linux shell脚本 基线加固

待完善！。。。

echo --------备份-----------------------
cp /etc/login.defs /etc/login.defs.bak
cp /etc/security/limits.conf /etc/security/limits.conf.bak
cp /etc/pam.d/su  /etc/pam.d/su.bak
cp /etc/profile /etc/profile.bak
cp /etc/issue.net /etc/issue.net.bak
cp /etc/shadow /etc/shadow.bak
cp /etc/passwd /etc/passwd.bak
cp /etc/pam.d/passwd  /etc/pam.d/passwd.bak
cp /etc/pam.d/common-password /etc/pam.d/common-password.bak
cp /etc/host.conf /etc/host.conf.bak
cp /etc/hosts.allow /etc/hosts.allow.bak
cp /etc/ntp.conf /etc/ntp.conf.bak
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak

echo --------检查是否设置口令更改最小间隔天数-----
MINDAY=`cat -n /etc/login.defs | grep -v ".*#.*"| grep PASS_MIN_DAYS|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_DAYS.*/PASS_MIN_DAYS 6/' /etc/login.defs
echo "检查口令更改最小间隔天数完成"
echo --检查是否设置口令过期前警告天数---
WARNAGE=`cat -n /etc/login.defs | grep -v ".*#.*"| grep PASS_WARN_AGE|awk '{print $1}'`
sed -i ''$WARNAGE's/.*PASS_WARN.*/PASS_WARN_AGE 30/' /etc/login.defs
echo "检查口令过期前警告天数完成"

echo ---检查口令生存周期------
MAXDAY=`cat -n /etc/login.defs | grep -v ".*#.*"| grep PASS_MAX_DAYS|awk '{print $1}'`
sed -i ''$MAXDAY's/.*PASS_MAX.*/PASS_MAX_DAYS 90/' /etc/login.defs
echo "检查口令生存周期完成"

echo ---检查口令最小长度----
MINLEN=`cat -n /etc/login.defs | grep -v ".*#.*"| grep PASS_MIN_LEN|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_LEN.*/PASS_MIN_ LEN 6/' /etc/login.defs
echo "检查口令最小长度"

echo ----检查密码重复使用次数 
kk=`cat -n /etc/pam.d/system-auth | grep -v ".*#.*"| grep md5|awk '{print $1}'`
t="password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5"
sed -i ""$kk"c $t" /etc/pam.d/system-auth

echo ------用户认证登录失败次数限制------
w=`cat -n /etc/pam.d/login|grep PAM-1.0|awk '{print $1}'`
t="auth required pam_tally2.so onerr=fail deny=3 unlock_time=30 even_deny_root root_unlock_time=100"
sed -i ""$w"a $t" /etc/pam.d/login

echo "--------设置口令复杂度----------"
q = `cat -n /etc/pam.d/system-auth | grep -v ".*#.*" | grep 'password.*.requisite' | awk '{print $1}'`
t="password    requisite    pam_crackilb.so difok=3 minlen=8 ucredit=-1 lcredit=-1 dcredit=1"
sed -i ''$q'c $t' /etc/pam.d/system-auth

echo "---------添加登录超时设置---------"
echo export TMOUT=180 >> /etc/profile
source /etc/profile

echo "--------给history加上时间戳---------"
echo export HISTTIMEFORMAT="%F %T `whoami` " >> /etc/profile
source /etc/profile

echo -----------test grub,lilo-----------#启动引导程序 添加密码
grub="/etc/grub.conf"
if [ ! -x "$grub" ];then
touch "$grub"
echo password=123456 >> "$grub"
else 
echo password=123456 >> "$grub"
fi
lilo="/etc/lilo.conf"
if [ ! -x "$lilo" ];then
touch "$lilo"
echo password=123456 >> "$lilo"
else
echo password=123456 >> "$lilo"
fi

echo -------text ctrl-alt-del-----------
a=/usr/lib/systemd/system/ctrl-alt-del.target
if [ ! -e "$a"  ];then
echo ok!
else
rm -rf /usr/lib/systemd/system/ctrl-alt-del.target
init q
echo set ok!
fi

echo -------history number-------
sed -i 's/^HISTSIZE=1000/HISTSIZE=200/' /etc/profile
source /etc/profile
echo -------text wheel-----#wheel组内的用户才可以使用su root
echo -e  auth"\t\t"required"\t"pam_wheel.so use_uid >>"/etc/pam.d/su" 
echo -e auth "\t\t"sufficient"\t"pam_rootok.so >>"/etc/pam.d/su"
echo ok!

echo -------test issue------#删除开机欢迎界面的语句
if [ -f /etc/issue.net ]
then
mv /etc/issue.net /etc/issue.net.bak
else
echo "issue.net 文件不存在"
fi
if [ -f /etc/issue ]
then
mv /etc/issue /etc/issue.bak
else
echo "issue 文件不存在"
fi

echo "--------检查空口令账户-------"
i=`awk -F: '($2 == "") { print $1 }' /etc/shadow`
echo -e  "$i \n --空口令" >> info_temp
echo    "$i "
echo "---------检查uid为0的用户--------"
# awk -F: '($3== 0 ) {print $1 }' /etc/passwd
i=`awk -F: '{ if($3 == 0 ) print $1 }' /etc/passwd`
echo -e "$i \n --uid=0" >> info_temp
echo -e "$i \n --保存在info_temp"

echo "---------文件权限设置完成--------"
chmod 644 /etc/passwd
chmod 644 /etc/group
chmod 400 /etc/shadow
#chmod 600 /etc/xinetd.conf
chmod 644 /etc/services
chmod 600 /etc/security
chmod 600 /etc/grub.conf
chmod 600 /boot/grub/grub.conf
chmod 600 /etc/lilo.conf

待加入：
4、修改root umask值：/etc/ash.cssrc 设置为027
5、对于重要目录 只有root可以读写值执行这个目录下的脚本
chmod -R 750 /etc/rc.d/init.d/*
6、查找未授权的suid和sgid文件
7、检查任何人都有写权限的目录和文件
10、 /etc/ssh/sshd_config
设置 PERmitRootLogin 值为no
修改ssh使用协议版本 设置 protocol 版本为2

11、检查开启的服务
chkconfig --list 与管理员确认