1、登陆超时时间设置,300秒
[ ! -z "$(cat /etc/profile | egrep "^TMOUT")" ] && sed -i "/^TMOUT/c\TMOUT=300" /etc/profile || echo "TMOUT=300" >> /etc/profile
2、启用远程日志功能
[ -f /etc/syslog.conf ] || echo "*.* @192.168.0.1" > /etc/syslog.conf
[ ! -z "$(cat /etc/syslog.conf | egrep "^[^#].*\..*\s*\@((((2[0-4]\d|25[0-5]|[01]?\d\d?)\.){3}(2[0-4]\d|25[0-5]|[01]?\d\d?))|.*\.*)")" ] || echo "*.* @192.168.0.1" >> /etc/syslog.conf
[ -f /etc/rsyslog.conf ] || echo "*.* @192.168.0.1" > /etc/rsyslog.conf
[ ! -z "$(cat /etc/rsyslog.conf | egrep "^[^#].*\..*\s*\@((((2[0-4]\d|25[0-5]|[01]?\d\d?)\.){3}(2[0-4]\d|25[0-5]|[01]?\d\d?))|.*\.*)")" ] || echo "*.* @192.168.0.1" >> /etc/rsyslog.conf
3、限制 root 用户远程登录
cp /etc/ssh/sshd_config /etc/ssh/sshd_config$(date "+%Y%m%d%H%M%S")
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do grp_and="";for grp in $(groups $user | cut -d":" -f2);do grp_and=${grp_and:+${grp_and}","}$grp;done; usermod -G ${grp_and:+${grp_and}","}"wheel" $user ;done
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do id $user;done
[ -n "$(cat /etc/ssh/sshd_config | egrep "^PermitRootLogin")" ] && sed -i "/^PermitRootLogin/c\PermitRootLogin no" /etc/ssh/sshd_config || echo "PermitRootLogin no" >> /etc/ssh/sshd_config
4、设置密码过期时间,90天
[ -n "$(cat /etc/login.defs | grep ^PASS_MAX_DAYS)" ] && sed -i "/^PASS_MAX_DAYS/c\PASS_MAX_DAYS 90" /etc/login.defs || echo "PASS_MAX_DAYS 90" >> /etc/login.defs
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1);do chage -M 99999 -W 7 $user;done
5、配置密码复杂度
以下适用于centos7
sed -i "/^password\s*requisite\s*pam_cracklib\.so /d" /etc/pam.d/system-auth
sed -i "/^password\s*requisite\s*pam_pwquality\.so /d" /etc/pam.d/system-auth
echo "password requisite pam_cracklib.so try_first_pass retry=3 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 minlen=8 minclass=3" >> /etc/pam.d/system-auth
echo "password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=" >> /etc/pam.d/system-auth
[ -n "$(cat /etc/login.defs | grep ^PASS_MIN_LEN)" ] && sed -i "/^PASS_MIN_LEN/c\PASS_MIN_LEN 8" /etc/login.defs || echo "PASS_MIN_LEN 8" >> /etc/login.defs
6、限制用户su到root
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do grp_and="";for grp in $(groups $user | cut -d":" -f2);do grp_and=${grp_and:+${grp_and}","}$grp;done; usermod -G ${grp_and:+${grp_and}","}"wheel" $user ;done
for user in $( cat /etc/passwd | grep "/bin/bash" | cut -d":" -f1 );do id $user;done
sed -i "/^auth\s*required\s*pam_wheel.so/d" /etc/pam.d/su
[ -n "$(cat /etc/pam.d/su | egrep "^\s*auth\s*sufficient\s*.*pam_rootok\.so")" ] || echo "auth sufficient pam_rootok.so" >> /etc/pam.d/su
[ -n "$(cat /etc/pam.d/su | egrep "^\s*auth\s*required\s*.*pam_wheel.so\s*group\s*\=\s*wheel")" ] || echo "auth required pam_wheel.so group=wheel" >> /etc/pam.d/su
7、删除潜在危险文件
rm -rf /.rhost
rm -rf /.netrc
rm -rf /etc/hosts.equiv
8、记录 cron 行为日志
[ -n "$(cat /etc/rsyslog.conf | egrep "^\s*cron\.\*")" ] || echo "cron.* /var/log/cron" >> /etc/rsyslog.conf
[ -n "$(cat /etc/syslog.conf | egrep "^\s*cron\.\*")" ] || echo "cron.* /var/log/cron" >> /etc/syslog.conf
9、配置日志文件安全权限
chmod 600 /var/log/messages
chmod 600 /var/log/secure
chmod 600 /var/log/maillog
chmod 600 /var/log/cron
chmod 600 /var/log/spooler
chmod 600 /var/log/boot.log