Examples of necessary protection measures for Linux operating system security

System security Log files

The record file inside the operating system is an important clue to detect whether there is a network intrusion. If your system is connected directly to the Internet, you find a lot of people doing telnet/ftp login attempts on your system and can run "#more/var/log/secure | grep refused "to check the system for attacks to take appropriate countermeasures, such as using SSH to replace Telnet/rlogin, and so on.

Startup and logon security

1. BIOS Security

Setting the BIOS password and modifying the boot order prevents booting the system from the floppy disk.

2. User Password

User password is a basic starting point for Linux security, many people use the user password is too simple, which is tantamount to the intruder open the door, although theoretically, as long as there is enough time and resources available, there is no user password can not be cracked. But choosing the right password is hard to crack, and a better user password is a string of characters that only he can remember and understand, and never write anywhere.

3. Default account Number

All default accounts that are started by the operating system itself should be banned and should be done when you first install the system, and Linux provides a number of default accounts, and the more accounts you have, the more vulnerable the system is to attack.

You can delete an account with the following command.

# userdel用户名

or delete the group user account with the following command.

# groupdel username

4. password file

The chattr command adds immutable properties to the following file, preventing unauthorized users from gaining permissions.

# chattr +i /etc/passwd
# chattr +i /etc/shadow
# chattr +i /etc/group
# chattr +i /etc/gshadow

5. Prohibit ctrl+alt+delete reboot machine command

Modify the/etc/inittab file to comment out the "Ca::ctrlaltdel:/sbin/shutdown-t3-r Now" line. Then, reset the permissions for all files under the/etc/rc.d/init.d/directory, and run the following command:

# chmod -R 700 /etc/rc.d/init.d/*

This allows only root to read, write, or execute all of the above script files.