Centos Security Protection Settings

There are a lot of spam on the network to scan the root account, so it is necessary to do a good job of security! The following are some security settings for reference only:
1. Modify the SSH port
Vi/etc/ssh/sshd_config
Port22 Modification
PermitEmptyPasswordsno: unregister #-Do Not Allow Empty Password accounts to log on to the server!
If MaxAuthTries2 does not work twice, log on to the server through SSH again.

2. automatic logout without any operation within 5 minutes:
Vim/etc/profile
ExportTMOUT =-5 minutes automatically canceled
Find
History Size = 1000
To:
HISTSIZE = 100 -- reduce the size of the diary to kb, which is too large to leak important information.

3. Modify file attributes
Chmod700/bin/rpm: only root users can use rpm to install software packages.
Chmod664/etc/hosts
Chmod644/etc/passwd
Chmod644/etc/exports
Chmod644/etc/issue
Chmod664/var/log/wtmp
Chmod664/var/log/btmp
Chmod644/etc/services
Chmod600/etc/shadow
Chmod600/etc/login. defs
Chmod600/etc/hosts. allow
Chmod600/etc/hosts. deny
Chmod600/etc/securetty
Chmod600/etc/security
Chmod600/etc/ssh/ssh_host_key
Chmod600/etc/ssh/sshd_config
Chmod600/var/log/lastlog
Chmod600/var/log/messages

4. ping prohibited users from Using ping without any reflection
Echo1>/proc/sys/net/ipv4/icmp_echo_ignore_all -- disable ping
Echo0>/proc/sys/net/ipv4/icmp_echo_ignore_all -- disable ping

5. Disable IP Spoofing
Vi/etc/host. conf
Add:
Nospoofon

6. Prevent DOS Attacks:
Vi/etc/security/limits. conf
Add the following configurations:
* Hardcore0
* Hardrss10000
* Hardnproc20

The above are based on your needs!

7. the more complex the root account password, the better:
7.1. It contains uppercase and lowercase letters;
7.2 contains numbers;
7.3 characters;
7.4. Do not use your own birthday or other frequently associated letters, numbers, and characters.

8. Delete unnecessary users and groups:
# Cut-d:-f1/etc/passwd # view all users in the system
# Cut-d:-f1/etc/group # view all groups in the system
Userdeladm
Userdellp
Userdelnews
Userdeluucp
Userdelgames
Groupdeladm
Groupdellp
Groupdelnews
Groupdeluucp
Groupdelgames
Groupdeldip

9. block junk IP addresses
More/var/log/secure

First, observe the spam IP addresses that you want to remotely log on to the server using the preceding command;
Then
Vi/etc/hosts. deny
Added:
Sshd: 61.131.47.157 --- take 61.131.47.157 as an example!
Save it!