Linux服务器基线配置

1、登陆超时时间设置，300秒

[ ! -z "$(cat /etc/profile | egrep "^TMOUT")" ] && sed -i "/^TMOUT/c\TMOUT=300" /etc/profile || echo "TMOUT=300" >> /etc/profile

2、启用远程日志功能

[ -f /etc/syslog.conf ] || echo "*.*   @192.168.0.1" > /etc/syslog.conf
[ ! -z "$(cat /etc/syslog.conf | egrep "^[^#].*\..*\s*\@((((2[0-4]\d|25[0-5]|[01]?\d\d?)\.){3}(2[0-4]\d|25[0-5]|[01]?\d\d?))|.*\.*)")" ] || echo "*.*   @192.168.0.1" >> /etc/syslog.conf

[ -f /etc/rsyslog.conf ] || echo "*.*   @192.168.0.1" > /etc/rsyslog.conf
[ ! -z "$(cat /etc/rsyslog.conf | egrep "^[^#].*\..*\s*\@((((2[0-4]\d|25[0-5]|[01]?\d\d?)\.){3}(2[0-4]\d|25[0-5]|[01]?\d\d?))|.*\.*)")" ] || echo "*.*   @192.168.0.1" >> /etc/rsyslog.conf

3、限制 root 用户远程登录

cp /etc/ssh/sshd_config /etc/ssh/sshd_config$(date "+%Y%m%d%H%M%S")
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do grp_and="";for grp in $(groups $user | cut -d":" -f2);do grp_and=${grp_and:+${grp_and}","}$grp;done; usermod -G ${grp_and:+${grp_and}","}"wheel" $user ;done
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do id $user;done
[ -n "$(cat /etc/ssh/sshd_config | egrep "^PermitRootLogin")" ] && sed -i "/^PermitRootLogin/c\PermitRootLogin no"  /etc/ssh/sshd_config || echo "PermitRootLogin no" >>  /etc/ssh/sshd_config

4、设置密码过期时间，90天

[ -n "$(cat /etc/login.defs | grep ^PASS_MAX_DAYS)" ] && sed -i "/^PASS_MAX_DAYS/c\PASS_MAX_DAYS   90" /etc/login.defs || echo "PASS_MAX_DAYS   90" >> /etc/login.defs
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1);do chage -M 99999 -W 7 $user;done

5、配置密码复杂度

以下适用于centos7

sed -i  "/^password\s*requisite\s*pam_cracklib\.so /d" /etc/pam.d/system-auth
sed -i  "/^password\s*requisite\s*pam_pwquality\.so /d" /etc/pam.d/system-auth
echo "password    requisite     pam_cracklib.so  try_first_pass retry=3 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 minlen=8 minclass=3" >> /etc/pam.d/system-auth
echo "password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=" >> /etc/pam.d/system-auth
[ -n "$(cat /etc/login.defs | grep ^PASS_MIN_LEN)" ] && sed -i "/^PASS_MIN_LEN/c\PASS_MIN_LEN    8" /etc/login.defs || echo "PASS_MIN_LEN    8" >> /etc/login.defs

6、限制用户su到root

for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do grp_and="";for grp in $(groups $user | cut -d":" -f2);do grp_and=${grp_and:+${grp_and}","}$grp;done; usermod -G ${grp_and:+${grp_and}","}"wheel" $user ;done
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do id $user;done
sed -i "/^auth\s*required\s*pam_wheel.so/d" /etc/pam.d/su
[ -n "$(cat /etc/pam.d/su | egrep "^\s*auth\s*sufficient\s*.*pam_rootok\.so")" ] || echo "auth       sufficient    pam_rootok.so" >> /etc/pam.d/su
[ -n "$(cat /etc/pam.d/su | egrep "^\s*auth\s*required\s*.*pam_wheel.so\s*group\s*\=\s*wheel")" ] ||  echo "auth       required    pam_wheel.so group=wheel" >> /etc/pam.d/su

7、删除潜在危险文件

rm -rf /.rhost
rm -rf /.netrc
rm -rf /etc/hosts.equiv

8、记录 cron 行为日志

[ -n "$(cat /etc/rsyslog.conf | egrep "^\s*cron\.\*")" ] || echo "cron.*                                                  /var/log/cron" >> /etc/rsyslog.conf
[ -n "$(cat /etc/syslog.conf | egrep "^\s*cron\.\*")" ] || echo "cron.*                                                  /var/log/cron" >> /etc/syslog.conf

9、配置日志文件安全权限

chmod 600 /var/log/messages
chmod 600 /var/log/secure
chmod 600 /var/log/maillog
chmod 600 /var/log/cron
chmod 600 /var/log/spooler
chmod 600 /var/log/boot.log