Linux基于等保的安全加固

✍ 道路千万条，安全第一条。操作不规范，运维两行泪。

一、设置密码安全策略

1、修改 vim /etc/login.defs 文件

#vim /etc/login.defs
PASS_MAX_DAYS   90  　　     # 密码最长过期天数
PASS_MIN_DAYS   7  　　　    # 密码最小过期天数
PASS_MIN_LEN    8  　　　　  # 密码最小长度
PASS_WARN_AGE   14   　　　  # 密码过期警告天数

2、修改 vim /etc/security/pwquality.conf 文件

# vim /etc/security/pwquality.conf
minlen=8                         # 密码长度
minclass=3                       # 密码策略 3 表示大小写字母、数字、字符是少 3 类

3、修改 /etc/pam.d/password-auth 和 /etc/pam.d/system-auth 文件

password    sufficient     pam_sss.so use_authtok  remember=5  # 密码最大重用次数

二、修复系统账户

1、查看是否存在特权用户，通过判断 uid 是否为 0 来查找系统是否存在特权用户

awk -F: '$3==0 {print $1}' /etc/passwd

2、查看是否存在空口令用户

awk -F: 'length($2)==0 {print $1}' /etc/shadow

三、修复系统日志

1、添加审计账户

useradd audit
usermod -G audit audit

2、开启审计服务

# 检查服务是否存在
systemctl status auditd
# 如果不存在则安装
yum -y install audit audit-libs-devel
systemctl daemon-reload
systemctl enable auditd

配置审计规则：

1）简单版本

# vim /etc/audit/rules.d/audit.rules
-a exit,always -F arch=b64 -S umask -S chown -S chmod
-a exit,always -F arch=b64 -S unlink -S rmdir
-a exit,always -F arch=b64 -S setrlimit
-a exit,always -F arch=b64 -S setuid -S setreuid
-a exit,always -F arch=b64 -S setgid -S setregid
-a exit,always -F arch=b64 -S sethostname -S setdomainname
-a exit,always -F arch=b64 -S adjtimex -S settimeofday
-a exit,always -F arch=b64 -S mount -S _sysctl
-w /etc/group -p wa
-w /etc/passwd -p wa
-w /etc/shadow -p wa
-w /etc/sudoers -p wa
-w /etc/ssh/sshd_config
-w /etc/bashrc -p wa
-w /etc/profile -p wa
-w /etc/profile.d/
-w /etc/aliases -p wa
-w /etc/sysctl.conf -p wa
-w /var/log/lastlog
# Disable adding any additional rules - note that adding *new* rules will require a reboot

2）详细版本

cat >> /etc/audit/rules.d/audit.rules <<EOF
###记录系统的日期和时间的修改
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k timechange
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

####记录用户和组的修改的事件
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

####记录网络环境修改时间
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/sysconfig/network -p wa -k system-locale
-w /etc/sysconfig/network-scripts/ -p wa -k system-locale

####记录登录和登出事件
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins

####记录会话启动事件
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

####监视对文件权限、属性、所有权和组的更改
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

####记录未授权文件访问尝试
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

####收集成功挂载磁盘事件
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mount

####收集用户的文件删除事件
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

####收集对系统管理范围（sudoers）的更改
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

####收集内核模块加载和卸载
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

####收集使用特权命令
-a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/lib/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/libexec/utempter/utempter -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/libexec/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
EOF

重新加载规则

/sbin/augenrules --load

日志赋权

chown audit:audit -R /var/log
chown root:root -R /var/log/audit

3、日志权限设置，权限不得大于 640

chmod 640 /var/log/messages
chmod 640 /var/log/secure
chmod 640 /var/log/audit/audit.log

4、日志远程存储

#vim  /etc/rsyslog.conf
*.info;mail.none;news.none;authpriv.none;cron.none /var/log/messages
*.* @@172.16.x.xx:514
*.* @172.16.x.xx:514

三、限制远程登录

1、修改 /etc/ssh/sshd_config

# vim /etc/ssh/sshd_config
PermitEmptyPasswords no         # 禁止无密码访问服务器
MaxAuthTries 4                  # 用户最大认证次数
HostbasedAuthentication no      # 关闭openssh主机认证
# SSH空闲超时配置
ClientAliveInterval 300         # 小于等于300s
ClientAliveCountMax 3           # 存活用户数小于等于3

2、配置连接超时自动退出功能

echo "TMOUT=300">>/etc/profile
source /etc/profile

四、附检查修复脚本

1、基线检查脚本

#!/bin/bash
# ################ Descripthon ################
# Date: 2020-10-12
# Auth: Joker
# Mail: jokerbaix@163.com
# Version: v1
# Attention: 阿里云云服务器基线检测
# #############################################

IP=$(ifconfig eth0 | grep -w inet | awk '{print $2}')
NOW_TIME=$(date +"%Y-%m-%d-%T")

dash_line="------------------------------------------------------------------"
# 绿色字体输出检测通过
pass=$(($pass + 1))
print_pass() {
    echo -e "\033[32m++> PASS \033[0m"
    echo "++> PASS" >>"$file"
}
# 红色字体输出检测失败FAIL
fail=$(($fail + 1))
print_fail() {
    echo -e "\033[31m--> FAIL \033[0m"
    echo "--> FAIL" >>"$file"
}
# 黄色字体输出需手工再检查的项
print_manual_check() {
    echo -e "\033[33m##> Manual \033[0m"
    echo "##> Manual" >>"$file"
}
# 蓝色字体输出补充
print_info() {
    echo -e "\033[34m$1 \033[0m"
}
# 紫色字体输出检测项
print_check_point() {
    echo ""
    echo -e "\033[35m[No."$1"] "$2" \033[0m"
    echo "[$1]"" $2" >>"$file"
}
print_dot_line() {
    echo "$dash_line"
}
print_summary() {
    # 输出显示
    print_info "---------------------------- Summary -----------------------------"
    echo -e "\033[35m全部检测项: $1 \033[0m"
    echo -e "\033[32m通过检测项: $2 \033[0m"
    echo -e "\033[31m失败检测项: $3 \033[0m"
    echo -e "\033[33m手工检测项: $4 \033[0m"
    print_info "检测结果将写入文件 $file中..."
    print_info "$dash_line"
    # 写入文件
    echo "---------------------------- Summary -----------------------------" >>"$file"
    echo "全部检测项: $1" >>"$file"
    echo "通过检测项: $2" >>"$file"
    echo "失败检测项: $3" >>"$file"
    echo "手工检测项: $4" >>"$file"
    echo "$dash_line" >>"$file"
}
# ====================================
function check() {
    begin_msg="-------------------- 正在执行操作系统基线检查 --------------------"
    print_info "$begin_msg"
    index=0  # 检测项编号
    pass=0   # 通过的检测项数
    fail=0   # 未通过的检测项数
    manual=0 # 需手工复核的检测项数
    file="baseline_check_result.txt"

    echo "$begin_msg" >"$file"

    check_point="帐号管理-1:检查是否设置除root之外UID为0的用户"
    index=$(($index + 1))
    print_check_point $index "$check_point"

    print_info "'任何UID为0的帐户都具有系统上的超级用户特权，只有root账号的uid才能为0'"
    print_dot_line

    result=$(/bin/cat /etc/passwd | /bin/awk -F: '($3 == 0) { print $1 }')
    print_info "UID为0的用户如下:"
    print_info "[ $result ]"

    if [ "root" = $result ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi


    check_point="口令策略-1:检查是否设置口令生存周期 "
    index=$(($index + 1))
    print_check_point $index "$check_point"
    passmax=$(cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^#)
    print_info "'PASS_MAX_DAYS 应介于1~90'"
    print_dot_line
    print_info "$passmax"
    if [ -n "$passmax" ]; then
        days=$(echo $passmax | awk '{print $2}')
        if [ "$days" -gt 90 ]; then
            fail=$(($fail + 1))
            print_fail
        else
            pass=$(($pass + 1))
            print_pass
        fi
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-2:检查是否设置口令更改最小间隔天数 "
    index=$(($index + 1))
    print_check_point $index "$check_point"
    passmin=$(cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^#)
    print_info "'PASS_MIN_DAYS 应大于等于 7'"
    print_dot_line
    print_info "$passmin"
    if [ -n "$passmin" ]; then
        days=$(echo $passmin | awk '{print $2}')
        if [ "$days" -lt 7 ]; then
            fail=$(($fail + 1))
            print_fail
        else
            pass=$(($pass + 1))
            print_pass
        fi
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-3:检查是否设置口令过期前警告天数  "
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'口令过期前告警天数PASS_WARN_AGE应设置为 7'"
    print_dot_line
    pass_age=$(cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^#)
    print_info "$pass_age"
    if [ -n "$pass_age" ]; then
        days=$(echo $pass_age | awk '{print $2}')
        if [ "$days" -eq 7 ]; then
            pass=$(($pass + 1))
            print_pass
        else
            fail=$(($fail + 1))
            print_fail
        fi
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-4:检查设备密码复杂度策略"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'系统应设置密码复杂度策略，避免设置账号弱口令'"
    print_dot_line
    print_info "'密码长度>=8，且至少包含一个大写字母、小写字母、数字、特殊字符(可自定义密码复杂度策略)'"
    print_dot_line
    flag=0
    # 以下检查/etc/security/pwquality.conf文件中的内容
    # minlen为密码字符串长度，minclass为字符类别,至少包含小写字母、大写字母、数字、特殊字符等4类字符中等3类或4类
    print_info "检查/etc/security/pwquality.conf，如下:"
    line_minlen=$(cat /etc/security/pwquality.conf | grep minlen | grep -v ^#)
    line_minclass=$(cat /etc/security/pwquality.conf | grep minclass | grep -v ^#)

    if [ -n "$line_minlen" ] && [ -n "$line_minclass" ]; then
        minlen=$(echo "$line_minlen" | awk -F "=" '{print $2}' | awk '{gsub(/^\s+|\s+$/, "");print}')
        minclass=$(echo "$line_minclass" | awk -F "=" '{print $2}' | awk '{gsub(/^\s+|\s+$/, "");print}')
        if [ "$minlen" -ge 8 ] && [ "$minclass" -ge 4 ]; then
            print_info "minlen =>"" [ $minlen ]"
            print_info "minclass =>"" [ $minclass ]"
            flag=1
        fi
    fi
    if [ "$flag" -eq 1 ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-5:检查是否存在空口令账号"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'不允许存在空口令的账号'"
    print_dot_line
    tmp=$(/bin/cat /etc/shadow | /bin/awk -F: '($2 == "" ) { print "user " $1 " does not have a password "}')
    print_info '空口令账号:'"[ $tmp ]"
    if [ -z "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-6:检查密码重复使用次数限制"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    line=$(cat /etc/pam.d/system-auth | grep password | grep sufficient | grep pam_unix.so | grep remember | grep -v ^#)
    print_info "'口令重复使用限制次数 remember >=5'"
    print_dot_line
    print_info "[ $line ]"
    if [ -n "$line" ]; then
        times=$(echo $line | awk -F "remember=" '{print $2}')
        if [ $times -ge 5 ]; then
            pass=$(($pass + 1))
            print_pass
        else
            fail=$(($fail + 1))
            print_fail
        fi
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-7:检查账户认证失败次数限制"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_dot_line
    print_info "登录失败限制可以使用pam_tally2或pam.d，请手工检测/etc/pam.d/login和/etc/pam.d/sshd"
    print_info "建议配置：auth required pam_tally2.so deny=3 unlock_time=300 even_deny_root root_unlock_time=10"
    manual=$(($manual + 1))
    print_manual_check

    check_point="日志审计-1:检查是否对登录进行日志记录"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'设备应配置日志功能，对用户登录进行记录，记录内容包括用户登录使用的账号，登录是否成功，登录时间，以及远程登录时，用户使用的IP地址'"
    tmp=$(cat /etc/rsyslog.conf | grep /var/log/secure | egrep 'authpriv'.\('info|\*'\) | grep -v ^#)
    print_dot_line
    print_info "/etc/rsyslog.conf 文件中 authpriv 的配置如下所示:"
    print_info "[ $tmp ]"
    if [ -n "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="口令策略-8:检测是否允许空密码登录"
    index=$(($index+1))
    print_check_point $index "$check_point"
    print_info "应该禁止SSH空密码用户登录"
    print_dot_line
    tmp=`cat /etc/ssh/sshd_config | grep PermitEmptyPasswords | grep -v ^#`
    print_info "/etc/ssh/sshd_config中是否允许空密码登录配置如下所示:"
    print_info "$tmp"
    if [ -n "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="日志审计-2:检查日志文件权限设置"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    messages=$(stat -c %a /var/log/messages)
    dmesg=$(stat -c %a /var/log/dmesg)
    maillog=$(stat -c %a /var/log/maillog)
    secure=$(stat -c %a /var/log/secure)
    wtmp=$(stat -c %a /var/log/wtmp)
    cron=$(stat -c %a /var/log/cron)
    print_info "'设备应配置权限，控制对日志文件读取、修改和删除等操作'"
    print_info "推荐的文件权限:(不大于左侧值)"
    print_info "600 /var/log/messages"
    print_info "600 /var/log/secure、"
    print_info "600 /var/log/maillog、"
    print_info "600 /var/log/cron"
    print_info "644 /var/log/dmesg"
    print_info "664 /var/log/wtmp"
    print_dot_line
    print_info "目前的文件权限如下:"
    print_info $messages' /var/log/messages'
    print_info $dmesg' /var/log/dmesg  '
    print_info $maillog' /var/log/maillog  '
    print_info $secure' /var/log/secure  '
    print_info $wtmp' /var/log/wtmp  '
    print_info $cron' /var/log/cron  '
    if [ "$messages" -le 600 ] && [ "$secure" -le 600 ] && [ "$maillog" -le 600 ] && [ "$cron" -le 600 ] && [ "$dmesg" -le 644 ] && [ "$wtmp" -le 664 ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="日志审计-3:检查安全事件日志配置"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'设备应配置日志功能，记录对与设备相关的安全事件'"
    print_dot_line
    tmp=$(cat /etc/rsyslog.conf | grep /var/log/messages | egrep '\*.info;mail.none;authpriv.none;cron.none' | grep -v ^#)
    print_info "/etc/rsyslog.conf 文件中 /var/log/messages 的配置如下所示:"
    print_info "$tmp"
    if [ -n "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="日志审计-4:检查SSH的日志级别"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'确保SSH LogLevel设置为INFO,记录登录和注销活动'"
    print_dot_line
    tmp=$(cat /etc/ssh/sshd_config | grep LogLevel | grep -v ^#)
    print_info "/etc/ssh/sshd_config文件中SSH的日志级别配置如下所示:"
    print_info "$tmp"
    if [ -n "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="文件权限-1:检查重要目录或文件权限设置"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    passwd=$(stat -c %a /etc/passwd)
    shadow=$(stat -c %a /etc/shadow)
    group=$(stat -c %a /etc/group)
    print_info "'在设备权限配置能力内，根据用户的业务需要，配置其所需的最小权限'"
    print_info "建议文件权限:(不大于左侧值)"
    print_info "644 /etc/passwd"
    print_info "400 /etc/shadow"
    print_info "644 /etc/group"
    print_dot_line
    print_info "实际检测值为:"
    print_info "$passwd"" /etc/passwd"
    print_info "$shadow"" /etc/shadow"
    print_info "$group"" /etc/group"
    if [ "$passwd" -le 644 ] && [ "$shadow" -le 400 ] && [ "$group" -le 644 ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    check_point="其他配置-1:检查是否设置命令行界面超时退出"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'命令行界面超时自动登出时间TMOUT应不大于300s'"
    print_dot_line
    TMOUT=$(cat /etc/profile | grep -i TMOUT | grep -v ^#)
    if [ -z "$TMOUT" ]; then
        print_info "没有设置超时时间TMOUT"
        fail=$(($fail + 1))
        print_fail
    else
        TMOUT=$(cat /etc/profile | grep -i TMOUT | egrep -v ^\# | awk -F "=" '{print $2}')
        if [ "$TMOUT" -gt 300 ]; then
            print_info "TMOUT值过大:""$TMOUT"
            fail=$(($fail + 1))
            print_fail
        else
            print_info "TMOUT:""$TMOUT"
            pass=$(($pass + 1))
            print_pass
        fi
    fi

    check_point="其他配置-2:检查SSH最大密码尝试失败次数"
    index=$(($index + 1))
    print_check_point $index "$check_point"
    print_info "'设置最大密码尝试失败次数3-6，建议为4'"
    print_dot_line
    tmp=$(cat /etc/ssh/sshd_config | grep MaxAuthTries | grep -v ^#)
    print_info "/etc/ssh/sshd_config文件中SSH的最大密码尝试失败次数配置如下所示:"
    print_info "$tmp"
    if [ -n "$tmp" ]; then
        pass=$(($pass + 1))
        print_pass
    else
        fail=$(($fail + 1))
        print_fail
    fi

    print_summary $index $pass $fail $manual
}

# 开始检测并生成报告
check

2、基线修复脚本

#!/bin/bash
# ################ Descripthon ################
# Date: 2020-10-15
# Auth: Joker
# Mail: jokerbaix@163.com
# Version: v1
# Attention: 阿里云云服务器基线检测修复
# #############################################


# 修复前先备份所有配置文件
function backup() {
    now_time=$(date +%Y%m%d%H%M)
    cp /etc/login.defs /etc/login.defs.bak.${now_time}
    cp /etc/security/pwquality.conf /etc/security/pwquality.conf.bak.${now_time}
    cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.${now_time}
    cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak.${now_time}
    cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.${now_time}
    cp /etc/profile /etc/profile.bak.${now_time}
}

# 修改口令相关策略
function repair_pwd_policy() {
    # 更改口令最小间隔数
    grep '^PASS_MIN_DAYS   7' /etc/login.defs &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^PASS_MIN_DAYS/ d" /etc/login.defs
        echo 'PASS_MIN_DAYS   7' >>/etc/login.deeefs
        chage --mindays 7 root
    fi

    # 更改口令生存时间
    grep '^PASS_MAX_DAYS   90' /etc/login.defs &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^PASS_MAX_DAYS/ d" /etc/login.defs
        echo 'PASS_MAX_DAYS   90' >>/etc/login.deeefs
        chage --maxdays 90 root
    fi

    # 修改口令过期警告时间
    grep '^PASS_WARN_AGE   7' /etc/login.defs &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^PASS_WARN_AGE/ d" /etc/login.defs
        echo 'PASS_WARN_AGE   7' >>/etc/login.defs
    fi

    # 修改密码复杂度
    grep '^minlen=10' /etc/security/pwquality.conf &>/dev/null
    a=$?
    grep '^minclass=3' /etc/security/pwquality.conf &>/dev/null
    b=$?
    if [[ $a -ne 0 ]] && [[ $b -ne 0 ]]; then
        sed -i "/^minlen/ d" /etc/security/pwquality.conf
        sed -i "/^minclass/ d" /etc/security/pwquality.conf
        echo "minlen=10" >>/etc/security/pwquality.conf
        echo "minclass=3" >>/etc/security/pwquality.conf
    fi

    # 修改密码重用次数
    for file in /etc/pam.d/password-auth /etc/pam.d/system-auth; do
        grep 'password' $file | grep sufficient | grep remember &>/dev/null
        if [[ $? -ne 0 ]]; then
            grep 'use_authtok' $file &>/dev/null
            if [[ $? -eq 0 ]]; then #这行存在则末尾加字符
                sed -i 's/use_authtok$/& remember=5/' $file
            fi
        fi
    done
}

# 修改ssh参数
function repair_ssh() {
    ssh_config=/etc/ssh/sshd_config

    # 不允许空密码登录
    grep "^PermitEmptyPasswords no" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^PermitEmptyPasswords/ d" $ssh_config
        echo "PermitEmptyPasswords no" >>$ssh_config
    fi

    # 修改最大尝试次数
    grep "^MaxAuthTries 4" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^MaxAuthTries/ d" $ssh_config
        echo "MaxAuthTries 4" >>$ssh_config
    fi

    # 修改ssh远程协议
    grep "^Protocol 2" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^Protocol/ d" $ssh_config
        echo "Protocol 2" >>$ssh_config
    fi

    # 其他参数修改
    grep "^X11Forwarding no" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^X11Forwarding/ d" $ssh_config
        echo "X11Forwarding no" >>$ssh_config
    fi
    grep "^IgnoreRhosts yes" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^IgnoreRhosts/ d" $ssh_config
        echo "IgnoreRhosts yes" >>$ssh_config
    fi
    grep "^HostbasedAuthentication no" $ssh_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^HostbasedAuthentication/ d" $ssh_config
        echo "HostbasedAuthentication no" >>$ssh_config
    fi
}

# 修改/etc/profile中的配置
function repair_profile() {
    profile_config=/etc/profile
    # 设置命令行界面超时退出
    grep "^TMOUT=300" $profile_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^TMOUT/ d" $profile_config
        echo "TMOUT=300" >>$profile_config
    fi

    # 设置历史命令显示条数
    grep "^HISTFILESIZE=5" $profile_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^HISTFILESIZE/ d" $profile_config
        echo "HISTFILESIZE=5" >>$profile_config
    fi
    grep "^HISTSIZE=5" $profile_config &>/dev/null
    if [ $? -ne 0 ]; then
        sed -i "/^HISTSIZE/ d" $profile_config
        echo "HISTSIZE=5" >>$profile_config
    fi
}

function main() {
    echo "===========  开始修复  ==========="
    # 备份需修改的文件
    backup
    # 修改口令策略
    repair_pwd_policy
    # 修改ssh配置文件
    repair_ssh
    # 修改环境变量
    repair_profile

    # 重启ssh
    # service sshd restart
    # source /etc/profile
    echo "===========  修复完成  ==========="
}

main

菜单

Linux基于等保的安全加固

分享

Linux基于等保的安全加固

一、设置密码安全策略

二、修复系统账户

三、修复系统日志

三、限制远程登录

四、附检查修复脚本

评论

【运维必读】运维的十一条规范

基于Kubernetes的CICD实战

Linux基于等保的安全加固

告警平台V1.0

基于Kubernetes容器平台的容灾方案

【夜莺监控】海王——Categraf

【夜莺监控】告警管理，香！

【夜莺监控】从日志提取指标的瑞士军刀

【译】详解Kubernetes网络模型

Alpine OpenJDK镜像无法使用jamp等命令-