Getting started with cainiao: six security configurations in Linux

Article Title: getting started with cainiao: six tips for Security Configuration in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

1. Use a firewall to close unnecessary ports. If someone else fails to PING the server, the threat is naturally reduced by more than half.

Methods To prevent ping by others:

1) at the command prompt

Echo 1>/proc/sys/net/ipv4/icmp_ignore_all

2) use a firewall to prohibit (or discard) icmp Packets

Iptables-a input-p icmp-j DROP

3) do not respond to all ICMP Packets

For example, ping tracert.

2. Change the SSH port to over 10000, and the chances of others scanning the port will also decrease.

Vi/etc/ssh/sshd_config

Change PORT to PORT 1000 or above

Create a Common Logon user and cancel direct root logon.

Useradd 'username'

Passwd 'username'

Vi/etc/ssh/sshd_config

Add the following sentence at the end:

PermitRootLogin no # cancel root direct remote login

3. Delete redundant accounts with a bloated system: userdel adm userdel lp userdel sync userdel shutdown userdel halt userdel news userdel uucp userdel operator userdel games userdel gopher userdel ftp if you do not allow anonymous FTP, delete this user account groupdel adm groupdel lp groupdel news groupdel uucp groupdel games groupdel dip groupdel pppusers

4. Change the following file permissions so that no one has the permission to change the account: chattr + I/etc/passwd chattr + I/etc/shadow chattr + I/etc/group chattr + I/etc/gshadow

5. chmod 600/etc/xinetd. conf

6. Disable Anonymous FTP User Login