基线安全与linux基线加固方法

1.基线

即安全基线配置，诸如操作系统、中间件和数据库的一个整体配置，这个版本中各项配置都符合安全方面的标准。比如在系统安装后需要按安全基线标准，将新机器中各项配置调整到一个安全、高效、合理的数值。

2.基线扫描

使用自动化工具、抓取系统和服务的配置项。将抓取到的实际值和标准值进行对比，将不符合的项显示出来，最终以报告的形式体现出扫描结果

有的工具将配置采集和配置对比分开，通过自动化脚本采集配置后再通过特别的软件转换为适合人类阅读的文档

3.自动化脚本

.sh文件为执行文件。而.pl文件则包含着检查命令。

下面给出两个文件的截图





4.Linux基线加固

下面对重要程度排名靠前的项进行脚本加固



基线加固脚本如下：

（*所有操作均在拷贝后执行）

echo ---------------开始--------------------
echo ---------------aboutkey----------------
cd /etc
if [ -f login.defs ];then
cp /etc/login.defs  /home/test1
MINDAY=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MIN_DAYS|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_DAYS.*/PASS_MIN_DAYS 6/' /home/test1/login.defs
WARNAGE=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_WARN_AGE|awk '{print $1}'`
sed -i ''$WARNAGE's/.*PASS_WARN.*/PASS_WARN_AGE 30/' /home/test1/login.defs
MAXDAY=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MAX_DAYS|awk '{print $1}'`
sed -i ''$MAXDAY's/.*PASS_MAX.*/PASS_MAX_DAYS 90/' /home/test1/login.defs
MINLEN=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MIN_LEN|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_LEN.*/PASS_MIN_ LEN 6/' /home/test1/login.defs
fi
echo --------------------ok---------------------------
echo -------------------stop the del------------------------
cd /etc/init
if [ -f control-alt-delete.conf ];then
cp /etc/init/control-alt-delete.conf /home/test1
#delete=`grep -n "/sbin/shutdown -r now" /home/test1/control-alt-delete.conf | cut -d ":" -f 1`
#sed -i ''$delete' r s/^/#/' /home/test1/control-alt-delete.conf
#cp /etc/init/control-alt-delete.conf /home/test1
#num1=`grep -n "/sbin/shutdown" /home/test1/control-alt-delete.conf | cut -d "" -f 1`
#sed -i ''$num' r s/^/#/' /home/test1/control-alt-delete.conf
#a=`cat -n /home/test1/control-alt-delete.conf|grep -v "#" | grep "/sbin/shutdown" | awk '{print $1}'`
#text=`sed -n "$a"p /home/test1/control-alt-delete.conf`
#sed -i ''$a'c # '$text'' /home/test1/control-alt-delete.conf
a=`cat -n /home/test1/control-alt-delete.conf|grep -v "#" | grep /sbin/shutdown | awk '{print $1}'`
if [ -z $a ];then
echo ok
else
sed -i ''$a' s/^/#/' /home/test1/control-alt-delete.conf
fi
fi
echo ---------------------ok---------------------------------------
echo ------------------------grub and lilo key------------------------
grub="/home/test1/menu.lst"
if [ ! -x "$grub" ];then
touch "$grub"
echo password=123456 >> "$grub"
else
echo password=123456 >> "$grub"
fi
lilo="/home/test1/lilo.conf"
if [ ! -x "$lilo" ];then
touch "$lilo"
echo password=123456 >> "$lilo"
else
echo password=123456 >> "$lilo"
fi
echo ---------------------ok--------------------------------------
echo ----------------------the history of mouthpasswd------------------
cd /etc
if [ -f profile ];then
cp /etc/profile /home/test1
#num=`sed -n /home/test1/profile | grep HISTFILESIZE | awk '{print $1}'`
#/home/test1/profile | sed $num'c HISTFILESIZE=5'
echo "HISTFILESIZE=5" >> /home/test1/profile
echo "ulimit -S -c unlimited" >> /home/test1/profile
fi
echo -------------------------ok---------------------
echo ------------------------issue-----------------
#issu="/etc/issue.net"
cd /etc
if [ -f issue.net ];then
cp  issue.net  /home/test1/issue.net.bak
echo ok
fi
echo ok
if [ -f issue ];then
cp issue /home/test1/issue.bak
echo ok
fi
echo -----------------------allow/deny ip-------------------
cd /etc
if [ -f hosts.allow ];then
cp /etc/hosts.allow /home/test1
echo "all:172.18.12.:all" >> /home/test1/hosts.allow
echo "sshd:172.18.12.:all" >> /home/test1/hosts.allow
fi
cd /etc
if [ -f hosts.deny ];then
cp /etc/hosts.deny /home/test1
echo "all:all" >> /home/test1/hosts.deny
fi
echo -----------------ok------------------------
#/etc/init.d/xinetd restart
echo -----------------------------core dump-------------------
cd /etc/security
if [ -f limits.conf ];then
cp /etc/security/limits.conf  /home/test1
echo "*soft core 0" >> /home/test1/limits.conf
echo "*hard core 0" >> /home/test1/limits.conf
fi
echo --------------ok-------------------------
echo ----------------------------passwdrepeat---------------------
cd /etc/pam.d
if [ -f system-auth ];then
cp /etc/pam.d/system-auth  /home/test1
#num=`grep -n "md5" /home/test1/system-auth | cut -d ":" -f 1`
#sed -i ''$num'	r s/$/ remember=5' /home/test1/system-auth
kk=`cat -n /home/test1/system-auth | grep -v ".*#.*"| grep md5|awk '{print $1}'`
echo $kk
version="password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=500"
sed -i ""$kk"c $version" /home/test1/system-auth
letter=`cat -n /home/test1/system-auth |grep password | grep requisite | awk '{print $1}'`
sed -i ''$letter's/pam_cracklib.so/& ucredit=-1 lcredit=-1 dcredit=-1 /' /etc/pam.d/system-auth
fi
echo -----------------ok--------------------
echo --------------------超出退出--------------
cd /etc
if [ -f profile ];then
cp /etc/profile /home/test1
echo "export TMOUT=600" >> /home/test1/profile
fi
echo ------------------ok-------------------
echo ------------------权限-------------------
chmod 644 /etc/passwd
chmod 644 /etc/group
chmod 400 /etc/shadow
#chmod 600 /etc/xinetd.conf
chmod 644 /etc/services
chmod 600 /etc/security
chmod 600 /etc/grub.conf
chmod 600 /boot/grub/grub.conf
chmod 600 /etc/lilo.conf

echo ------------------unmask--------------------
cp /etc/csh.cshrc /home/test1
cp /etc/csh.login /home/test1
cp /etc/bashrc /home/test1
cp /etc/profile /home/test1
sed -i '11 s/.*umask.*/umask 077/' /home/test1/csh.cshrc

sed -i '58 s/.*umask.*/umask 077/' /home/test1/csh.login

sed -i '66 s/.*UMASK.*/UMASK 077/' /home/test1/bashrc

sed -i '62s/.*umask.*/umask 077/' /home/test1/profile
echo --------------------before login banner-------------------
cd /etc
if [ -f ssh_banner ];then
touch /etc/ssh_banner
chown bin:bin /etc/ssh_banner
chmod 644 /etc/ssh_banner
echo "Authorized only.All activity will be monitored and reported" > /etc/ssh_banner
fi
echo -----------------------ok----------------------------
echo -------------------stop root ssh login------------------
cp /etc/pam.d/login /home/test1
echo "auth   required   pam_securetty.so" >> /home/test1/login
cp /etc/ssh/sshd_config /home/test1
echo "Banner /etc/ssh_banner" >> /home/test1/sshd_config
echo "PermitRootLogin no" >> /home/test1/sshd_config
service sshd restart
echo -------------------------ok-------------------
echo --------------------openssh----------------------------
openssh=`cat -n /home/test1/sshd_config | grep -v ".*#.*"| grep Protocol |awk '{print $1}'`
sed -i ''$openssh's/.*Protocol.*/Protocol 2/' /home/test1/sshd_config
echo -------------ok---------------------------