Linux Security Hardening

1. Check if the shadow has empty password users and other Super Administrator users:

Awk-f: ' ($ = = "") {print $} '/etc/shadowawk-f: ' ($3==0) '/etc/passwd

2. Lock out redundant self-built (test) accounts in the system and back up

CAT/ETC/PASSWD && Cp/etc/passwd/etc/passwd.bakcat/etc/shadow && cp/etc/shadow/etc/shadow.bakcp/et C/profile/etc/profile.bak

3. Check the System password policy

Cat/etc/login.defs|grep pass#pass_max_daysmaximum number of days a password could be used. #PASS_MIN_DAYSMinimum Number of D Ays allowed between password changes. #PASS_MIN_LENMinimum acceptable password length. #PASS_WARN_AGENumber of Days Warning given before a password expires. Pass_max_days99999pass_min_days0pass_min_len5pass_warn_age7

4. Deactivate or disable unrelated services

Who-r//view current RunLevel chkconfig--list

5. Set access control Policy

Deny certain users login, allow some users to log in, deny certain group logins, allow certain groups to log on

Denyusers,allowusers,denygroups,allowgroupseg:denyusers AAA BBB//Disable multiple accounts separated by spaces

If write-only allowusers indicates that the user is rejected if it does not match

Permitrootlogin no//deny root user Login

Cp/etc/ssh/sshd_config/etc/ssh/sshd_config.bakgrep Banner/etc/ssh/sshd_configbanner/etc/ssh/ssh_login_banner

# Banner None//Cancel Banner message cat/etc/ssh/ssh_login_bannerwelcome to CentOS 6.5

See if there's any/etc/inittab inside.

#ca:: Ctrlaltdel:/sbin/shutdown-t3-r now//disable Ctrl+alt+delvi/etc/pam.d/system-authauth required pam_tally.so ONERR=FA Il deny=6 unlock_time=300//password consecutive error 6 times, account lockout 300 seconds

Vi/etc/profile

tmout=600//No operation 600 seconds auto Exit Source/etc/profile

Cat/etc/grub.conf|grep Password//See if GRUB sets a password

Audit strategy:

PS-AEF | grep syslog |grep-v grep//Confirm that the syslog is enabled grep weekly/etc/logrotate.conf# rotate log files Weeklyweeklygrep 4/etc /logrotate.conf# Keep 4 weeks worth of backlogsrotate 4cat/etc/logrotate.d/syslog/var/log/cron/var/log/maillog/var/ Log/messages/var/log/secure/var/log/spooler

This article from "Pengcheng-soy sauce bottle" blog, declined reprint!

Linux Security Hardening