Chinaunix首页 | 论坛 | 博客
  • 博客访问: 4237579
  • 博文数量: 553
  • 博客积分: 13864
  • 博客等级: 上将
  • 技术积分: 11041
  • 用 户 组: 普通用户
  • 注册时间: 2011-11-28 21:25
个人简介

个人Blog: hhktony.com

文章分类

全部博文(553)

文章存档

2015年(1)

2014年(2)

2013年(12)

2012年(384)

2011年(154)

分类: LINUX

2012-04-23 01:33:28

建议根据自己的实际需要来修改此脚本,不要盲目使用!

点击(此处)折叠或打开

  1. #!/bin/sh
  2. # desc: setup linux system security
  3. # author:coralzd
  4. # powered by www.freebsdsystem.org
  5. # version 0.1.2 written by 2011.05.03
  6. #account setup
  7. passwd -l xfs
  8. passwd -l news
  9. passwd -l nscd
  10. passwd -l dbus
  11. passwd -l vcsa
  12. passwd -l games
  13. passwd -l nobody
  14. passwd -l avahi
  15. passwd -l haldaemon
  16. passwd -l gopher
  17. passwd -l ftp
  18. passwd -l mailnull
  19. passwd -l pcap
  20. passwd -l mail
  21. passwd -l shutdown
  22. passwd -l halt
  23. passwd -l uucp
  24. passwd -l operator
  25. passwd -l sync
  26. passwd -l adm
  27. passwd -l lp
  28. # chattr /etc/passwd /etc/shadow
  29. chattr +i /etc/passwd
  30. chattr +i /etc/shadow
  31. chattr +i /etc/group
  32. chattr +i /etc/gshadow
  33. # add continue input failure 3 ,passwd unlock time 5 minite
  34. sed -i 's#auth required pam_env.so#auth required pam_env.sonauth required pam_tally.so onerr=fail deny=3 unlock_time=300nauth required /lib/security/$ISA/pam_tally.so onerr=fail deny=3 unlock_time=300#' /etc/pam.d/system-auth
  35. # system timeout 5 minite auto logout
  36. echo "TMOUT=300" >>/etc/profile
  37. # will system save history command list to 10
  38. sed -i "s/HISTSIZE=1000/HISTSIZE=10/" /etc/profile
  39. # enable /etc/profile go!
  40. source /etc/profile
  41. # add syncookie enable /etc/sysctl.conf
  42. echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
  43. sysctl -p # exec sysctl.conf enable
  44. # optimizer sshd_config
  45. sed -i "s/#MaxAuthTries 6/MaxAuthTries 6/" /etc/ssh/sshd_config
  46. sed -i "s/#UseDNS yes/UseDNS no/" /etc/ssh/sshd_config
  47. # limit chmod important commands
  48. chmod 700 /bin/ping
  49. chmod 700 /usr/bin/finger
  50. chmod 700 /usr/bin/who
  51. chmod 700 /usr/bin/w
  52. chmod 700 /usr/bin/locate
  53. chmod 700 /usr/bin/whereis
  54. chmod 700 /sbin/ifconfig
  55. chmod 700 /usr/bin/pico
  56. chmod 700 /bin/vi
  57. chmod 700 /usr/bin/which
  58. chmod 700 /usr/bin/gcc
  59. chmod 700 /usr/bin/make
  60. chmod 700 /bin/rpm
  61. # history security
  62. chattr +a /root/.bash_history
  63. chattr +i /root/.bash_history
  64. # write important command md5
  65. cat > list << "EOF" &&
  66. /bin/ping
  67. /bin/finger
  68. /usr/bin/who
  69. /usr/bin/w
  70. /usr/bin/locate
  71. /usr/bin/whereis
  72. /sbin/ifconfig
  73. /bin/pico
  74. /bin/vi
  75. /usr/bin/vim
  76. /usr/bin/which
  77. /usr/bin/gcc
  78. /usr/bin/make
  79. /bin/rpm
  80. EOF
  81. for i in `cat list`
  82. do
  83. if [ ! -x $i ];then
  84. echo "$i not found,no md5sum!"
  85. else
  86. md5sum $i >> /var/log/`hostname`.log
  87. fi
  88. done
  89. rm -f list


阅读(2815) | 评论(2) | 转发(2) |
给主人留下些什么吧!~~

重返人生2012-04-24 10:26:21

Linux的系统安全设置Shell脚本还是比较值得学习的啊,可以再写的具体点啊

☆彼岸★花开2012-04-23 19:58:32

不用有太大的改动吧,基本都差不多的说