Linux system security Protection measures

1. system Security record file

The log files inside the operating system are important clues to detect network intrusion. If the system is connected directly to the Internet, and you find that many people do telnet/ftp logon attempts to the system, you can run the #more/var/secure| grep refused "to check the system for attacks to take corresponding to CAI, such as using SSH to replace Telnet and so on.

2. Startup and login security

(1). BIOS security

Setting the BIOS password and modifying the boot order disables booting the system from the floppy disk.

(2). User Password

User password is the basic requirement for Linux security, although theoretically speaking, as long as there is enough time and resources available, there is no password can not be cracked, but the correct choice of password is difficult to crack.

(3). Default Account

You should disable all default and unnecessary accounts that are started by the operating system itself, which should be done when the system is first installed, the Linux system provides many default accounts, and the more accounts, the system will be vulnerable to attack.

(4). password file

Use the chattr command to add an immutable attribute to the following file, thereby preventing unauthorized users from gaining access, using the following command.

[Email protected] ~]# chattr +i/etc/passwd

[Email protected] ~]# chattr +i/etc/shadow

[Email protected] ~]# chattr +i/etc/group

[Email protected] ~]# chattr +i/etc/gshadow

(5). Disable Ctrl+alt+delete Restart the machine command.

Modify the/etc/inittab file, comment out the "Ca::ctrlaltdel:/sbin/shutdown-t3-r Now" line, and then reset the permissions for all files in the/etc/rc.d/init.d/directory, run the following command.

[Email protected] ~]# chmod-r 700/etc/rc.d/init.d/*

This allows only root to read, write, or execute all of the above script files.

(6). Restrict the use of the SU command

If you do not want any user to be able to switch to root using Su, you can edit the/etc/pam.d/su file to add the following two lines.

Auth sufficient/lib/security/pam_root.so Debug

Auth required/lib/security/pam_wheel.so GROUP=ISD

At this point, only users with the ISD group can switch to root with Su. Thereafter, if you want user admin to be able to switch to root with Su, you can run the following command:

[Email protected] ~]# usermod-g Wang

3. Preventing cyber attacks

(1). Block Ping

If no one can ping the universal user's system, security naturally increases. To do this, you can add the following line to the/etc/rc.d/rc.local file.

Echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_all

When you save the file and restart the computer, no one can ping the computer.

(2) Prevent IP spoofing

Edit the/etc/host.conf file and add the following lines to prevent IP spoofing attacks.

Order bind,hosts

Multi off

Nospoof on

(3). Prevent Dos attacks

Setting resource limits on all users of the system can prevent DOS type attacks, such as the maximum number of processes and memory usage. For example, you can add the following lines to the/etc/security/limits.conf file.

Hard Core 0

Hard RSS 5000

Hard Nproc 20

You must then edit the/etc/pam.d/login file to check if the following line of data exists in the file.

Session required/lib/security/pam_limits.so

The above name prevents debugging files, limits the number of processes by 20, and restricts memory usage to 5MB.

Linux system security Protection measures