一、认证口令加固
1.1 限定口令长度和复杂度
以root用户权限执行如下操作
cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak //备份源文件
vim /etc/pam.d/system-auth //编辑配置文件
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=10 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root
retry=3 定义登录/修改密码失败时，可以重试的次数；
minlen=10 密码最小长度为10个字符。
lcredit=-1 密码应包含的小写字母的至少一个
ucredit=-1 密码应包含的大写字母至少一个
Dcredit=-1 将密码包含的数字至少为一个
ocredit=-1 设置其他符号的最小数量，例如@，＃、! $％等，至少要有一个
enforce_for_root 确保即使是root用户设置密码，也应强制执行复杂性策略。
1.2 限定口令的生存周期
chage -M 90 -m 7 -W 15 root
chage -l root
修改用户密码最长有效期90天，最短有效期7天，提前15天提醒。
通过vim /etc/login.defs命令修改配置文件
PASS_MAX_DAYS 90 //设置口令最长使用期限
PASS_MIN_DAYS 7 //设置口令最短使用期限
PASS_MIN_LEN 10 //设置口令最小长度
PASS_WARN_AGE 15 //设置口令到期前的提示日期
1.3 设置登陆会话超时
10分钟无操作，自动退出会话。
echo "export TMOUT=300" >> /etc/profile
source /etc/profile //重新加载环境变量配置文件
cat /etc/profile | grep TMOUT
1.4 设置登陆失败锁定
输错5次密码，账号锁定10分钟。
vim /etc/pam.d/system-auth
auth required pam_tally2.so onerr=fail deny=5 unlock_time=300 even_deny_root root_unlock_time=600
以上配置只对控制台有效，ssh无效。
针对对ssh远程有效，则修改/etc/pam.d/sshd
vim /etc/pam.d/sshd
auth required pam_tally2.so onerr=fail deny=5 unlock_time=60 even_deny_root root_unlock_time=60
二、用户设定
2.1 Linux系统下新建三权分立用户
系统管理员（sysadmin）：
useradd sysadmin
echo XXXxxx#gg%GG12345 | passwd --stdin sysadmin
usermod -g sysadmin sysadmin
usermod -aG wheel sysadmin
安全员（security）：
useradd security
echo XXXxxx#gg%GG12345 | passwd --stdin sysadmin
mJElf%lujfl9021
审计员(auditor)用户：
useradd auditor
echo XXXxxx#gg%GG12345 | passwd --stdin sysadmin
2.2 设置不允许root登录
编辑/etc/ssh/sshd_config配置文件
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
2.3 权限切换限制
限制用户su到root，只允许wheel组的su。
去掉该行注释，保存退出。
sed -i "/^#.*required/s/^#//" /etc/pam.d/su
sed -i '/required/s/pam_sysadmin.so use_uid/\/lib\/security\/pam_sysadmin.so group=sysadmin/' /etc/pam.d/su
三、日志审计及历史命令
3.1 开启日志外发至日志审计服务器
添加rsyslog日志服务器信息：
echo *.*' '@192.168.100.44:514 >> /etc/rsyslog.conf
echo *.*' '@192.168.100.45:514 >> /etc/rsyslog.conf
cat /etc/rsyslog.conf | grep 514
systemctl restart rsyslog.service
3.2 设置历史命令记录条数
sed -i 's/HISTSIZE=1000/HISTSIZE=10/' /etc/profile
source /etc/profile
echo $HISTSIZE
四、附shell执行脚本
文件 ：DengBao_Level3.sh
#!/bin/bash
#1、执行命令启用auditd服务：service auditd start
systemctl start auditd
#2、执行命令service rsyslog start启用rsyslog服务
systemctl start rsyslog
#修改审计策略规则
cat <<EOF | tee -a /etc/audit/rules.d/audit.rules /etc/audit/audit.rules >/dev/null
-a always,exit
-F arch=b64
-S unlink
-S unlinkat
-S rename
-S renameat
-F auid>=1000
-F auid!=4294967295
-k delete
-a always,exit
-F arch=b32
-S unlink
-S unlinkat
-S rename
-S renameat
-F auid>=1000
-F auid!=4294967295
-k delete
EOF
cat <<EOF | tee -a /etc/audit/rules.d/audit.rules /etc/audit/audit.rules >/dev/null
-w /etc/group
-p wa -k identity
-w /etc/passwd
-p wa
-k identity
-w /etc/gshadow
-p wa -k identity
-w /etc/shadow
-p wa
-k identity
-w /etc/security/opasswd
-p wa
-k identity
EOF
cat <<EOF | tee -a /etc/audit/rules.d/audit.rules /etc/audit/audit.rules >/dev/null
-w /etc/sudoers
-p wa
-k scope
-w /etc/sudoers.d/
-p wa
-k scope
EOF
echo "backlog_limit = 8192" >> /etc/audit/auditd.conf
#创建三权用户，只允许sysadmin用户执行用户切换及提权
#系统管理员（sysadmin）：
useradd sysadmin
echo "sysadmin:XXXxxx#gg%GG12345" | chpasswd
usermod -aG wheel sysadmin
#安全员（security）：
useradd security
echo "security:XXXxxx#gg%GG12345" | chpasswd
#审计员(auditor)用户：
useradd auditor
echo "auditor:XXXxxx#gg%GG12345" | chpasswd
sed -i 's/#\s*auth\s*required\s*pam_wheel.so\s*use_uid/auth required pam_wheel.so use_uid/g' /etc/pam.d/su
#检查/etc/sudoers配置sudo权限的用户，不能所有用户都配置(ALL)权限
sed -i 's/root\s*ALL=(ALL)\s*ALL/root ALL=(sysadmin) ALL/g' /etc/sudoers
#检查`/etc/bashrc`和`/etc/profile`文件中`umask`值是否设置为`027`或更严格，否则添加或编辑umask参数： `umask 027` 执行命令：`source /etc/profile`；
echo "umask 027" >> /etc/profile
source /etc/profile
#确保每个用户的home目录权限设置为750或者更严格
chmod 750 /home/*
#sed -i 's/PermitRootLogin\s*yes/PermitRootLogin no/g' /etc/ssh/sshd_config
#sed -i 's/#PermitRootLogin\s*yes/PermitRootLogin no/g' /etc/ssh/sshd_config
#sed -i 's/#PermitRootLogin\s*no/PermitRootLogin no/g' /etc/ssh/sshd_config
cat <<EOF | tee -a /etc/ssh/sshd_config >/dev/null
AllowUsers root@192.168.25.100
AllowUsers root@192.168.25.200
AllowUsers sysadmin@*
AllowUsers security@*
AllowUsers auditor@*
#DenyUsers root@*
EOF
usermod -L shutdown
usermod -L halt
#执行以下4条命令： ```chown root:root /etc/hosts.allow chown root:root /etc/hosts.deny chmod 644 /etc/hosts.deny chmod 644 /etc/hosts.allow ```
#chown root:root /etc/hosts.allow
#chown root:root /etc/hosts.deny
#chmod 644 /etc/hosts.deny
#chmod 644 /etc/hosts.allow
#执行以下5条命令 ```chown root:root chmod 0644 /etc/group chmod 0644 /etc/passwd chmod 0400 /etc/shadow chmod 0400 /etc/gshadow ```
#chmod 0644 /etc/group
#chmod 0644 /etc/passwd
#chmod 0400 /etc/shadow
#chmod 0400 /etc/gshadow
#设置 /etc/ssh/sshd_config 的权限： ```chown root:root /etc/ssh/sshd_config chmod 600 /etc/ssh/sshd_config ```
#chown root:root /etc/ssh/sshd_config
#chmod 600 /etc/ssh/sshd_config
#配置/etc/profile文件权限： ```chown root:root /etc/profile chmod 644 /etc/profile ```
#chown root:root /etc/profile
#chmod 644 /etc/profile
#运行以下命令以设置ssh主机公钥文件的权限和所有权： ```find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \; ```
find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \;
find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;
#运行以下命令以设置ssh主机私钥文件的权限和所有权： ```
find /etc/ssh -xdev -type f -name 'ssh_host_*_key' -exec chmod 0600 {} \;
find /etc/ssh -xdev -type f -name 'ssh_host_*_key' -exec chown root:root {} \;
#在`/etc/ssh/sshd_config`中取消`MaxAuthTries`注释符号#，设置最大密码尝试失败次数3-6，建议为5：`MaxAuthTries 5`
sed -i 's/#MaxAuthTries\s*6/MaxAuthTries 5/g' /etc/ssh/sshd_config
#限定口令长度和复杂度
#备份源文件
cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
#编辑修改替换配置文件
sed -i 's/password\s*requisite\s*pam_pwquality.so\s*try_first_pass local_users_only\s*retry=3\s*authtok_type=/password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=10 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root/g' /etc/pam.d/system-auth
sed -i 's/password\s*requisite\s*pam_pwquality.so\s*try_first_pass\s*local_users_only/password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=10 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root/g' /etc/pam.d/system-auth
chage -M 90 -m 7 -W 15 root
chage -M 90 -m 7 -W 15 sysadmin
chage -M 90 -m 7 -W 15 security
chage -M 90 -m 7 -W 15 auditor
echo "export TMOUT=300" >> /etc/profile
source /etc/profile
echo "auth required pam_tally2.so onerr=fail deny=5 unlock_time=600 even_deny_root root_unlock_time=600" >> /etc/pam.d/system-auth
echo "auth required pam_tally2.so onerr=fail deny=5 unlock_time=600 even_deny_root root_unlock_time=600" >> /etc/pam.d/sshd
echo *.*' '@192.168.10.44:514 >> /etc/rsyslog.conf
echo *.*' '@192.168.10.45:514 >> /etc/rsyslog.conf
systemctl restart rsyslog.service
#sed -i 's/HISTSIZE=1000/HISTSIZE=10/' /etc/profile
#source /etc/profile
#NTP时间同步
echo "server 192.168.10.250 iburst" >> /etc/chrony.conf
systemctl restart chronyd.service
chronyc sources
chronyc makestep
#auditd服务器系统中被配置为不允许手动关闭及重启
#systemctl restart auditd
systemctl restart rsyslog
systemctl restart sshd.service
五、附ansible批量执行剧本
文件：DengBao_Level3_Ansible.yml
---
- name: Upload and execute script on remote servers
hosts: all
remote_user: root # 指定远程用户
become: yes # 如果需要以其他用户（如root）身份执行任务
become_user: root
gather_facts: yes
vars:
local_script_path: "/zdreamsi/DengBao_Level3.sh"
remote_script_path: "/tmp/DengBao_Level3.sh"
tasks:
- name: Upload the script to the remote server
ansible.builtin.copy:
src: "{{ local_script_path }}"
dest: "{{ remote_script_path }}"
mode: '0777'
register: copy_result
- name: Fail if upload failed
ansible.builtin.fail:
msg: "Failed to upload script to {{ inventory_hostname }}"
when: copy_result.failed
- name: Execute the uploaded script
ansible.builtin.command: "{{ remote_script_path }}"
register: script_output
ignore_errors: yes
- name: Display the script output
ansible.builtin.debug:
msg: "{{ script_output.stdout_lines }}"
- name: Delete the script from the remote server
ansible.builtin.file:
path: "{{ remote_script_path }}"
state: absent
when: script_output is defined and script_output.rc == 0
ignore_errors: yes
- name: Log the result
ansible.builtin.lineinfile:
path: "/var/log/ansible_script_execution.log"
line: "{{ inventory_hostname }} - {{ ansible_date_time.date }} - {{ script_output.rc }}"
create: yes
扫一扫
5672
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
