CentOS5生产环境系统安全加固配置-脚本实例二

#!/bin/bash

echo "updata V1.0 by csc  2014-11-10"

VER="v1.3d"

VERSION="System Security configuration "${VER}", by WuHan Tianyu, 2013-07-19."

echo $VERSION

SET_NTP()

{

#set ntp

echo -e "\n>>>>>  begin to set ntp ..."

ntpstatus=`ps -ef|grep ntp|grep -v grep|wc -l`

if [ $ntpstatus != 0 ];then

  grep "^server" /etc/ntp.conf|grep -v "127.127.1.0";

  echo "ntpserver No. is "`grep "^server" /etc/ntp.conf|grep -v "127.127.1.0"|wc -l`;

else

  crontab -l|grep -v "^#"|grep ntp > /dev/null

  if test $? -eq 0;then

    crontab -l|grep -v "^#"|grep ntp

    echo "ntpserver No. is "`crontab -l|grep -v "^#"|grep ntp|wc -l`;

  else

    echo "0 12 * * * ntpdate 127.0.0.1" >> /var/spool/cron/root

    crontab -l|grep -v "^#"|grep ntp

    echo "ntpserver No. is "`crontab -l|grep -v "^#"|grep ntp|wc -l`;

  fi

fi

}

SET_TIMEOUT_LOGOUT()

{

#system timeout auto logout

echo -e "\n>>>>>  begin to set system timeout auto logout ..."

cat /etc/profile |grep -v ^\#|grep .|grep -i tmout >> /dev/null

if test $? -ne 0;then

  echo "export TMOUT=180" >> /etc/profile

else

  sed -i "s/.*TMOUT.*/TMOUT=180/" /etc/profile

fi

echo "your system will auto logout at 180s"

}

SET_IDLE_LOGOUT()

{

#system idle auto logout

echo -e "\n>>>>>  begin to set system idle auto logout ..."

cat /etc/csh.cshrc |grep -v ^\#|grep .|grep -i autologout >> /dev/null

if test $? -ne 0;then

  echo "set autologout=30" >> /etc/csh.cshrc

fi

echo "your system will auto logout at idle "`cat /etc/csh.cshrc |grep -v ^\#|grep .|grep -i autologout|awk -F= '{printf $2}'`"m"

}

SET_ICMP_REDIRECTS()

{

#disable icmp redirects

echo -e "\n>>>>>  begin to set disable icmp redirects ..."

n=`sysctl -a|grep net.ipv4.conf.all.accept_redirects|sed 's/\(.*\)\(.\)$/\2/'`

if [ $n != 0 ];then

  echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf

fi

sysctl -p > /dev/null

echo "icmp redirects disabled"

}

SET_LOGON_BANNER()

{

#set logon banner

echo -e "\n>>>>>  begin to set disable logon banner ..."

if [ ! -s /etc/motd ];then

  echo "This is TianYu's Server!" >> /etc/motd

fi

echo -e "system logon banner is:\n--------\n"`cat /etc/motd`"\n--------"

}

SET_SSH_BANNER()

{

#set ssh logon banner

echo -e "\n>>>>>  begin to set ssh logon banner ..."

BANNER="Welcome -- set_secure "${VER}

SSHBANNER=`grep -v ^\# /etc/ssh/sshd_config|grep -i banner`

if [ $? -eq 1 ];then

  echo "Banner /etc/sshbanner" >> /etc/ssh/sshd_config

fi

echo $BANNER > /etc/sshbanner

chmod 644 /etc/sshbanner

echo -e "system ssh banner is:\n--------\n"`cat /etc/sshbanner`"\n--------"

}

SET_SELINUX_DISABLE()

{

#disable selinux

echo -e "\n>>>>>  begin to set disable selinux ..."

grep SELINUX=disabled /etc/selinux/config >/dev/null

if test $? -ne 0 ;then

  sed -i -e "s/SELINUX=.*/SELINUX=disabled/g"  /etc/selinux/config 

fi

setenforce 0 2> /dev/null

echo "SELINUX is disabled"

}

SET_TIMEMASK_HISTORY()

{

#time mark for history

echo -e "\n>>>>>  begin to set time mark for history ..."

grep -i histtimeformat /etc/profile > /dev/null

if [[ $? == 1 ]];then

  echo "export HISTTIMEFORMAT=\"%F %T \"" >> /etc/profile

fi

echo "history is marked by time"

}

SET_UMASK()

{

#set all user's umask

echo -e "\n>>>>>  begin to set user's umask ..."

grep -v ^\# /etc/profile|grep -i ^umask > /dev/null

if test $? -eq 1;then

  echo "umask 027" >> /etc/profile

else

  sed -i "s/^umask.*/umask 027/" /etc/profile

fi

echo "set user's umask eq 027"

}

SET_SYS_CORE_DUMP()

{

#set system core dump

echo -e "\n>>>>>  begin to set system core dump ..."

cat /etc/security/limits.conf|grep -v ^\#|grep .|grep -e "soft.*core"

if test $? -eq 1;then

  echo "* soft core 0" >> /etc/security/limits.conf

else

  sed -i "s/[^\#].*soft.*core.*/\* soft core 0/" /etc/security/limits.conf

fi

cat /etc/security/limits.conf|grep -v ^\#|grep .|grep -e "hard.*core"

if test $? -eq 1;then

  echo "* hard core 0" >> /etc/security/limits.conf

else

  sed -i "s/.*hard.*core.*/\* hard core 0/" /etc/security/limits.conf

fi

echo "set system core dump done"

}

#旧密码不能使用 5次之内

SET_OLD_PASSWD_SAVE()

{

#set old passwd save

echo -e "\n>>>>>  begin to set old passwd save ..."

grep -v ^\# /etc/pam.d/system-auth|grep "password.*pam_unix.so.*remember.*" > /dev/null

if test $? -eq 1;then

  touch /etc/security/opasswd

  chown root:root /etc/security/opasswd

  chmod 600 /etc/security/opasswd

  sed -i "s/password.*pam_unix.so.*/password\tsufficient\tpam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5/" /etc/pam.d/system-auth

fi

echo "the old passwd will save in /etc/security/opasswd"

}

SET_PASSWD_STRENGTH()

{

#set passwd strength

echo -e "\n>>>>>  begin to set passwd strength ..."

grep -v ^\# /etc/pam.d/system-auth|grep "password.*pam_cracklib.so.*" > /dev/null

if test $? -eq 0;then

  sed -i "s/password.*pam_cracklib.so.*/password\trequisite\tpam_cracklib.so minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 minclass=2/g" /etc/pam.d/system-auth

else

  echo "set passwd strength failed"

  exit 1

fi

echo "set passwd strength success"

}

SET_DEL_USER()

{

#delete unused users

echo -e "\n>>>>>  begin to delete unused users ..."

userdel adm

userdel lp

userdel sync

userdel shutdown

userdel halt

userdel news

userdel uucp

userdel operator

userdel gopher

userdel games

userdel smmsp

groupdel adm

groupdel lp

groupdel news

groupdel uucp

groupdel dip

}

SET_DEL_SERVICE()

{

#delete unused services

echo -e "\n>>>>>  begin to delete unused services ..."

chkconfig chargen-dgram off

chkconfig chargen-stream off

chkconfig daytime-dgram off

chkconfig daytime-stream off

chkconfig echo-dgram off

chkconfig echo-stream off

chkconfig eklogin off

chkconfig ekrb5-telnet off

chkconfig gssftp off

chkconfig klogin off

chkconfig krb5-telnet off

chkconfig kshell off

chkconfig rsync off

chkconfig tcpmux-server off

chkconfig tftp off

chkconfig time-dgram off

chkconfig time-stream off

chkconfig postfix off

chkconfig rsyncd off

chkconfig rlogin off

chkconfig rsh off

chkconfig rexec  off

chkconfig snmpd off

chkconfig sendmail off

chkconfig telnet off

chkconfig smartd off

chkconfig cups off

chkconfig cups-config-daemon off

}

SET_PASSWD_VALIDITY()

{

echo -e "\n>>>>>  begin to set passwork validity ..."

sed -i "s/PASS_MAX_DAYS.*[0-9]/PASS_MAX_DAYS\t90/g" /etc/login.defs

sed -i "s/PASS_MIN_DAYS.*[0-9]/PASS_MIN_DAYS\t6/g" /etc/login.defs

sed -i "s/PASS_MIN_LEN.*[0-9]/PASS_MIN_LEN\t6/g" /etc/login.defs

sed -i "s/PASS_WARN_AGE.*[0-9]/PASS_WARN_AGE\t30/g" /etc/login.defs

echo "your password will expired erery 90 days"

}

#登入失败5次后，锁定10秒

SET_SYSTEM_AUTOLOCK()

{

#system will lock after input bad passwd 6 time

echo -e "\n>>>>>  begin to set system autolock ..."

grep -v ^\# /etc/pam.d/system-auth|grep "auth.*pam_tally2.so.*" > /dev/null

if test $? -eq 0;then

  sed -i "s/auth.*pam_tally2.so.*/auth\trequired\tpam_tally2.so deny=5  unlock_time=300 even_deny_root root_unlock_time=10/g" /etc/pam.d/system-auth

else

  n=`cat -n /etc/pam.d/system-auth|grep "auth.*pam_unix.so"|awk '{print $1}'`

  sed -i "${n:=5}i\auth\trequired\tpam_tally2.so deny=5  unlock_time=300 even_deny_root root_unlock_time=10" /etc/pam.d/system-auth

fi

echo "system will lock after input bad passwd 5 times"

}

SET_SYSTEM_LOGFILE()

{

echo -e "\n>>>>>  begin to set system log file ..."

#set system save users action

touch /var/log/pacct

accton /var/log/pacct

echo "system will save users's action , you can use command 'lastcomm [user name] -f /var/log/pacct' to see it"

#设备应配置日志功能，记录对与设备相关的安全事件

grep -v ^\# /etc/syslog.conf|grep "/var/adm/message" > /dev/null

if test $? -eq 0;then

  sed -i "s#.*/var/adm/message.*#*.err;kern.debug;daemon.notice;\t/var/adm/message#" /etc/syslog.conf

else

  echo -e "*.err;kern.debug;daemon.notice;\t/var/adm/message" >> /etc/syslog.conf

fi

echo "system will save security events in /var/adm/message"

#设备应配置日志功能，记录用户使用SU命令的情况，记录不良的尝试记录

touch /var/log/secure

grep -v ^\# /etc/syslog.conf|grep "/var/log/secure" > /dev/null

if test $? -eq 0;then

  sed -i "s#.*/var/log/secure.*#authpriv.*\t/var/log/secure#" /etc/syslog.conf

else

  echo -e "authpriv.*\t/var/log/secure" >> /etc/syslog.conf

fi

echo "system will save normal user's SU action in /var/log/secure"

service syslog restart > /dev/null

}

SET_PERMIT_ROOTLOGIN()

{

echo -e "\n>>>>>  begin to set permit root login ..."

#set allow root login

sed -i "s#PermitRootLogin\s*[y n Y N].*#PermitRootLogin yes#" /etc/ssh/sshd_config

echo "system will permit root login"

}

##############################################################################

USER=`whoami`

if [ $USER != root ]; then

  echo "Must be root to run this script, please login as root and re-try!"

  exit

fi

# see if configuration is already being applied

if [ -f "/etc/set_secure.conf" ]; then

  echo "************************************************************************************************"

  LAST_SET=`tail -n 1 /etc/set_secure.conf`

  echo "LAST SETTING: "${LAST_SET}

  echo "************************************************************************************************"

  echo -n "System Security configuration has already been applied, do you want to set again?(Y/N)"

  read RET_SURE

  if [ "$RET_SURE" != "Y" ] && [ "$RET_SURE" != "y" ]; then

echo "Abort Setting!"

exit;

  fi 

else

  if [ "$1" != "yes" ]; then

  echo -n "Starting to system security setting, are you sure?(Y/N)"

    read RET_SURE

    if [ "$RET_SURE" != "Y" ] && [ "$RET_SURE" != "y" ]; then

echo "Abort Setting!"

exit;

    fi 

  fi

fi

###################  Beging to security setting ###################

SET_NTP

SET_TIMEOUT_LOGOUT

SET_IDLE_LOGOUT

SET_ICMP_REDIRECTS

SET_LOGON_BANNER

SET_SSH_BANNER

SET_PERMIT_ROOTLOGIN

SET_SELINUX_DISABLE

SET_TIMEMASK_HISTORY

SET_UMASK

SET_SYS_CORE_DUMP

SET_OLD_PASSWD_SAVE

SET_PASSWD_STRENGTH

SET_DEL_USER

SET_DEL_SERVICE

SET_PASSWD_VALIDITY

SET_SYSTEM_AUTOLOCK

SET_SYSTEM_LOGFILE

###################  End security setting ###################

echo -e "\n>>>>>  restart sshd ..."

service sshd restart

NOW_TIME=`date +%Y%m%d-%H:%M.%S` 

echo $NOW_TIME"  "$VERSION >> /etc/set_secure.conf

echo ""

echo "**********************************************"

echo "              All Finished!"

echo "**********************************************"