linux基本安全配置设置脚本

方便设置一些基本的linux安全设置

 
#vi autosafe.sh
 
#!/bin/bash
#########################################################################
#
# File:         autosafe.sh
# Description:
# Language:     GNU Bourne-Again SHell
# Version: 1.1
# Date: 2010-6-23
# Corp.: c1gstudio.com
# Author: c1g
# WWW: http://blog.c1gstudio.com
### END INIT INFO
###############################################################################
 
V_DELUSER="adm lp sync shutdown halt mail news uucp operator games gopher ftp"
V_DELGROUP="adm lp mail news uucp games gopher mailnull floppy dip pppusers popusers slipusers daemon"
V_PASSMINLEN=8
V_HISTSIZE=30
V_TMOUT=300
V_GROUPNAME=suadmin
V_SERVICE="acpid anacron apmd atd auditd autofs avahi-daemon avahi-dnsconfd bluetooth cpuspeed cups dhcpd firstboot gpm haldaemon hidd ip6tables ipsec isdn kudzu lpd mcstrans messagebus microcode_ctl netfs nfs nfslock nscd pcscd portmap readahead_early restorecond rpcgssd rpcidmapd rstatd sendmail setroubleshoot snmpd sysstat xfs xinetd yppasswdd ypserv yum-updatesd"
V_TTY="3|4|5|6"
V_SUID=(
'/usr/bin/chage'
'/usr/bin/gpasswd'
'/usr/bin/wall'
'/usr/bin/chfn'
'/usr/bin/chsh'
'/usr/bin/newgrp'
'/usr/bin/write'
'/usr/sbin/usernetctl'
'/bin/traceroute'
'/bin/mount'
'/bin/umount'
'/sbin/netreport'
)
version=1.0
 
 
# we need root to run
if test "`id -u`" -ne 0
then
echo "You need to start as root!"
exit
fi
 
case $1 in
"deluser")
echo "delete user ..."
for i in $V_DELUSER ;do
echo "deleting $i";
userdel $i ;
done
;;
 
"delgroup")
echo "delete group ..."
for i in $V_DELGROUP ;do
echo "deleting $i";
groupdel $i;
done
;;
 
"password")
echo "change password limit ..."
echo "/etc/login.defs"
echo "PASS_MIN_LEN $V_PASSMINLEN"
sed -i "/^PASS_MIN_LEN/s/5/$V_PASSMINLEN/" /etc/login.defs
;;
 
"history")
echo "change history limit ..."
echo "/etc/profile"
echo "HISTSIZE $V_HISTSIZE"
sed -i "/^HISTSIZE/s/1000/$V_HISTSIZE/" /etc/profile
;;
 
"logintimeout")
echo "change login timeout ..."
echo "/etc/profile"
echo "TMOUT=$V_TMOUT"
sed -i "/^HISTSIZE/a\TMOUT=$V_TMOUT" /etc/profile
;;
 
"bashhistory")
echo "denied bashhistory ..."
echo "/etc/skel/.bash_logout"
echo 'rm -f $HOME/.bash_history'
if egrep "bash_history" /etc/skel/.bash_logout > /dev/null
then
echo 'warning:existed'
else
echo 'rm -f $HOME/.bash_history' >> /etc/skel/.bash_logout
fi
 
;;
"addgroup")
echo "groupadd $V_GROUPNAME ..."
groupadd $V_GROUPNAME
;;
 
"sugroup")
echo "permit $V_GROUPNAME use su ..."
echo "/etc/pam.d/su"
echo "auth sufficient /lib/security/pam_rootok.so debug"
echo "auth required /lib/security/pam_wheel.so group=$V_GROUPNAME"
if egrep "auth sufficient /lib/security/pam_rootok.so debug" /etc/pam.d/su > /dev/null
then
echo 'warning:existed'
else
echo 'auth sufficient /lib/security/pam_rootok.so debug' >> /etc/pam.d/su
echo "auth required /lib/security/pam_wheel.so group=${V_GROUPNAME}" >> /etc/pam.d/su
fi
;;
 
"denyrootssh")
echo "denied root login ..."
echo "/etc/ssh/sshd_config"
echo "PermitRootLogin no"
sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
;;
 
"stopservice")
echo "stop services ..."
for i in $V_SERVICE ;do
service $i stop;
done
;;
 
"closeservice")
echo "close services autostart ..."
for i in $V_SERVICE ;do
chkconfig $i off;
done
;;
 
"tty")
echo "close tty ..."
echo "/etc/inittab"
echo "#3:2345:respawn:/sbin/mingetty tty3"
echo "#4:2345:respawn:/sbin/mingetty tty4"
echo "#5:2345:respawn:/sbin/mingetty tty5"
echo "#6:2345:respawn:/sbin/mingetty tty6"
sed -i '/^[$V_TTY]:2345/s/^/#/' /etc/inittab
;;
 
"ctrlaltdel")
echo "close ctrl+alt+del  ..."
echo "/etc/inittab"
echo "#ca::ctrlaltdel:/sbin/shutdown -t3 -r now"
sed -i '/^ca::/s/^/#/' /etc/inittab
;;
 
"lockfile")
echo "lock user&services ..."
echo "chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/services"
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/services
;;
 
"unlockfile")
echo "unlock user&services ..."
echo "chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/services"
chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/services
;;
 
"chmodinit")
echo "init script only for root ..."
echo "chmod -R 700 /etc/init.d/*"
echo "chmod 600 /etc/grub.conf"
echo "chattr +i /etc/grub.conf"
chmod -R 700 /etc/init.d/*
chmod 600 /etc/grub.conf
chattr +i /etc/grub.conf
;;
 
"chmodcommand")
echo "remove SUID ..."
echo "/usr/bin/chage /usr/bin/gpasswd ..."
for i in ${V_SUID[@]};
do
chmod a-s $i
done
;;
 
        "version")
                echo "Version: Autosafe for Linux $version"
                ;;
 
*)
echo "Usage: $0 <action>"
echo ""
echo " deluser      delete user"
echo " delgroup     delete group"
echo " password     change password limit"
echo " history      change history limit"
echo " logintimeout      change login timeout"
echo " bashhistory      denied bashhistory"
echo " addgroup      groupadd $V_GROUPNAME"
echo " sugroup      permit $V_GROUPNAME use su"
echo " denyrootssh      denied root login"
echo " stopservice     stop services "
echo " closeservice      close services"
echo " tty      close tty"
echo " ctrlaltdel     close ctrl+alt+del "
echo " lockfile      lock user&services"
echo " unlockfile      unlock user&services"
echo " chmodinit      init script only for root"
echo " chmodcommand      remove SUID"
echo " version      "
echo ""
 
;;
esac
设置权限
 
chmod u+x ./autosafe.sh
运行脚本
 
./autosafe.sh deluser
./autosafe.sh delgroup
.....