Linux prohibit non-admin group normal user Login Superuser root

As most people know, Linux has the highest privilege of root account, so it is necessary to prevent root login.

1: Prohibit normal users through Su-switch to Superuser root

[Root@localhost ~]# Su-test
[Test@localhost ~]$ su-#正常情况下, you can switch to the root environment
Password:
[Root@localhost ~]#
[Root@localhost ~]# grep "pam_wheel.so"/etc/pam.d/su
#auth Sufficient pam_wheel.so Trust Use_uid
Auth Required pam_wheel.so Use_uid #取消注释后, you cannot Su-login root
[Test@localhost ~]$ Su-
Password:
Su:incorrect Password
[Root@localhost ~]# usermod-g Wheel test #将test加入wheel组即可
[Root@localhost ~]# Su-test
[Test@localhost ~]$ Su-
Password:
[Root@localhost ~]#
[Root@localhost ~]# grep wheel/etc/group
Wheel:x:10:test

2: SSH remote root login is prohibited

Cat >>/etc/ssh/sshd_config <<byrd
#BY: BYRD
Port 22987 #修改为你需要的端口
Permitrootlogin No #禁止root远程登录
Permitemptypasswords No #禁止空密码登录
Usedns No #关闭DNS反向解析
#BY: BYRD
BYRD

3:visudo configuration permissions are configured properly

User_alias MASTER = Manage
Cmnd_alias MASTER = All,!/usr/sbin/visudo*,!/usr/bin/passwd root,!/usr/bin/vim/etc/passwd,!/bin/vi/etc/passwd, \
!/usr/bin/vim/etc/sudoers,!/bin/vi/etc/sudoers,!/bin/chmod,!/bin/chown,!/bin/chgrp #定义运维经理权限