Linux -- 等级保护 (简单操作)

// 密码复杂度: 字母/数字/特殊符号,不小于8位; 用户密码 5 次不能重复;
vim /etc/pam.d/system-auth
auth        required      pam_tally2.so onerr=fail deny=3  unlock_time=1200 even_deny_root root_unlock_time=1200
auth        sufficient    pam_unix.so nullok try_first_pass remember=5
password    requisite     pam_cracklib.so retry=3 difork=3 minlen=8 lcredit=-1 dcredit=-1 ocredit=-1

// 设置定期修改密码时间
vim /etc/login.defs
PASS_MAX_DAYS   90
PASS_MIN_DAYS   0
PASS_MIN_LEN   8
PASS_WARN_AGE   7

// 设置错误密码登录不超过3次,超过锁定20分钟
find /lib* -iname "pam_tally2.so"
    /lib64/security/pam_tally2.so
vim /etc/pam.d/sshd
auth       required     pam_tally2.so deny=3 unlock_time=12000

// 启用auditd审计功能,审计覆盖到服务器及用户
/etc/init.d/auditd start
    // 记录用户的登录与操作(操作日志记录 /tmp/dbasky/root/192.168.10.108)
    vim /etc/profile
    USER_IP=`who -u am i 2>/dev/null| awk ‘{print $NF}‘|sed -e ‘s/[()]//g‘`
    if [ "$USER_IP" = "" ]
    then
    USER_IP=`hostname`
    fi
    if [ ! -d /tmp/dbasky ]
    then
    mkdir /tmp/dbasky
    chmod  755 /tmp/dbasky
    fi
    if [ ! -d /tmp/dbasky/${LOGNAME} ]
    then
    mkdir /tmp/dbasky/${LOGNAME}
    chmod 300 /tmp/dbasky/${LOGNAME}
    fi
    export HISTSIZE=4096
    DT=`date "+%Y-%m-%d_%H:%M:%S"`
    export HISTFILE="/tmp/dbasky/${LOGNAME}/${USER_IP} dbasky.$DT"
    chmod 600 /tmp/dbasky/${LOGNAME}/*dbasky* 2>/dev/null
    
    // 审计重要文件
 auditctl -w /etc/passwd -p war ausearch -f /etc/passwd -x rm/vim....   // 查询
    
   vim /etc/audit/audit.rules ... ... // 添加(-w 路径; -p 权限; -k 关键字 ;r 读; w 写; x 执行; a 修改文件属性;)
 -a exit,always -F arch=b64 -S umask -S chown -S chmod -a exit,always -F arch=b64 -S unlink -S rmdir -a exit,always -F arch=b64 -S setrlimit -a exit,always -F arch=b64 -S setuid -S setreuid -a exit,always -F arch=b64 -S setgid -S setregid -a exit,always -F arch=b64 -S sethostname -S setdomainname -a exit,always -F arch=b64 -S adjtimex -S settimeofday -a exit,always -F arch=b64 -S mount -S _sysctl -w /etc/group -p wa -w /etc/passwd -p wa -w /etc/shadow -p wa -w /etc/sudoers -p wa -w /etc/ssh/sshd_config -w /etc/bashrc -p wa -w /etc/profile -p wa -w /etc/profile.d/ -w /etc/aliases -p wa -w /etc/sysctl.conf -p wa -w /var/log/lastlog  
    // 审计工具
  aureport   // 生成审计活动概述;
 * -au    // 查看授权失败的详细信息;
      * -m      // 所有账户修改的相关事件;
        
// 创建审计用户audit
 useradd audit passwd audit 12tianrong. mkdir /tmp/dbasky chown -R audit.audit /var/log/audit/ chmod 750 /var/log/audit/ chmod 600 /var/log/audit/audit.log chown -R audit.audit /tmp/dbasky/ vim /etc/sudoers audit node2.hkrt.cn.com=/bin/ls,/bin/cat,/usr/bin/tail,/usr/bin/sz Defaults logfile=/var/log/sudo %wheel node2.hkrt.cn.com=/sbin/*,/usr/bin/*,/usr/sbin/*,!/sbin/reboot,!/sbin/init,!/sbin/poweroff,!/sbin/shutdown  
// 保护审计进程，避免受到未预期的中断
 [[email?protected] script]# vim audit_up.sh #!/bin/sh while true do ps -ef | grep " auditd" | grep -v "grep" if [ "$?" -eq 1 ] then /etc/init.d/auditd start echo "process has been restarted!" else echo "process already started!" fi sleep 10 done chmod +x audit_up.sh sh audit_up.sh >/dev/null &

// 审计记录保留半年以上
    // 定时任务每周将日志内容切割分离
 crontab -e 00 00 * * 1 /bin/mv /var/log/audit/audit.log /data/auditback/audit.log.$(date -d ‘1 days ago‘ +%d) mkdir -p /data/auditback 
// 文件完整性
 tar xf tripwire-2.4.2.2-src.tar.bz2 -C /usr/src/ cd /usr/src/tripwire-2.4.1.2-src/ ./configure --prefix=/usr/local/tripwire make && make install vim /usr/local/tripwire/etc/twcfg 9 LOOSEDIRECTORYCHECKING =true        // 不监测所属目录的完整性
 12 REPORTLEVEL =4           // 改变监测结果报告等级
    
    // 建立加密格式
 cd /usr/local/tripwire/etc/ /usr/local/tripwire/sbin/twadmin --create-cfgfile -S site.key twcfg.txt
    
 /usr/local/tripwire/sbin/tripwire --init   // 初始化数据库
    
 /usr/local/tripwire/sbin/tripwire --init /usr/local/tripwire/sbin/tripwire --check --interactive find / -type f -name *.twr   // 生成的检测文件
  /usr/local/tripwire//sbin/twprint --print-report --twrfile /usr/local/tripwire/lib/tripwire/report/node2.hkrt.cn.com-20180318-002054.twr # 查看检查记录;

// 防恶意代码软件
 tar xf maldetect-current.tar.gz -C /usr/src/ cd /usr/src/maldetect-1.6.2/ ./install.sh maldet --scan-all /      // 检测
    // 存储路径
  /usr/local/maldetect/sess/session.180316-0921.16896 /usr/local/maldetect/sess/session.hits.180316-0921.16896
    
// 单个用户系统资源（CPU、内存、硬盘）的使用限度进行限制
    //  以后每个一分钟就会检查一次，调整占用50%以上CPU或25%内存的进程的nice值，从而使这样的进程优先级变低，被调度的机会减少，同时会向root发邮件提示该进程被调整过。
  cd /script vim cpu.sh #!/bin/sh PIDS=`top -bn 1 | grep "^ *[1-9]" | awk ‘{ if($9 > 50 || $10 > 25 && id -u $2 > 500) print $1}‘` for PID in $PIDS do renice +10 $PID echo "renice +10 $PID" done chmod +x /script/cpu.sh crontab -e * * * * * /scripts/cpu.sh >/dev/null
    
// 系统的最大并发会话连接数进行限制(注意新建Xshell,尝试是否能连接)
 ulimit -n 8192 /etc/sysctl.conf中加入ip_conntrack_max=8192 /usr/include/bits/types.h 文件，改变__FD_SETSIZE 的值： #define _ _FD_SETSIZE 8192 echo 8192 > /proc/sys/fs/file-max ulimit -Hn 8192
执行sysctl -p 生效..
/bin/bash: Too many open files in system 报错
修改 /proc/sys/fs/file-max 执行上述命令生效