当前位置：首页 > news >正文

主机基线脚本

news 2026/8/12 15:52:58

基线修复脚本

#基线加固
#删除无关账号
sed -i '/gdm/c\gdm:x:42:42:gdm:/:/bin/false' /etc/passwd
sed -i '/nobody/c\nobody:x:99:99:Nobody:/:/bin/false' /etc/passwd
sed -i '/gdm/c\gdm:*LK*:17374::::::' /etc/shadow
sed -i '/nobody/c\nobody:*LK*:17374::::::' /etc/shadow#限制用户su到root
if [ -z "`cat /etc/pam.d/su | grep -v "^#" | grep group=wheel`" ];thensed -i "3i auth   required   pam_wheel.so   group=wheel" /etc/pam.d/su
fi
#sed -i -e '7 s/^/#/' -i -e '7 s/^/#/' /etc/pam.d/su
cat /etc/pam.d/su#口令复杂度
sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_cracklib.so.+$)/#\1\npassword\trequired\tpam_passwdqc.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth
sed -i -r 's/(^[[:space:]]*password[[:space:]]+(requisite|required)[[:space:]]+.*pam_pwquality.so.+$)/#\1\npassword\trequired\tpam_pwquality.so min=disabled,disabled,disabled,8,8 passphrase=0 similar=deny enforce=everyone random=0 retry=3/' /etc/pam.d/system-auth#口令生存期
sed -i '/PASS_MAX_DAYS/c\'"PASS_MAX_DAYS   90"'' /etc/login.defs
sed -i '/PASS_MIN_LEN/c\'"PASS_MIN_LEN    8"'' /etc/login.defs
sed -i '/PASS_MIN_DAYS/c\'"PASS_MIN_DAYS    0"'' /etc/login.defs

#配置用户最小授权#文件与目录缺省权限控制
if [ -z "`cat /etc/profile | grep -v "^#" | grep "umask 027"`" ];thenecho "umask 027" >> /etc/profile
fi#用户FTP访问安全配置
echo "chroot_local_user=YES" >> /etc/vsftpd/vsftpd.conf
echo "chroot_list_enable=YES" >> /etc/vsftpd/vsftpd.conf
echo "chroot_list_file=/etc/vsftpd/chroot_list_new" >> /etc/vsftpd/vsftpd.conf
cat /etc/passwd|awk -F ':'  '$3>=500{print $1}' 1>/etc/vsftpd/chroot_list_new#禁止root登陆FTP
if [ -z "`cat /etc/vsftpd/ftpusers | grep -v "^#" | grep root`" ];thenecho "root" >> /etc/vsftpd/ftpusers
fi#禁止匿名FTP
sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf#修改FTPBanner信息
if [ -z "`cat /etc/vsftpd/vsftpd.conf | grep -v "^#" | grep ftpd_banner`" ];thenecho "ftpd_banner=Authorized users only. All activity will be monitored and reported." >>/etc/vsftpd/vsftpd.conf
fi#限制root用户远程登录
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
sed -i '/PermitRootLogin yes/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config
sed -i '/PermitRootLogin noPermitRootLogin no/c\'"PermitRootLogin no"'' /etc/ssh/sshd_config

#使用SSH协议进行远程维护#启用syslog系统日志审计
if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep authpriv.*`" ];thenecho "authpriv.*   /var/log/secure" >> /etc/syslog.conf
fi
if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep authpriv.*`" ];thenecho "authpriv.*   /var/log/secure" >> /etc/rsyslog.conf
fi#日志文件安全
echo "" > /var/log/spooler
chmod 600 /var/log/secure
chmod 600 /var/log/maillog
chmod 600 /var/log/cron
chmod 600 /var/log/spooler
chattr -a /var/log/boot.log
chmod 600 /var/log/boot.log
chattr -a /var/log/messages
chmod 600 /var/log/messages#记录cron行为日志(可选)
if [ -z "`cat /etc/rsyslog.conf | grep -v "^#" | grep cron.*`" ];thenecho "cron.* /var/log/cron" >> /etc/rsyslog.conf
fi
if [ -z "`cat /etc/syslog.conf | grep -v "^#" | grep cron.*`" ];thenecho "cron.* /var/log/cron" >> /etc/syslog.conf
fiecho "*.* @192.168.1.1" >> /etc/syslog.conf
echo "*.* @192.168.1.1" >> /etc/rsyslog.conf
#关闭不必要的服务#修改系统Banner
rm -rf /etc/issue*#登录超时时间设置
if [ -z "`cat /etc/profile | grep -v "^#" | grep TMOUT`" ];thenecho -e "TMOUT=300" >> /etc/profile
fi
sed -i 's/TMOUT=1800/TMOUT=300/' /etc/profile#删除潜在危险文件#sudo tty权限配置
sed -i 's/Defaults    requiretty/#Defaults    requiretty/' /etc/sudoers#配置用户最小授权
chmod 400 /etc/shadow#文件与目录缺省权限控制
sed -i 's/UMASK       022/UMASK      027/' /etc/login.defs#history记录时间
echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  "' >> /etc/profile
HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  "