2021-05-11

一，限制使用su命令
1.修改配置认证文件/etc/pam.d/su, 启用 pam——wheel.so认证模块
[root@centos ~]# head -3 /etc/pam.d/su
#%PAM-1.0
auth sufficient pam_rootok.so
2.将admin用户加入到wheel组
[root@centos ~]# useradd radmin
[root@centos ~]# gpasswd -a radmin wheel
正在将用户“radmin”加入到“wheel”组中
[root@centos ~]# grep wheel /etc/group
wheel❌10:radmin

3.验证除了root.remdin以外 其他用户均不能使用su用户进行切换
[root@centos ~]# su radmin
[radmin@centos root]$ su
密码：
二，设置sudo授权
1.授权用户zhangsan使用useradd userdel passwd usermod命令 但禁止执行“passwd root ” “usermod * root”操作
[root@centos ~]# gpasswd -a zhangsan wheel
正在将用户“zhangsan”加入到“wheel”组中
[root@centos ~]# su zhangsan
[zhangsan@centos root]$ sudo useradd lisi

2.授权lisi用户使用/sbin/*、/usr/sbin/命令，添加NOPASSWD以取消验证
[root@centos01 ~]# useradd lisi
[root@centos01 ~]# passwd lisi
lisi centos01=NOPASSWD:/sbin/,/usr/sbin/
添加Defaults logfile配置行以启用sudo日志
[root@centos01 ~]# vim /etc/sudoers
Defaults logfile = “/var/log/sudo”

3.限制引导及登录过程
禁用ctrl+alt+del快捷键禁止root用户从tty5，tty6登录

1.禁用ctrl+alt+del快捷键
[root@centos ~]# cat /etc/inittab
[root@centos01 ~]# systemctl mask ctrl+alt+del.target
Created symlink from /etc/systemd/system/ctrl\x2balt\x2bdel.target to /dev/null.

2.重新加载服务
[root@centos01 ~]# systemctl daemon-reload

3.限制用户登录tty5、6终端登录
[root@centos01 ~]# vim /etc/securetty
#tty5
#tty6

4.为GRUB引导菜单设置密码
[root@centos01 ~]# grub2-mkpasswd-pbkdf2
输入口令：
Reenter password:
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.11264A99B4CB3A367DE30B32785A575F61FA2982AB88C9398BD77190CB9404AE32A8A5CE9B6C0C19183ABFC07A95670F42ABA145533D51C5708767D01B154B91.F8D7A903D67E0B75425345523568A74C54096FE1F51B5E9E994D38A4ADE6A9A4FFFABB9AAB73595223F22E9B99ECD44F81E8D6943CB5A7F7E3E8D602116872C8备份引导菜单
[root@centos01 ~]# cp /boot/grub2/grub.cfg /boot/grub2/grub.cfg.bak
[root@centos01 ~]# cp /etc/grub.d/00_header /etc/grub.d/00_header.bak

.修改grub引导菜单加载密码
[root@centos01 ~]# vim /etc/grub.d/00_header
cat <<EOF

set superusers=“root”
password_pbkdf2 root grub.pbkdf2.sha512.10000.11264A99B4CB3A367DE30B32785A575F61FA2982AB88C9398BD77190CB9404AE32A8A5CE9B6C0C19183ABFC07A95670F42ABA145533D51C5708767D01B154B91.F8D7A903D67E0B75425345523568A74C54096FE1F51B5E9E994D38A4ADE6A9A4FFFABB9AAB73595223F22E9B99ECD44F81E8D6943CB5A7F7E3E8D602116872C8EOF

6.生成grub引导菜单
[root@centos01 ~]# grub2-mkconfig -o /boot/grub2/grub.cfg

Generating grub configuration file …
Found linux image: /boot/vmlinuz-3.10.0-693.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-693.el7.x86_64.img
Found linux image: /boot/vmlinuz-0-rescue-7c3b239e3c254776a1b0604a08bfd864
Found initrd image: /boot/initramfs-0-rescue-7c3b239e3c254776a1b0604a08bfd864.img