Centos 5.5 System Security Configuration

1. Comment out unnecessary users and user groups

1. VI/etc/passwd

1. # Adm
2. # Lp
3. # Sync
4. # Shutdown
5. # Halt
6. # News
7. # Uucp
8. # Operator
9. # Games
10. # Gopher
11. # Ftp

1. VI/etc/group

1. # Adm
2. # Lp
3. # News
4. # Uucp
5. # Games
6. # Dip

2. Add unchangeable attributes to the following files to prevent unauthorized users from obtaining permissions.

1. # Chattr + I/etc/passwd
2. # Chattr + I/etc/shadow
3. # Chattr + I/etc/group
4. # Chattr + I/etc/gshadow

After the permission is modified, the user cannot be added or deleted. To cancel the previous modification,

1. # Lsattr/etc/passwd/etc/shadow/etc/group/etc/gshadow

Lsattr only displays the attributes of a file.

1. # Chattr-I/etc/passwd
2. # Chattr-I/etc/shadow
3. # Chattr-I/etc/group
4. # Chattr-I/etc/gshadow

View again
Lsattr/etc/passwd/etc/shadow/etc/group/etc/gshadow
-----/Etc/passwd
-----/Etc/shadow
-----/Etc/group
-----/Etc/gshadow
After modification, execute

1. Chattr + I/etc/passwd
2. Chattr + I/etc/shadow
3. Chattr + I/etc/group
4. Chattr + I/etc/gshadow

Disable Ctrl + ALT + Delete from restarting machine commands

3. Modify the/etc/inittab file and comment out "CA: ctrlaltdel:/sbin/shutdown-t3-rnow" line.

Then reset the permission for all files in the/etc/rc. d/init. d/directory and run the following command:

1. # Chmod-r 700/etc/rc. d/init. d /*

In this way, only the root user can read, write, or execute all the above script files.

4. Restrict su commands

If you do not want anyone to use Su as the root user, you can edit the/etc/PAM. d/su file and add the following two lines:

1. Auth sufficient/lib/security/pam_rootok.sodebug
2. Auth required/lib/security/pam_wheel.sogroup = ISD

In this case, only users in the ISD group can use Su as the root user. After that, if you want the user admin to be able to su as root, you can run the following command:

1. # Usermod-G 10 Admin

5. Prevent Attacks

1) Prevent Ping and resist SYN:
If no one can ping the system, the security will naturally increase. Therefore, we can add the following line to the/etc/rc. d/rc. Local file:

1. Echo 1>/proc/sys/NET/IPv4/icmp_echo_ignore_all

SYN attacks use the three-way handshake principle of the TCP/IP protocol to send a large number of network packets that establish connections, but do not actually establish connections. As a result, the network queue of the attacked server is full, cannot be accessed by normal users.
The Linux Kernel provides several syn-related configurations. Run the following command:

1. Sysctl-A | grep SYN

See:
Net. ipv4.tcp _ max_syn_backlog = 1024
Net. ipv4.tcp _ syncookies = 0
Net. ipv4.tcp _ synack_retries = 5
Net. ipv4.tcp _ syn_retries = 5
Tcp_max_syn_backlog is the length of the SYN queue, and tcp_syncookies are a function. Whether to enable the SYN Cookie function can prevent some SYN attacks. Tcp_synack_retries and tcp_syn_retries define the number of retries of syn.
Increasing the SYN queue length can accommodate more network connections waiting for connection. Enabling the SYN Cookie function can prevent some SYN attacks and reduce the number of retries.
To adjust the preceding settings, follow these steps:
VI/etc/rc. d/rc. Local, add the following command Method

1. Sysctl-W net. ipv4.tcp _ max_syn_backlog = 2048 # increase the SYN queue length to 2048
2. Sysctl-W net. ipv4.tcp _ syncookies = 1 # enable the SYN Cookie Function
3. Sysctl-W net. ipv4.tcp _ synack_retries = 3 # reduce the number of retries
4. Sysctl-W net. ipv4.tcp _ syn_retries = 3

2) prevent IP Spoofing
Edit the host. conf file and add the following lines to prevent IP spoofing attacks.

1. Order hosts, bind # name interpretation order
2. Multi on # Allow the host to have multiple IP addresses
3. Nospoof on # Disable IP Address Spoofing

3) Prevent DoS Attacks
Setting resource limits for all users of the system can prevent DoS attacks, such as the maximum number of processes and memory usage.
For example, you can add the following lines in/etc/security/limits. conf:

1. * Hard core 0
2. * Hard RSS 5000
3. * Hard nproc 20

Then, you must edit the/etc/PAM. d/login file to check whether the following row exists.
Session required/lib/security/pam_limits.so
4) modify the sshd_config file
First, modify the configuration file VI/etc/ssh/sshd_config.
A. Modify the ssh port
Find the section # port 22, which indicates that port 22 is used by default and changed to the following:

1. Port 22
2. Port 50000

Save and exit
Run/etc/init. d/sshd restart
In this way, the ssh port will work on both 22 and 50000.
Now edit the firewall configuration: VI/etc/sysconfig/iptables
Port 50000 is enabled.
Run/etc/init. d/iptables restart
Now, use the SSH tool to connect to port 50000 to test whether the connection is successful.
If the connection is successful, edit the settings of sshd_config again and delete port22.
B only uses SSH v2
Change # Protocol 2 to Protocol 2
C. Restrict SSH access.
Assume that you only need the root, Vivek, and Jerry users to use the system via SSH and add the following to the sshd_config configuration file:

1. Allowusers root Vivek Jerry

D. Configure the idle time-out exit interval.
You can log on to the server through SSH. You can set an idle timeout interval to avoid orphan SSH sessions. Open the sshd_config configuration file to ensure the following configuration items are available:

1. Clientaliveinterval 300
2. Clientalivecountmax 0

In the preceding example, the idle timeout interval is set to 300 seconds, that is, 5 minutes. After this time, the idle user is automatically kicked out (which can be understood as logout or logout ).
E. Disable the. rhosts file.
Do not read the user's ~ /. Rhosts and ~ /. Shosts file. Use the following settings to update the sshd_config configuration file:
IgnoreRhosts Yes
SSH can simulate outdated RSH commands. RSH is recognized as an insecure Remote Access Protocol and must be disabled.

6. Restrict the permissions of different files

1. [Root @ localhost ~] # Chmod 700/usr/bin/
2. [Root @ localhost ~] # Chmod 750/usr/bin/* ++ *
3. [Root @ localhost ~] # Chmod 750/usr/bin/C ++ *
4. [Root @ localhost ~] # Chmod 750/usr/bin/LD
5. [Root @ localhost ~] # Chmod 750/usr/bin/
6. [Root @ localhost ~] # Locate sqlaccess
7. /Opt/lampp/bin/mysqlaccess
8. [Root @ localhost ~] # Chmod 755/opt/lampp/bin/mysqlaccess
9. [Root @ localhost ~] # Chattr + A. bash_history
10. [Root @ localhost ~] # Chattr + I. bash_history
11. [Root @ localhost ~] # Chmod 700/bin/ping
12. [Root @ localhost ~] # Chmod 700/usr/bin/finger
13. [Root @ localhost ~] # Chmod 700/usr/bin/WHO
14. [Root @ localhost ~] # Chmod 700/usr/bin/W
15. [Root @ localhost ~] # Chmod 700/usr/bin/locate
16. [Root @ localhost ~] # Chmod 700/usr/bin/whereis
17. [Root @ localhost ~] # Chmod 700/usr/bin/Vim
18. [Root @ localhost ~] # Chmod 700/usr/bin/make
19. [Root @ localhost ~] # Chmod 700/bin/netstat
20. [Root @ localhost ~] # Chmod 700/usr/bin/tail
21. [Root @ localhost ~] # Chmod 700/usr/bin/less
22. [Root @ localhost ~] # Chmod 700/usr/bin/head
23. [Root @ localhost ~] # Chmod 700/bin/cat
24. [Root @ localhost ~] # Chmod 700/bin/uname
25. [Root @ localhost ~] # Chmod 500/bin/PS
26. [Root @ localhost ~] # Chmod 500/usr/sbin/lsof