Linux系统安全及应用

/etc/sudoers

[root@localhost ~]# visudo

zhangsan localhost=/sbin/ifconfig

lisi localhost=/sbin/*,!/sbin/ifconfig,!/sbin/route

%wheel ALL=NOPASSWD: ALL

备注：

user MACHINE=COMMANDS，多个命令可以用逗号隔开

ALL=NOPASSWD: ALL 表示无需验证密码即可执行任何命令

lisi ALL=(ALL) NOPASSWD: ALL

sudo日志
[root@localhost ~]# visudo

添加：

Defaults logfile = "/var/log/sudo"

验证

使用lisi用户执行命令

[root@localhost ~]# su - lisi

[lisi@localhost ~]$ sudo lvscan

ACTIVE '/dev/centos/swap' [4.00 GiB] inherit

ACTIVE '/dev/centos/root' [193.99 GiB] inherit

[lisi@localhost ~]$ exit

[root@localhost ~]# cat /var/log/sudo

Jun 23 20:20:02 : lisi : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=/sbin/lvscan

grub引导密码
密文：字符加密
[root@localhost ~]# grub2-mkpasswd-pbkdf2

输入口令：

Reenter password:

PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.2FC29375F7DCBEC6F8D28444EEC806FBC572A3BA3185B7D1F9FA5708D58719DC8A3C2F7FB1EA33B407B9B98691354D49089118049BF5672E5E51BBE59807EA65.5FD51B1C7FAEFD9F3F6E51D027EF3024AEA90B2633309020F2AB3BBB48444FC4435DBFB6578B8B49DF2D393D03FC564B23936C6C5F10A4FE37392C0054462AEC

[root@localhost ~]# vim /etc/grub.d/01_users

cat << EOF

set superusers="root"

export superusers

password_pbkdf2 root grub.pbkdf2.sha512.10000.2FC29375F7DCBEC6F8D28444EEC806FBC572A3BA3185B7D1F9FA5 708D58719DC8A3C2F7FB1EA33B407B9B98691354D49089118049BF5672E5E51BBE59807EA65.5FD51B1C7FAEFD9F3F6E51D027EF3024AEA90B2633309020F2AB3BBB48444FC4435DBFB6578B8B49DF2D393D03FC564B23936C6C5F10A4FE37392C0054462AEC

EOF

[root@localhost ~]# grub2-mkconfig -o /boot/grub2/grub.cfg

重启进入GRUB测试密码

在GRUB菜单处第一行按下字母e，提示输入账号和密码

明文：不加密
[root@localhost ~]# vi /etc/grub.d/01_users

cat << EOF

set superusers="root"

password root pwd123

EOF

[root@localhost ~]# grub2-mkconfig -o /boot/grub2/grub.cfg

终端
tty（6个）

[root@localhost ~]# vi /etc/securetty

若要禁止 root 用户从 tty5、tty6 登录，就注释掉tty5和tty6

#tty5

#tty6

修改能登陆的终端数量

[root@localhost ~]# vim /etc/systemd/logind.conf

NAutoVTs=12

[root@localhost ~]# systemctl restart systemd-logind

禁止普通用户登录

[root@localhost ~]# touch /etc/nologin

密码字典

1：安装 John the Ripper

[root@localhost ~]# tar zxf john-1.8.0.tar.gz

[root@localhost ~]# cd john-1.8.0

[root@localhost john-1.8.0]# cd src/

[root@localhost src]# yum -y install gcc

[root@localhost src]# make clean linux-x86-64

2：检测弱口令

[root@localhost src]# cp /etc/shadow /root/shadow.txt

[root@localhost src]# cd /root/john-1.8.0/run/

[root@localhost run]# ./john /root/shadow.txt

查看检测结果

[root@localhost run]# ./john --show /root/shadow.txt

3：使用密码字典检测

[root@localhost run]# vim /root/pass.list

编写密码字典，将所有的用户密码写进去

[root@localhost run]# ./john --wordlist=/root/pass.list /root/shadow.txt

[root@localhost run]# ./john --show /root/shadow.txt

root:aptech::0:99999:7:::

lisi:111:19166:0:50:7:::

2 password hashes cracked, 1 left

网络扫描

1：安装NMAP包

[root@localhost ~]# yum install -y nmap

2：扫描语法及类型

[root@localhost ~]# nmap 127.0.0.1

[root@localhost ~]# nmap -sU 127.0.0.1 ##扫描常用端口

[root@localhost ~]# ifconfig

[root@localhost ~]# nmap -p 21 192.168.10.0/24    ##扫描网段中哪些主机启用的端口21

[root@localhost ~]# nmap -n -sP 192.168.10.0/24   ##扫描存活主机

[root@localhost ~]# nmap -p 139,445 192.168.10.10-20    扫描主机是否开了共享