Linux Security and Applications

Password Security Control

set the password to valid for days:vim/etc/login.defs

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ("/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

the expiration date should be at Lisi User:chage–m30 Lisi

in some special cases, such as requiring users of bulk creation to have their own password when they first log on, requiring all users to update the password according to the security plan, you can have an administrator enforce the policy so that the user must change the password at the next logon:

Chage–d 0 Lisi

command history, Automatic logoff.

the command history mechanism of the shell environment provides great convenience to the user. But the security barrier of the server is a notch more. in the Bash terminal environment, the number of record bars in the history directory has variable histsize control. The default is the bar. By modifying the value of the histsize variable in the/etc/profile file , you can affect all users in the system:

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ("/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

You can also modify the ~/.bash_logout file in the host directory to add an action statement that clears the history command:

650) this.width=650, "width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/themes/default/images/word.gif") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

Bash terminal environment, you can also set an idle time-out period, when more than the specified time without any input automatically log off the terminal, you can effectively avoid when the administrator is not in the wrong operation of the server risk. Vim/etc/profile exporttmout=600

User Switching and power-up

The SU command is primarily used to switch users, and the sudo command is used to elevate execution permissions

Su command: Switches to the specified other user, thereby having all the permissions for that user.

The option "-" is equivalent to "--login" or "-l", which means that the user is switched tothe target user's login shell environment, and if this option is missing, the user environment is not switched. to switch The root user, you can omit it.

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

with the pam_wheel authentication module, only individual users are allowed to switch with the su command. Implementation process: Add users who are authorized to use the SU command to the wheel group and modify the/etc/pam.d/su authentication.

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

sudo command--Elevate execution Permissions

The su command makes it very easy to switch to another user, but only if the login password of the target user must be known

configuration file /etc/sudoers Add Authorization in

the Sudo mechanism's configuration file is /etc/sudoers, and the file's default permissions are the same, and need to be edited using specialized Visudo tools.

basic configuration format for authorization:

Usermachine=commands

User: Authorized user name, or in the form of "% Group name"

Host ( machine): Use the host name of this profile to make it easy to share the same sudoers file across multiple hosts , generally set as localhost file

Command ( COMMANDS): Allow authorized users to execute the command via sudo, fill in the full path of the commanding program, separated by commas between multiple commands

A centrally defined alias can be used when more authorized users are available, or when more commands are authorized. User, host, command parts can be defined as aliases, respectively, through the keyword user_alias,host_alias,cmnd_alias to set.

User_alias Operators=jerry,tom,tsengyia

Host_alias Mailsvrs=smtp,pop

Cmnd_alias Pkgtools=/bin/rpm,/usr/bin/yum

OPERATORS Mailsvrs=rkgtools

650) this.width=650; "Width=" 553 "height=" "src=,"/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

Sudo Configuration records the portion of the command that allows the use of the wildcard "*" to take the inverse symbol "! "Itis especially useful when you need to authorize all commands in a directory or cancel individual commands.

execute a privileged command with sudo: just use the normal command line as a parameter to the sudo command. Because privileged command programs are typically located in directories such as/sbin,/usr/sbin. Normal user execution should use an absolute path .

Insufficient authority

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

650) this.width=650; "Width=" 554 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/themes/default/images/word.gif") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

the "sudo-l" command can see the sudo configuration of an authorized user

650) this.width=650; "Width=" 554 "height=" 149 "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ("/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

System Boot and Login control

safety control of Switch Machine

adjust bios boot settings

set the first optimization boot device to the disk on which the current system resides

booting the system from other Devices (CD,U -disk, network, etc.) is prohibited and is set to "disabled "

Change the security level ofthe BIOS to "setup" and set the administrative password to prevent unauthorized modification 。

Disable ctrl+alt+del shortcut key restart

                                         /etc/init/control-alt-delete.conf,

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" background: URL ("/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/> Restrict changes to GRUB boot parameters.

MD5 The algorithm encrypts the string: " Grub-md5-crypt "

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" background: URL ("/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/> the boot process security controls, in the "/boot/gurb/grub.conf" file file can set a password for the Grub menu.

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

re-boot press e Enter GRUB menu, press directly e The boot parameters cannot be modified. You need to press the P key to enter the correct GRUB password. Then press e to add 1. Enter. Press bto enter. Input root passwd

terminal and login control

/etc/init/tty.conf// Control TTY opening of the terminal

/etc/init/start-ttys.conf// Control TTY number of open terminals, device files

/etc/sysconfig/init// Control TTY number of opening of terminal, terminal color

Disable root User login

Linux System, Login The program will read /etc/securetty file to decide to allow Root which terminals the user logs into the system.

650) this.width=650, "width=" 553 "height=", "src=", "/e/u261/themes/default/images/spacer.gif" style= "Background:url" ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

prohibit normal user login

Login The program will check /etc/nologin whether the file exists, and if so, denies normal user login to the system.

650) this.width=650; "Width=" 553 "height=" "src="/e/u261/themes/default/images/spacer.gif "style=" Background:url ( "/e/u261/lang/zh-cn/images/localimage.png") no-repeat center;border:1px solid #ddd; "alt=" Spacer.gif "/>

This article is from the "11853028" blog, please be sure to keep this source http://11863028.blog.51cto.com/11853028/1875370

Linux Security and Applications