centos7.9 安全加固的记录

前提：准备备份文件夹用于存放原有文件

mkdir -p /root/centos79/reinforcement/

一、/etc/login.defs文件

1.1 备份基础文件

cp -a /etc/login.defs  /root/centos79/reinforcement/login.defs.default

1.2、密码长度及有效期

涉及参数

• PASS_MAX_DAYS
• PASS_MIN_DAYS
• PASS_MIN_LEN
• PASS_WARN_AGE

加固命令

sudo sed -i 's/^#\?PASS_MAX_DAYS.*/PASS_MAX_DAYS 90/g' /etc/login.defs && sudo sed -i 's/^#\?PASS_MIN_DAYS.*/PASS_MIN_DAYS 6/g' /etc/login.defs  && sudo sed -i 's/^#\?PASS_MIN_LEN.*/PASS_MIN_LEN 8/g' /etc/login.defs && sudo sed -i 's/^#\?PASS_WARN_AGE.*/PASS_WARN_AGE 30/g' /etc/login.defs

加固结果

cat /etc/login.defs |grep PASS_ |grep -v '#'
PASS_MAX_DAYS 90
PASS_MIN_DAYS 6
PASS_MIN_LEN 8
PASS_WARN_AGE 30

二、/etc/pam.d/system-auth 文件

2.1 备份基础文件

cp -a /etc/pam.d/system-auth  /root/centos79/reinforcement/system-auth.default

2.2 密码复杂度

涉及参数

• minlen
• difok
• dcredit
• lcredit
• ocredit
• retry

加固命令

sudo sed -i 's/^#\?password    requisite.*/password    requisite     pam_cracklib.so try_first_pass minlen=8 difok=5 dcredit=-1 lcredit=-1 ocredit=-1 retry=1 type=/g' /etc/pam.d/system-auth

加固结果

cat /etc/pam.d/system-auth | grep  "password    requisite     pam_cracklib.so"
password    requisite     pam_cracklib.so try_first_pass minlen=8 difok=5 dcredit=-1 lcredit=-1 ocredit=-1 retry=1 type=

2.3 历史密码不相同次数

涉及参数

• remember

加固命令

sudo sed -i 's/^#\?password    sufficient.*/password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5 /g' /etc/pam.d/system-auth

加固结果

cat /etc/pam.d/system-auth |grep "password    sufficient"
# 输出
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5

2.4 设置登陆失败锁定

涉及参数

• root_unlock_time
• deny
• unlock_time
• even_deny_root

加固命令

sudo sed -i '/PAM-1.0/a auth        required      pam_tally2.so    deny=5    unlock_time=300 even_deny_root root_unlock_time=600' /etc/pam.d/system-auth

加固结果

cat /etc/pam.d/system-auth |grep "unlock_time"
# 输出
auth        required      pam_tally2.so    deny=5    unlock_time=300 even_deny_root root_unlock_time=600

三、/etc/profile 文件

3.1 备份基础文件

cp -a /etc/profile  /root/centos79/reinforcement/profile.default

3.2 设置会话时间

涉及参数

• TMOUT

加固命令

sed -i '$a export TMOUT=300' /etc/profile

加固结果

cat /etc/profile |grep "TMOUT"
# 输出
export TMOUT=300

3.3 设置history命令时间戳

涉及参数

• HISTTIMEFORMAT

加固命令

sed -i '$a export HISTTIMEFORMAT="%F %T `whoami` "' /etc/profile

加固结果

cat /etc/profile |grep "HISTTIMEFORMAT"
# 输出
export HISTTIMEFORMAT="%F %T `whoami` "

3.4 增加history保存条数

涉及参数

• HISTSIZE

加固命令

sudo sed -i 's/^#\?HISTSIZE=.*/HISTSIZE=3000/g' /etc/profile

加固结果

cat /etc/profile |grep "HISTSIZE="
# 输出
HISTSIZE=3000

四、 /etc/ssh/sshd_config 文件

4.1 备份原始文件

cp -a /etc/ssh/sshd_config /root/centos79/reinforcement/sshd_config.default

4.2 禁止root远程访问

涉及参数

• PermitRootLogin

加固命令

sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config

加固结果

cat /etc/ssh/sshd_config |grep 'PermitRootLogin'
# 输出
PermitRootLogin no

4.3 参数增强

涉及参数

• PermitEmptyPasswords
• AllowTcpForwarding
• ChallengeResponseAuthentication
• GSSAPIAuthentication
• MaxAuthTries
• LogLevel

加固命令

sudo sed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/g' /etc/ssh/sshd_config && sudo sed -i 's/^#\?AllowTcpForwarding.*/AllowTcpForwarding no/g' /etc/ssh/sshd_config && sudo sed -i 's/^#\?ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/g' /etc/ssh/sshd_config &&  sudo sed -i 's/^#\?GSSAPIAuthentication.*/GSSAPIAuthentication no/g' /etc/ssh/sshd_config &&  sudo sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 3/g' /etc/ssh/sshd_config &&  sudo sed -i 's/^#\?LogLevel.*/LogLevel INFO/g' /etc/ssh/sshd_config

加固结果

cat /etc/ssh/sshd_config |grep  -E "PermitEmptyPasswords|AllowTcpForwarding|ChallengeResponseAuthentication|GSSAPIAuthentication|MaxAuthTries|LogLevel" |grep -v '#'
# 输出
PermitEmptyPasswords no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
AllowTcpForwarding no

4.4 设置banner

涉及参数

• Banner

加固命令

sudo sed -i 's/^#\?Banner none.*/Banner \/etc\/ssh\/banner/g' /etc/ssh/sshd_config && touch /etc/ssh/banner && echo "The content of the banner" > /etc/ssh/banner

加固结果

cat /etc/ssh/sshd_config |grep 'Banner' && cat /etc/ssh/banner
# 输出
Banner /etc/ssh/banner
The content of the banner

五、/etc/issue和/etc/issue.net 和/etc/motd文件

5.1 备份原始文件

cp -a /etc/issue /root/centos79/reinforcement/issue.default && cp -a /etc/issue.net  /root/centos79/reinforcement/issue.net.default && cp -a /etc/motd /root/centos79/reinforcement/motd.default

5.2 隐藏版本信息

加固命令

echo  "" >/etc/issue && echo  "" >/etc/issue.net && echo  "" > /etc/motd && echo "The content of the banner" > /etc/issue &&  echo "The content of the banner" > /etc/issue.net && echo "The content of the banner" > /etc/motd

加固结果

cat /etc/issue && cat /etc/issue.net && cat /etc/motd

六、 /etc/shadow 文件

6.1 备份基础文件

cp -a /etc/shadow  /root/centos79/reinforcement/shadow.default

6.2 检查空密码

检查命令

awk -F: '($2 == ""){print $1}' /etc/shadow

如果没有输出则为正常

七、 /etc/passwd 文件

7.1 备份基础文件

cp -a /etc/passwd  /root/centos79/reinforcement/passwd.default

7.2 检查UID为0的用户

检查命令

cat /etc/passwd | awk -F: '($3 == 0) { print $1 }'

如果只输出root则为正常

八、日志服务

涉及服务

• rsyslog.service

检查命令

systemctl status rsyslog.service

九、审计服务

涉及服务

• auditd.service

检查命令

systemctl status auditd.service