linux基线检查、基线加固、安全漏扫、系统漏洞、centos7、文尾部附脚本

等保三级-CentOS Linux 7合规基线检查

风险分类:系统-等保三级-CentOS Linux 7合规基线检查

检测项说明:

CentOS Linux 7合规基线检查,对标中国等保2.0第三级等级保护基本要求部分检查项目,仅供参考

检查项目 : 应对登录的用户进行身份标识和鉴别,身份标识具有唯一性,身份鉴别信息具有复杂度要求并定期更换

加固建议: 
1、执行`cat /etc/shadow | awk -F: '($2 == "" ) { print $1}' `, 查看空密码账户并处理;
2、查看`/etc/passwd`,检查是否有重复UID的用户并清理; 
3、编辑`/etc/security/pwquality.conf` ,密码最小长度`minlen`设置为8-32之间,`minclass`设置3或4,如 `minlen=10` `minclass=3` 
4、定期更换密码,在 `/etc/login.defs` 中将`PASS_MAX_DAYS`参数设置为 `30-90`之间,如 `PASS_MAX_DAYS 90`。需同时执行命令设置root密码失效时间:`chage --maxdays 90 root` 
5、设置密码最短修改时间,在 `/etc/login.defs` 中将`PASS_MIN_DAYS`参数设置为 `7-14`之间,如 `PASS_MIN_DAYS 7`。需时执行命令为root用户设置:`chage --mindays 7 root `
6、在`/etc/pam.d/password-auth`和`/etc/pam.d/system-auth`中`password sufficient pam_unix.so` 这行的末尾配置`remember`参数为`5-24`之间,建议设为5,即行末尾加`remember=5` 
7、除root以外其他UID为0的用户,都应该删除或者修改其UID

检查项目 : 当对服务器进行远程管理时,应采取必要措施,防止鉴别信息在网络传输过程中被窃听

加固建议: 
1、编辑 `/etc/ssh/sshd_config` 文件设置参数(Centos7无需配置):` Protocol 2 ` 
2、执行命令`service sshd restart`重启sshd服务 
3、执行以下命令停止Telnet服务: ```systemctl stop telnet.socket systemctl disable telnet.socket ```

检查项目 : 应具有登录失败处理功能,应配置并启用结束会话、限制非法登录次数和当登录连接超时自动退出等相关措施

加固建议: 
1、配置登陆失败锁定,编辑`/etc/pam.d/password-auth`和`/etc/pam.d/system-auth`文件,在非注释行的第一行添加以下行(deny为连续失败次数,配置为3-8次,unlock_time为解锁时间,配置为600-1800秒) ```auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900 ```
2、设置系统登陆不活动连接超时退出,编辑`/etc/profile`,将`TMOUT` 设置为300到1800,即5-30分钟 ```TMOUT=900 ```
3、在`/etc/ssh/sshd_config`中取消`MaxAuthTries`注释符号#,设置最大密码尝试失败次数3-6,建议为5:`MaxAuthTries 5`

检查项目 : 应重命名或删除默认账户,修改默认账户的默认口令

加固建议: 
1、(注意:禁止root账户登陆前确保有其他账户可以正常使用)编辑配置文件`/etc/ssh/sshd_config`,将`PermitRootLogin yes` 改为`PermitRootLogin no` 
2、执行`service sshd restart`重启ssh 
3、root之外的系统默认帐户、数据库帐户禁止登陆(non-login) 
4、确保所有系统用户的密码都设置为复杂密码

检查项目 : 访问控制的粒度应达到主体为用户级或进程级,客体为文件、数据库表级

加固建议: 
1、执行以下4条命令: ```chown root:root /etc/hosts.allow chown root:root /etc/hosts.deny chmod 644 /etc/hosts.deny chmod 644 /etc/hosts.allow ```
2、执行以下5条命令 ```chown root:root /etc/passwd /etc/shadow /etc/group /etc/gshadow chmod 0644 /etc/group chmod 0644 /etc/passwd chmod 0400 /etc/shadow chmod 0400 /etc/gshadow ```
3、设置 /etc/ssh/sshd_config 的权限: ```chown root:root /etc/ssh/sshd_config chmod 600 /etc/ssh/sshd_config ```
4、配置/etc/profile文件权限: ```chown root:root /etc/profile chmod 644 /etc/profile ```

检查项目 : 审计记录应包括事件的日期和时间、用户、事件类型、事件是否成功及其他与审计相关的信息

加固建议: 满足另外一个检查项:启用安全审计功能,即满足此项。

检查项目 : 应启用安全审计功能,审计覆盖到每个用户,对重要的用户行为和重要安全事件进行审计

加固建议: 
1、执行命令启用auditd服务:`systemctl start auditd `; 
2、执行命令`systemctl start rsyslog `启用rsyslog服务; 
3、将以下行添加到/etc/audit/rules.d/audit.rules和/etc/audit/audit.rules 文件中: ```-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete ```
4、将以下行添加到/etc/audit/rules.d/audit.rules和/etc/audit/audit.rules 文件中: ```-w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w 
/etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity ```
5、将以下行添加到/etc/audit/rules.d/audit.rules和/etc/audit/audit.rules 文件中: ```-w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope ```重启:auditd: `service auditd restart`

系统-阿里云标准-CentOS Linux 7安全基线检查

风险分类:系统-阿里云标准-CentOS Linux 7安全基线检查

检测项说明:

基于阿里云最佳实践安全实践的CentOS Linux 7基线标准

检查项目 : 设置密码失效时间

加固建议: 
`使用非密码登陆方式如密钥对,请忽略此项。`
在 /etc/login.defs 中将 PASS_MAX_DAYS 参数设置为 60-180之间,如: ```PASS_MAX_DAYS 90 ```需同时执行命令设置root密码失效时间: ```chage --maxdays 90 root ```

检查项目 : 设置密码修改最小间隔时间

加固建议: 在 /etc/login.defs 中将 PASS_MIN_DAYS 参数设置为7-14之间,
建议为7: ```PASS_MIN_DAYS 7 ```需同时执行命令为root用户设置: ```chage --mindays 7 root ```

检查项目 : 密码复杂度检查

加固建议: 编辑/etc/security/pwquality.conf,把minlen(密码最小长度)设置为9-32位,把minclass(至少包含小写字母、大写字母、数字、特殊字符等4类字符中等3类或4类)设置为3或4。如: ```minlen=10 minclass=3 ```

检查项目 : 检查密码重用是否受限制

加固建议: 在/etc/pam.d/password-auth和/etc/pam.d/system-auth中password sufficient pam_unix.so 这行的末尾配置remember参数为5-24之间,原来的内容不用更改,只在末尾加了remember=5。

检查项目 : 确保SSH MaxAuthTries设置为3到6之间

加固建议: 在/etc/ssh/sshd_config中取消MaxAuthTries注释符号#,设置最大密码尝试失败次数3-6,建议为4: ```MaxAuthTries 4 ```

检查项目 : SSHD强制使用V2安全协议

加固建议: 
编辑 /etc/ssh/sshd_config 文件以按如下方式设置参数: ```Protocol 2 ```

检查项目 : 设置SSH空闲超时退出时间

加固建议: 
编辑/etc/ssh/sshd_config,将ClientAliveInterval 设置为300到900,即5-15分钟,将ClientAliveCountMax设置为0-3之间。 ```ClientAliveInterval 600 ClientAliveCountMax 2 ```

检查项目 : 确保SSH LogLevel设置为INFO

加固建议: 
编辑 /etc/ssh/sshd_config 文件以按如下方式设置参数(取消注释): ```LogLevel INFO ```

基线加固脚本(centos7)

#!/bin/bash
# 基于阿里云最佳实践安全实践的CentOS Linux 7基线标准
# 系统-等保三级-CentOS Linux 7合规基线检查
sed -i.bak -e 's/^\(PASS_MAX_DAYS\).*/\1   180/' /etc/login.defs
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chage --maxdays 180 root
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i.bak -e 's/^\(PASS_MIN_DAYS\).*/\1   7/' /etc/login.defs
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chage --mindays 7 root
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/# minclass = 0/minclass = 3/g' /etc/security/pwquality.conf
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/# minlen = 9/minlen = 9/g' /etc/security/pwquality.conf
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok/password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5/g' /etc/pam.d/password-auth
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok/password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5/g' /etc/pam.d/system-auth
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/#MaxAuthTries 6/MaxAuthTries 4/g' /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo 'Protocol 2' >> /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
#ssh超时时间
sed -i 's/#ClientAliveInterval 0/ClientAliveInterval 900/g' /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/#ClientAliveCountMax 3/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/#LogLevel INFO/LogLevel INFO/g' /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
service sshd restart
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i '/# User/a\auth        required      pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900' /etc/pam.d/password-auth
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i '/# User/a\auth        required      pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900' /etc/pam.d/system-auth
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo 'TMOUT=900' >> /etc/profile
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
sed -i 's/PermitRootLogin yes/PermitRootLogin yes/g' /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
service sshd restart
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi

chown root:root /etc/hosts.allow 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chown root:root /etc/hosts.deny 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 644 /etc/hosts.deny 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 644 /etc/hosts.allow
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chown root:root /etc/passwd /etc/shadow /etc/group /etc/gshadow 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 0644 /etc/group 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 0644 /etc/passwd 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 0400 /etc/shadow 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 0400 /etc/gshadow
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chown root:root /etc/ssh/sshd_config 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 600 /etc/ssh/sshd_config
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chown root:root /etc/profile 
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
chmod 644 /etc/profile
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
systemctl start auditd
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
systemctl start rsyslog
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete' >> /etc/audit/rules.d/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete' >> /etc/audit/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo ' -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity' >> /etc/audit/rules.d/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo ' -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity' >> /etc/audit/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo ' -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope' >> /etc/audit/rules.d/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
echo ' -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope' >> /etc/audit/audit.rules
if [ "$?" == 0 ]
then
   echo -e "\033[32m True \033[0m"
else
   echo -e "\033[31m False \033[0m"
fi
systemctl stop rpcbind &>/dev/null
systemctl stop rpcbind.socket &>/dev/null
systemctl disable rpcbind.socket &>/dev/null
systemctl disable rpcbind.socket &>/dev/null

已标记关键词 清除标记
©️2020 CSDN 皮肤主题: 游动-白 设计师:白松林 返回首页