主机基线脚本

基线修复脚本

#基线加固
#删除无关账号
sed -i '/gdm/c\gdm:x:42:42:gdm:/:/bin/false' /etc/passwd
sed -i '/nobody/c\nobody:x:99:99:Nobody:/:/bin/false' /etc/passwd
sed -i '/gdm/c\gdm:*LK*:17374::::::' /etc/shadow
sed -i '/nobody/c\nobody:*LK*:17374::::::' /etc/shadow

#限制用户su到root（只在无pam_wheel时添加，且放在rootok之后）
if [ -z "`cat /etc/pam.d/su | grep -v "^#" | grep pam_wheel`" ];then
    sed -i '/pam_rootok.so/a auth   required   pam_wheel.so   use_uid' /etc/pam.d/su
fi
#原脚本有缺陷，会导致root执行su时需要输入密码
#if [ -z "`cat /etc/pam.d/su | grep -v "^#" | grep group=wheel`" ];then
#    sed -i "3i auth   required   pam_wheel.so   group=wheel" /etc/pam.d/su
#fi
#sed -i -e '7 s/^/#/' -i -e '7 s/^/#/' /etc/pam.d/su
cat /etc/pam.d/su

#口令复杂度
sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_cracklib.so.+$)/#\1\npassword\trequired\tpam_passwdqc.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth
sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_pwquality.so.+$)/#\1\npassword\trequired\tpam_pwquality.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth

#口令生存期
sed -i '/PASS_MAX_DAYS/c\'"PASS_MAX_DAYS   90"'' /etc/login.defs
sed -i '/PASS_MIN_LEN/c\'"PASS_MIN_LEN    8"'' /etc/login.defs
sed -i '/PASS_MIN_DAYS/c\'"PASS_MIN_DAYS    0"'' /etc/login.defs

#配置用户最小授权

#文件与目录缺省权限控制
if [ -z "`cat /etc/profile | grep -v "^#" | grep "umask 027"`" ];then
    echo "umask 027" >> /etc/profile
fi

#用户FTP访问安全配置
echo "chroot_local_user=YES" >> /etc/vsftpd/vsftpd.conf
echo "chroot_list_enable=YES" >> /etc/vsftpd/vsftpd.conf
echo "chroot_list_file=/etc/vsftpd/chroot_list_new" >> /etc/vsftpd/vsftpd.conf
cat /etc/passwd|awk -F ':'  '$3>=500{print $1}' 1>/etc/vsftpd/chroot_list_new

#禁止root登陆FTP
if [ -z "`cat /etc/vsftpd/ftpusers | grep -v "^#" | grep root`" ];then
    echo "root" >> /etc/vsftpd/ftpusers
fi

#禁止匿名FTP
sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf

#修改FTPBanner信息
if [ -z "`cat /etc/vsftpd/vsftpd.conf | grep -v "^#" | grep ftpd_banner`" ];then
    echo "ftpd_banner=Authorized users only. All activity will be monitored and reported." >>/etc/vsftpd/vsftpd.conf
fi

#限制root用户远程登录
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
sed -i '/PermitRootLogin yes/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config
sed -i '/PermitRootLogin noPermitRootLogin no/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config

#使用SSH协议进行远程维护

#启用syslog系统日志审计
if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep authpriv.*`" ];then
    echo "authpriv.*   /var/log/secure" >> /etc/syslog.conf
fi
if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep authpriv.*`" ];then
    echo "authpriv.*   /var/log/secure" >> /etc/rsyslog.conf
fi

#日志文件安全
echo "" > /var/log/spooler
chmod 600 /var/log/secure
chmod 600 /var/log/maillog
chmod 600 /var/log/cron
chmod 600 /var/log/spooler
chattr -a /var/log/boot.log
chmod 600 /var/log/boot.log
chattr -a /var/log/messages
chmod 600 /var/log/messages

#记录cron行为日志(可选)
if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep cron.*`" ];then
    echo "cron.* /var/log/cron" >> /etc/rsyslog.conf
fi
if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep cron.*`" ];then
    echo "cron.* /var/log/cron" >> /etc/syslog.conf
fi

echo "*.* @192.168.1.1" >> /etc/syslog.conf
echo "*.* @192.168.1.1" >> /etc/rsyslog.conf
#关闭不必要的服务

#修改系统Banner
rm -rf /etc/issue*

#登录超时时间设置
if [ -z "`cat /etc/profile | grep -v "^#" | grep TMOUT`" ];then
    echo -e "TMOUT=300" >> /etc/profile
fi
sed -i 's/TMOUT=1800/TMOUT=300/' /etc/profile

#删除潜在危险文件


#sudo tty权限配置
sed -i 's/Defaults    requiretty/#Defaults    requiretty/' /etc/sudoers

#配置用户最小授权
chmod 400 /etc/shadow

#文件与目录缺省权限控制
sed -i 's/UMASK       022/UMASK      027/' /etc/login.defs

#history记录时间
echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  "' >> /etc/profile
HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  "