linux系统优化安全系统升级

电信RHEL6.6

-4.Hostname

sed -i "2c HOSTNAME=abm25" /etc/sysconfig/network >/etc/resolv.conf

echo 'secure@1W'|passwd root --stdin

iptables -F

service iptables save

-3.vmtools

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

bye

EOF

tar zxvf VMwareTools-8.6.11-1310128.tar.gz

cd vmware-tools*

./vmware-install.pl --default

mv /etc/yum.repos.d/rhel-source.repo /tmp

vi /etc/yum.repos.d/rhel-source.repo

[rhel-source]

name=Red Hat Enterprise Linux $releasever - $basearch - Source baseurl=http://136.5.176.162/iso/redhat6.6/

enabled=1

gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

sed -i "3c baseurl=http://136.5.176.162/iso/redhat6.4/"

/etc/yum.repos.d/rhel-source.repo

yum clean all

yum makecache

yum install -y ftp lftp zlib* openssl* pam* gdm ruby telnet* vsftpd* \ gcc dstat mcelog iotop lsscsi libstdc++* libcap*

yum groupinstall -y basic-desktop x11 development eclipse \

compat-libraries storage-client-multipath nfs-file-server \

cd /etc/sysconfig/network-scripts/

mv ifcfg-enp1s0f0 bakifcfg-enp1s0f0

mv ifcfg-enp130s0f1 bakifcfg-enp130s0f1

echo "ifenslave bond0 eth1 eth5">>/etc/rc.d/rc.local

cat ifcfg-bond0

vi ifcfg-bond0

DEVICE=bond0

BOOTPROTO=yes

IPADDR=136.5.225.100

GATEWAY=136.5.225.97

NETMASK=255.255.255.224

ONBOOT=yes

BONDING_OPTS="mode=1 miimon=200"

--------------

cat ifcfg-enp130s0f1

vi ifcfg-eth1 DEVICE=eth1 ONBOOT=yes BOOTPROTO=none MASTER=bond0 SLAVE=yes

TYPE=Ethernet

--------------

cat ifcfg-enp1s0f0 vi ifcfg-eth1

DEVICE=enp1s0f0 ONBOOT=yes BOOTPROTO=none MASTER=bond0 SLAVE=yes

TYPE=Ethernet

0.ueradd

useradd ibnms

echo "Wfz#2015"|passwd ibnms --stdin

mkdir /ibnms

chown ibnms:ibnms /ibnms

usermod -d /ibnms ibnms

useradd weihu

echo "pi=3yuaN"|passwd weihu --stdin

useradd user

echo "user,.123"|passwd user --stdin

userdel nobody

userdel ftp

1.profile

echo "TMOUT=300">>/etc/profile

sed -i 's/HISTSIZE=1000/HISTSIZE=50000/g' /etc/profile echo 'stty erase ^H'>> /etc/profile

echo "" >> /etc/profile

#2.su

cp /etc/pam.d/su /etc/pam.d/su.bak

sed -i "6c auth required pam_wheel.so use_uid" /etc/pam.d/su usermod -a -G wheel weihu

echo 'SU_WHEEL_ONLY yes'>>/etc/login.defs

#3.密码

cp /etc/login.defs /etc/login.defs.bak

sed -i "25c PASS_MAX_DAYS 60" /etc/login.defs

sed -i "27c PASS_MIN_LEN 8" /etc/login.defs

sed -i "26c PASS_MIN_DAYS 10" /etc/login.defs

sed -i 's/UMASK/#UMASK/g' /etc/login.defs

echo "UMASK 027">>/etc/login.defs

sed -i "s/umask 022/umask 027/g" /etc/profile

echo 'password requisite pam_cracklib.so retry=3 difok=3 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1'>>/etc/pam.d/system-auth

echo 'auth required pam_tally.so onerr=fail deny=5

unlock_time=300'>>/etc/pam.d/system-auth

cp -avx /etc/passwd /tmp

#4.禁止root

echo 'PermitRootLogin no'>>/etc/ssh/sshd_config

#5.启用syslog

sed -i "s/rotate 4/rotate 20/g" /etc/logrotate.conf

echo 'authpriv.* /var/log/secure'>>/etc/syslog.conf echo 'cron.*'>>/etc/syslog.conf

echo '*.* @127.0.0.1'>>/etc/syslog.conf

chmod 744 /var/log/messages

chmod 744 /var/log/secure

chmod 744 /var/log/maillog

chmod 744 /var/log/cron

chmod 744 /var/log/spooler

chmod 744 /var/log/boot.log

chmod 644 /etc/passwd

chmod 400 /etc/shadow

chmod 644 /etc/group

chmod 644 /etc/services

chmod 600 /etc/xinetd.conf

chmod 600 /etc/security

#6.banner

mv /etc/issue /etc/issue.bak

mv /etc/https://www.360docs.net/doc/2f9872014.html, /etc/https://www.360docs.net/doc/2f9872014.html,.bak

echo " Authorized only. All activity will be monitored and reported " > /etc/ssh_banner

#9.内核(old)

echo "* soft nproc 65535">>/etc/security/limits.conf

echo "* hard nproc 65535">>/etc/security/limits.conf

echo "* soft nofile 65535">>/etc/security/limits.conf

echo "* hard nofile 65535">>/etc/security/limits.conf

echo "* - maxlogins 65535">>/etc/security/limits.conf

sed -i 's/1024/65535/g' /etc/security/limits.d/90-nproc.conf

#10.权限

#11.time(old)

echo "server 136.0.24.13">>/etc/ntp.conf

chkconfig ntpd on

service ntpd restart

#12.服务

chkconfig apmd off

chkconfig netfs off

chkconfig yppasswdd off

chkconfig ypserv off

chkconfig dhcpd off

chkconfig portmap off

chkconfig lpd off

chkconfig nfs off

chkconfig sendmail off

chkconfig snmpd off

chkconfig snmptrapd off

chkconfig rstatd off

chkconfig atd off

chkconfig cups off

chkconfig bluetooth off

chkconfig hidd off

chkconfig ip6tables off

chkconfig ipsec off

chkconfig autofs off

chkconfig avahi-daemon off #5353 mdns chkconfig avahi-dnsconfd off

chkconfig cpuspeed off chkconfig isdn off chkconfig nfslock off chkconfig nscd off chkconfig pcscd off chkconfig acpid off chkconfig firstboot off chkconfig mcstrans off chkconfig microcode_ctl off chkconfig rpcgssd off chkconfig rpcidmapd off chkconfig rpcbind off chkconfig portreserve on chkconfig postfix off #smtp 25 chkconfig setroubleshoot off chkconfig xfs off

chkconfig xinetd off chkconfig restorecond off chkconfig anacron off chkconfig ypbind off chkconfig tftp off

chkconfig pox off

chkconfig printer off

chkconfig telnet off

chkconfig NetworkManager off

chkconfig tog-pegasus off #https 5989

chkconfig portreserve off #udp 631

chkconfig rawdevices on

chkconfig mcelogd on

chkconfig crond on

chkconfig kudzu on

chkconfig network on

chkconfig readahead_early on

chkconfig sshd on

chkconfig syslog on

chkconfig auditd on

service NetworkManager stop && service network restart service snmptrapd stop

#14.hosts

sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config

sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config #15.iptables(old)

service iptables stop

#7.登录提示(old)

export netbond=`ifconfig |grep bond|wc -l`

if [$netbond ge 1];then

export woip=`ifconfig bond0 |awk -F '[ :]+' 'NR==2 {print $4}'`

echo -e "\n${HOSTNAME}@${woip}\n"> /etc/motd

else

export woip=`ifconfig eth1 |awk -F '[ :]+' 'NR==2 {print $4}'`

echo -e "\n${HOSTNAME}@${woip}\n"> /etc/motd

fi

##cp

mv /etc/yum.repos.d/rhel-source.repo

/etc/yum.repos.d/rhel-source.repo.bak

cp rhel-source.repo /etc/yum.repos.d/rhel-source.repo

cp nmon /usr/bin

chmod 775 /usr/bin/nmon

#13.ftp(old)

sed -i 's/anonymous_enable=YES/anonymous_enable=NO/g'

/etc/vsftpd/vsftpd.conf

#sed -i 's/#chroot_local_user=YES/chroot_local_user=YES/g'

/etc/vsftpd/vsftpd.conf

sed -i 's/#ftpd_banner/ftpd_banner/g' /etc/vsftpd/vsftpd.conf

echo 'dual_log_enable=YES' >> /etc/vsftpd/vsftpd.conf

echo 'vsftpd_log_file=/var/log/vsftpd.log' >> /etc/vsftpd/vsftpd.conf sed -i '/#nopriv_user=/c nopriv_user=weihu' /etc/vsftpd/vsftpd.conf chkconfig vsftpd on

service vsftpd start

user_list允许

ftpusers 禁止

#15.glibc

mkdir glibc

cd glibc

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

cd glibc

mget *

bye

EOF

yum -y localupdate *

cd

#16.openssh

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

bye

EOF

tar zxvf openssh-7.6p1.tar.gz

cd openssh-7.6p1

tar zxvf openssh*

cd openssh*

./configure --prefix=/usr \

--sysconfdir=/etc/ssh \

--with-ssl-dir=/usr/share/ssl \

--with-zlib \

--with-pam \

--with-md5-passwords \

--with-kerberos5 \

sleep 3

make && make install

mv /etc/init.d/sshd /tmp/sshd

cp contrib/redhat/sshd.init /etc/init.d/sshd

service sshd restart

ssh -V

cd

17.nmon

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

bye

EOF

cp nmon /usr/bin

chmod +x /usr/bin/nmon

mkdir /home/weihu/nmon/

crontab -l

* * * * 1 find /home/weihu/nmon/ -type f -mtime +7 -exec rm -rf {} \;

1 1 * * * nmon -s60 -c1430 -f -m /home/weihu/nmon/

18.kdump

service kdump status

19.Xmanager不做了

yum install -y gdm

vi /etc/gdm/custom.conf

[security]

AllowRoot=true

AllowRemoteRoot=true

[xdmcp]

Port=177

Enable=true

20.itsm 不做了

su - ibnms

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

get jdk1.6.0_21.tar.gz

bye

EOF

tar zxvf jdk1.6.0_21.tar.gz

21.必做

rpm -e httpd --nodeps

rpm -e mysql --nodeps

rpm -e net-snmp --nodeps

rpm -e wget --nodeps

rpm -e squid --nodeps

22.ntpd

lftp -u weihu,pi=3yuaN sftp://136.5.176.162<

bye

EOF

rpm -e ntp --nodeps

rpm -e ntpdate --nodeps

./configure --prefix=/usr \

--bindir=/usr/sbin --sysconfdir=/etc \

--enable-linuxcaps --with-lineeditlibs=readline \ --docdir=/usr/share/doc/ntp-4.2.8p9 \

--enable-all-clocks --enable-parse-clocks \

--enable-clockctl

make

make install

#cp scripts/rc/ntpd /etc/init.d/ntpd #chmod +x /etc/init.d/ntpd

#vmmoban chkconfig

service ntpd restart