CentOS系统安全加固最佳实践

关于企业IT系统建设安全性问题在任何时候都不会成为一个过时的话题，企业在构建适合自己业务需求的IT系统之初以及整个IT系统生命周期内，系统的安全运行都是一项非常重要的工作，而作为系统运维人员更有责任为保证系统的安全、稳定的运行身体力行。
So本博文提供了关于Linux系统安全加固的具体实现脚本及基线检查规范，以供主机维护人员参考学习。
其中以下脚本主要实现的功能包括：
*加固项包括：密码长度、session超时时间、删除不用的帐号和组、限制root用户直接telnet或rlogin、ssh
*检查是否存在除root之外UID为0的用户、确保root用户的系统路径中不包含父目录，在非必要的情况下，不应包含组权限为777的目录
*检查操作系统Linux用户umask设置、检查重要目录和文件的权限、禁止除root之外的用户su操作、查找系统中任何人都有写权限的目录
*查找系统中没有属主的文件、查找系统中的隐藏文件、判断日志与审计是否合规、登录超时设置、禁用不必要的服务
*linux 安全加固适用于redhat、centos5.8至6.2
具体内容如下，请结合自身业务需求进行系统级加固：
#1、---------------------------------------------------------------------
echo "删除不用的帐号和组"
echo "delete unused users and grups"
for i in lp sync shutdown halt news uucp operator games gopher
do
echo "will delete user $i"
userdel $i
echo "user $i have delete"
done
for i in lp sync shutdown halt news uucp operator games gopher
do
echo "will delete group $i"
groupdel $i
echo "group $i have delete"
done
date=`date +%F`
#2、-----------------------------------------------
#section1 密码要求密码长度大于8,口令90天过期/etc/login.defs
#-----------------------------------------------
#---------------------------------------------------------------------
echo "cp /etc/login.defs to /etc/login.defs.bak_%date"
echo "#-------------------------------------"
cp /etc/login.defs /etc/login.defs.bak_$date
#echo "检查密码的配置"
echo "Check the configure for user&＃39;s password."
echo "#-------------------------------------"
for i in PASS_MAX_DAYS PASS_MIN_LEN PASS_MIN_DAYS PASS_WARN_AGE 
do
cat /etc/login.defs |grep $i|grep -v \#
done
#set password min length 8
echo "#-------------------------------------"
echo "Set user&＃39;s password min length is 8"
sed  -i &＃39;/PASS_MIN_LEN/s/5/8/g&＃39; /etc/login.defs
echo "#-------------------------------------"
#set password max day 90
#echo "set password expired 90 day"
#sed  -i &＃39;/PASS_MAX_DAYS/s/99999/90/g&＃39; /etc/login.defs
#3、---------------------------------------------------------------------
echo "#检查是否存在空口令"
echo "Check if there have user without password!"
echo "#-------------------------------------"
awk -F: &＃39;($2 == "") { print $1 }&＃39; /etc/shadow
#4、-----------------------------------------------
#section2 限制root用户直接telnet或rlogin，ssh无效
######建议在/etc/securetty文件中配置：COnSOLE= /dev/tty01
#---------------------------------------------------------------------
#帐号与口令-检查是否存在除root之外UID为0的用户
#echo "#检查系统中是否存在其它id为0的用户"
echo "Check if the system have other user&＃39;s id is 0"
echo "#-------------------------------------"
mesg=`awk -F: &＃39;($3 == 0) { print $1 }&＃39; /etc/passwd|grep -v root`
if [ -z $mesg ]
then 
echo "There don&＃39;t have other user uid=0"
else
echo
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
echo "$mesg uid=0"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
fi


#5、---------------------------------------------------------------------
echo "#确保root用户的系统路径中不包含父目录，在非必要的情况下，不应包含组权限为777的目录"
echo "check the Path set for root,make sure the path for root dont have father directory and 777 rights"
echo "#-------------------------------------"
echo $PATH | egrep &＃39;(^|:)(\.|:|$)&＃39;
find `echo $PATH | tr &＃39;:&＃39; &＃39; &＃39;` -type d \( -perm -002 -o -perm -020 \) -ls
#6、---------------------------------------------------------------------
echo "#检查操作系统Linux远程连接"
echo "Check if system have remote connection seting"
echo "#-------------------------------------"
find  / -name  .netrc
find  / -name  .rhosts 
echo "检查操作系统Linux用户umask设置"
echo "Check the system users umask setting"
echo "#-------------------------------------"
for i in /etc/profile /etc/csh.login /etc/csh.cshrc /etc/bashrc
do
grep -H umask $i|grep -v "#"
done
###################设置umask为027
#7、---------------------------------------------------------------------
#echo "#检查重要目录和文件的权限"
##echo "Check the important files and directory rights"
echo "#-------------------------------------"
for i in /etc /etc/rc.d/init.d /tmp /etc/inetd.conf /etc/passwd /etc/shadow /etc/group /etc/security /etc/services /etc/rc*.d
do
ls  -ld $i
done
echo -n "Please check if the output is ok ? yes or no :"
read i
case $i in 
y|yes)
break
;;
n|no)
echo "Please recheck the output!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
continue
;;
*)
echo "please input yes or no"
;;
esac
#8、---------------------------------------------------------------------
#echo "#配置rc.d下脚本的权限"
echo "Configure the scripts right(750) in rc.d directory"
echo "#-------------------------------------"
chmod -R 750 /etc/rc.d/init.d/*
chmod 755 /bin/su 改了之后只能root su，没有了s位别的用户无法成功su
chmod 664 /var/log/wtmp
#chattr +a /var/log/messages
#9、---------------------------------------------------------------------
echo "#查找系统中存在的SUID和SGID程序"
echo "Find the files have suid or Sgid"
echo "#-------------------------------------"
for PART in `grep -v ^# /etc/fstab | awk &＃39;($6 != "0") {print $2 }&＃39;`; do
find $PART \( -perm -04000 -o -perm -02000 \) -type f -xdev -print |xargs ls  -ld
done
echo -n "Please check if the output is ok ? yes or no :"
read i
case $i in 
y|yes)
break
;;
n|no)
echo "Please recheck the output!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
continue
;;
*)
echo "please input yes or no"
;;
esac


#10、---------------------------------------------------------------------  
echo "#查找系统中任何人都有写权限的目录"
echo "Find the directory everyone have the write right"
echo "#-------------------------------------"
for PART in `awk &＃39;($3 == "ext2" || $3 == "ext3") \
{ print $2 }&＃39; /etc/fstab`; do
find $PART -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print |xargs ls  -ld
done
echo -n "Please check if the output is ok ? yes or no :"
read i
case $i in 
y|yes)
break
;;
n|no)
echo "Please recheck the output!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
continue
;;
*)
echo "please input yes or no"
;;
esac
#11、---------------------------------------------------------------------
#echo "#查找系统中任何人都有写权限的文件"
echo "Find the files everyone have write right"
echo "#-------------------------------------"
for PART in `grep -v ^# /etc/fstab | awk &＃39;($6 != "0") {print $2 }&＃39;`; do
find $PART -xdev -type f \( -perm -0002 -a ! -perm -1000 \) -print |xargs ls -ld
done
echo -n "Please check if the output is ok ? yes or no :"
read i
case $i in 
y|yes)
break
;;
n|no)
echo "Please recheck the output!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
continue
;;
*)
echo "please input yes or no"
;;
esac
#12、---------------------------------------------------------------------  
echo "#查找系统中没有属主的文件"
echo "Find no owner or no group files in system"
echo "#-------------------------------------"
for PART in `grep -v ^# /etc/fstab |grep -v swap| awk &＃39;($6 != "0") {print $2 }&＃39;`; do
find $PART -nouser -o -nogroup |grep  -v "vmware"|grep -v "dev"|xargs ls  -ld
done
echo -n "Please check if the output is ok ? yes or no :"
read i
case $i in 
y|yes)
break
;;
n|no)
echo "Please recheck the output!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
continue
;;
*)
echo "please input yes or no"
;;
esac
#13、---------------------------------------------------------------------  
###echo "#查找系统中的隐藏文件"
##echo " Find the hiding file in system"
##echo "#-------------------------------------"
###linux执行报错\排除/dev”目录下的那些文件
####find  / -name \(".. *"  -o "…*"  -o ".xx" -o ".mail" \) -print -xdev
## #find  / -name "…*" -print -xdev | cat -v
##find  /  \( -name ".*"  -o -name  "…*"  -o -name ".xx" -o -name ".mail" \) -xdev
##echo -n "If you have check all the output files if correct yes or no ? :"
##read i
## case $i in 
## y|yes)
## break
## ;;
## n|no)
## echo "Please recheck the output!"
## echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
## continue
var cpro_id = "u6885494";