu_core: $SYSTEM_CPU_CORE\033[0m"
echo -e "\033[32mSystem_cpu_processor: $SYSTEM_CPU_PROCESSOR\033[0m"
echo -e "\033[32mAviailable_memory_size: $AVAILABLE_MEMORY_SIZE MB\033[0m"
echo -e "\033[32mSystem_disk_size: $SYSTEM_DISK_SIZE\033[0m"
echo "#---------------------------------------------------------------------#"
echo ""
###############################################################

#####################CHECKING SYSTEM USER######################
NOPASSWD=$(awk -F: '($2==""){
   print $1}' /etc/shadow)
INROOT=$(awk -F: '($3==0){print $1}' /etc/passwd)

if [ -z "$NOPASSWD" ];then
	echo -e  "\033[32mUsers who do not have a blank password for this system\033[0m"
	echo ""
	echo "#---------------------------------------------------------------------#"
else
	for user in $NOPASSWD;
	do 
		echo -e "\033[31m[$user] is a blank password\033[0m"
		echo -e "\033[31mDeactivating [$user] account\033[0m"
		echo ""
		echo "#################################################################"
		passwd -l $user > /dev/null 2>&1
	done
fi 

if [ "$INROOT" == "root" ];then
	echo ""
    echo -e  "\033[32mOnly root has administrator rights in the system\033[0m"
	echo ""
	echo "#---------------------------------------------------------------------#"
else
    for permission in $INROOT;
    do 
        echo -e "\033[31mUser [$permission] has administrator privileges\033[0m"
        echo -e "\033[31mPlease confirm whether to add for administrator\033[0m"
		echo ""
         
     done
 fi 
##############################################################
#########################DISABLE ICMP#########################
ICMP_CONFIG="/proc/sys/net/ipv4/icmp_echo_ignore_all"
echo ""
if [ `cat $ICMP_CONFIG` == "0" ];then 
	echo -e "\033[32mDisabling ICMP operation\033[0m"
	echo "1" > $ICMP_CONFIG 
	echo -e "\033[32mPing operation disabled\033[0m"
	echo ""
	echo "#---------------------------------------------------------------------#"
else
	echo -e "\033[32mPing operation disabled\033[0m"
	echo ""
	echo "#---------------------------------------------------------------------#"
fi
#############################################################
####################OPENSSH CONFIG###########################
cp -r /etc/ssh/sshd_config /etc/ssh/sshd_config.default
cp -r $WORKDIR/sshd_config /etc/ssh/

BANNER_FILE="/etc/banner"
if [ -s "$BANNER_FILE" ];then
	echo ""
	echo -e "\033[32mBanner information has been established\033[0m"
	echo ""
	echo "#---------------------------------------------------------------------#"
else
	if [ -f "/etc/issue" ] && [ -f "/etc/issue.net" ];then 
		mv /etc/issue /etc/issue.bak
		mv /etc/issue.net /etc/issue.net.bak 
	fi 

	cp -r $WORKDIR/banner $BANNER_FILE 

	if [ -s "$BANNER_FILE" ];then
       echo ""
       echo -e "\033[32mBanner information has been established\033[0m"
       echo ""
       echo "#--------------------------------------------------------------------    -#"
	else
       echo ""
        echo -e "\033[31mBanner information changed failed\033[0m"
        echo ""
        echo "#-------------------------------------------------------------------    --#"
	fi 
	systemctl restart sshd.service
fi
############################################################
SSHD_TIME_STAMP=$(stat /etc/ssh/sshd_config | grep Modify | awk -F. '{print $1}' | awk '{print $2 $3}' | sed 's/\-//g' | sed 's/\://g'

最低0.47元/天解锁文章