Linux Server Security Initialization

PS: this Shell script is mainly used to initialize security settings for new Linux server systems, including modifying the Yum source of the system, setting character encoding, disabling firewall and Selinux, and disabling unnecessary system services, disable the IPV6 module, adjust the number of files opened by the system, and optimize the system kernel. You can make changes based on your actual situation. before using the changes in the production environment, perform a test and pass the test in CentOS 5.8 i386. #! /Bin/bash # Script Name: initSystem. sh # Description: setup linux system init. # Author: 300 second-51cto.com # Date: 2012-10-30 # set envexport PATH = $ PATH:/bin:/sbin: /usr/sbinexport LANG = "zh_CN.GB18030" # require root to run this script. if [["$ (whoami )"! = "Root"]; then echo "Please run this script as root. "> & 2 exit 1fi # define cmd varSERVICE = 'which service' CHKCONFIG = 'which chkconfig' # Source function library .. /etc/init. d/functions # Modify the system yum source // Modify the system Yum source initYum () {cat <EOF + kernel ++ ------ Welcome to Modify the system yum source. ------ ++ ------------------------------------- ------------------------- + EOF cd/etc/yum. repos. d/\ cp CentOS-Base.repo. $ (date + % F) ping-c 1 baidu.com>/dev/null [! $? -Eq 0] & echo $ "Networking not configured-exiting" & exit 1 wget -- quiet-o/dev/null http://mirrors.sohu.com/help/CentOS-Base-sohu.repo \ Cp CentOS-Base-sohu.repo CentOS-Base.repoecho "Modify the system yum source. -------> OK "sleep 3} # Set the character encoding // Set the character encoding initI18n () {cat <EOF + encoding ++ ------ Welcome to Set the character encoding. ------ ++ -------------------------------------------------------------- + EOFecho "# set LANG =" zh_cn.gb18030 "\ cp/etc/sysconfig/i18n/etc/s Ysconfig/i18n. $ (date + % F) sed-I's # LANG = "en_US.UTF-8" # LANG = "zh_CN.GB18030" # '/etc/sysconfig/i18nsource/etc/sysconfig/i18ngrep LANG/etc/sysconfig/i18necho "Set the character encoding. -------> OK "sleep 3} # Close the firewall and Selinux // Close the firewall and SelinuxinitFirewall () {cat <EOF + signature ++ ------ Welcome to Close the firewall and Selinux. ------ ++- ------------------------------------------------------------- + EOF \ cp/etc/selinux/config. 'date + "% Y-% m-% d _ % H-% M-% S" '/etc/init. d/iptables stopchkconfig iptables offsed-I's/SELINUX = enable/SELINUX = disabled/'/etc/selinux/configsetenforce 0/etc/init. d/iptables statusgrep SELINUX = disabled/etc/selinux/configecho "Close the firewall and Selinux. -------> OK "sleep 3} # Close unnecessary System service // disable unnecessary system service initService () {cat <EOF + -------------------------------------------------------------- ++ ------ Welcome to Close unnecessary system service. ------ ++ -------------------------------------------------------------- + EOFexport LANG = "en_US.UTF-8" for I in 'chkconfig -- list | grep 3: on | awk '{print $1 }''; do chkconfig -- level 3 $ I off; donefor I in crond network sshd syslog; do chk Config -- level 3 $ I on; doneexport LANG = "zh_CN.GB18030" echo "Close unnecessary system service. ------> OK "sleep 3} # Set the sshConfig banned root login // Set sshConfig to prohibit root login to initSsh () {cat <EOF + -------------------------------------------------------------- ++ ------ Welcome to Set the sshConfig banned root login. ------ ++ ---------------------------------------------------------------- + EOF \ cp/etc/ssh/ss Hd_config/etc/ssh/sshd_config. 'date + "% Y-% m-% d _ % H-% M-% S" 'sed-I's % # Port 22% Port 52113% '/etc/ssh/ sshd_configsed-I's % # PermitRootLogin yes % PermitRootLogin no % '/etc/ssh/sshd_configsed-I's % # using no % PermitEmptyPasswords no %'/etc/ssh/sshd_configsed- i's % # UseDNS yes % UseDNS no '/etc/ssh/sshd_configegrep "UseDNS | 52113 | RootLogin | EmptyPass"/etc/ssh/sshd_config/etc/init. d/sshd reload Echo "Set the sshConfig banned root login. ------> OK "sleep 3} # Disable ctrlaltdel three key to reboot system // Disable ctrl + alt + del three keys to restart the system initSafe () {cat <EOF + -------------------------------------------------------------- ++ -- Welcome to Disable ctrlaltdel three key to reboot system. -- ++ -------------------------------------------------------------- + EOF \ cp/etc/inittab. 'date + "% Y-% m-% d _ % H-% M- % S "'sed-I" s/ca: ctrlaltdel: \/sbin/shutdown-t3-r now/# ca: ctrlaltdel: \/sbin/shutdown-t3-r now/"/etc/inittab/sbin/init qecho" Disable ctrlaltdel three key to reboot system. ------> OK "sleep 3} # Add users and set permissions in sudo // Add SA user and set sudo permission initAddUser () {cat <EOF + -------------------------------------------------------------- ++ ------ Welcome to Add users and set permissions in sudo. ---- -- ++ Tags + EOFdatetmp = 'date + "% Y-% m-% d _ % H-% M-% S" '\ cp/etc/sudoers. $ {datetmp} saUserArr = (test test1 test2) groupadd-g 901 safor (I = 0; I <$ {# saUserArr [@]}; I ++ )) do # add user // add user useradd-g sa-u 90 $ {I }$ {saUserArr [$ I]} # set password // set password echo "$ {saUserArr [$ I]} 123 "| passwd $ {saUserArr [$ I]} -- stdin # set permissions // set sudo permissions [$ (grep" $ {s AUserArr [$ I]} ALL = (ALL) NOPASSWD: ALL "/etc/sudoers | wc-l) -le 0] & echo "$ {saUserArr [$ I]} ALL = (ALL) NOPASSWD: ALL ">/etc/sudoers ['grep" \ % sa "/etc/sudoers | grep-v grep | wc-l'-ne 1] & \ echo" % sa ALL = (ALL) NOPASSWD: ALL ">/etc/sudoersdone/usr/sbin/mongodo-c [$? -Ne 0] &/bin/cp/etc/sudoers. $ {datetmp}/etc/sudoers & echo $ "Sudoers not configured-exiting" & exit 1 echo "Add users and set permissions in sudo. ------> OK "sleep 3} # Adjust the number of open files // Adjust the number of files opened by the system initOpenFiles () {cat <EOF + -------------------------------------------------------------- ++ ------ Welcome to Adjust the number of open files. ------ ++ ---------------------------------- ---------------------------- + EOF \ cp/etc/security/limits. conf/etc/security/limits. conf. 'date + "% Y-% m-% d _ % H-% M-% S" 'sed-I '/# End of file/I \ * \ t -\ tnofile \ t \ t65535 '/etc/security/limits. confulimit-HSn 65535 echo "ulimit-HSn 65535">/etc/rc. localecho "Adjust the number of open files. ------> OK "sleep 3 }# Set system time synchronization // Set the system synchronization time initSysTime () {cat <EOF + ------------------------- ------------------------------------- ++ ------ Welcome to Set system time synchronization. ------ ++ example + EOF yum-y install ntp>/dev/null 2> & 1 ntpdate time.windows.com echo "*/5 *****/usr/sbin/ntpdate time.windows.com> /dev/null 2> & 1 ">/var/spool/cron/rootecho" Set system time synchronization. ------> OK "sleep 3} # Optimization of system ker Nel // optimize the system kernel initKernel () {cat <EOF + -------------------------------------------------------------- ++ ------ Welcome to Optimization of system kernel. ------ ++ ---------------------------------------------------------------- + EOF \ cp/etc/sysctl. conf/etc/sysctl. conf. 'date + "% Y-% m-% d _ % H-% M-% S" 'cat>/etc/sysctl. conf <EOFnet. ipv4.tcp _ timestamps = 0net. ipv4.tcp _ synack_retries = 2net. ipv4.tcp _ syn_retries = 2net. ipv4.tcp _ mem = 94500000 915000000 92700w.net. ipv4.tcp _ max_orphans = 3276800net. core. wmem_default = 8388608net. core. rmem_default = 8388608net. core. rmem_max = 16777216net. core. wmem_max = 16777216net. ipv4.tcp _ rmem = 4096 87380 16777216net. ipv4.tcp _ wmem = 4096 87380 16777216net. core. netdev_max_backlog = 32768net. core. somaxconn = 32768net. ipv4.tcp _ syncookies = 1net. ipv4.tcp _ tw_reuse = 1net. ipv4. Tcp_tw_recycle = 1net. ipv4.tcp _ fin_timeout = 1net. ipv4.tcp _ keepalive_time = 600net. ipv4.tcp _ max_syn_backlog = 65535net. ipv4.ip _ local_port_range = 1024 65535EOF/sbin/sysctl-p echo "Optimization of system kernel. ------> OK "sleep 3 }# Installation system tools // install the system tool initTool () {cat <EOF + ------------------------------------------------------------ + ------ Welcome to Installation system tools. ---- -- ++ ------ <Sysstat ntp net-snmp lrzsz rsync> ------ ++ combine + EOFyum-y install sysstat ntp net-snmp lrzsz rsync>/dev/null 2> & 1 echo" installation system tools. -------> OK "sleep 3} # Prohibit the use of IPV6 // forbidden to use IPV6initIPV6 () {cat <EOF + threads ++ ------ Welcome to Prohibit the use of IPV6. ------ ++ ---------------------------------------------------------------- + EOF \ cp/etc/modprobe. conf/etc/modprobe. conf. 'date + "% Y-% m-% d _ % H-% M-% S" 'echo "alias net-pf-10 off">/etc/modprobe. confecho "alias ipv6 off">/etc/modprobe. confecho "Prohibit the use of IPV6. ------> OK" sleep 3} AStr = "Modify system Yum source, set character encoding, disable firewall and Selinux, disable unnecessary System Service "BStr =" Configure sshConfig, modify the default port 22-> 52113 and disable root logon "CStr =" Disable Ctrl + Alt + Del to restart the system "DStr =" add SA users and set sudo Permissions "EStr =" adjust the number of files opened by the system "FStr =" set system synchronization time "GStr =" optimize system kernel "HStr =" Install system Tool "IStr =" IPV6 IPV6 IPV6 "JStr =" echo "+ ---------------------------------------------------- +" echo "+ ------------------- welcome to initialize the system security settings! --------------- + "Echo" A :$ {AStr} "echo" B :$ {BStr} "echo" C :$ {CStr} "echo" D: $ {DStr} "echo" E :$ {EStr} "echo" F :$ {FStr} "echo" G :$ {GStr} "echo" H: $ {HStr} "echo" I :$ {IStr} "echo" J :$ {JStr} "echo" + ---------------------------------------------------------- + "echo" NOTE: If Initialization is not selected, in 20 seconds, one-click initialization and installation will be automatically selected! "Echo" + -------------------------------------------------------------- + "option ="-1 "read-n1-t20-p" select initialization option [A-B-C-D-E-F-G-H-I-J ]: "optionflag1 =1 (echo $ option | egrep" \-1 "| wc-l) flag2 = $ (echo $ option | egrep "[A-Ja-j]" | wc-l) if [$ flag1-eq 1]; then option = "K" elif [$ flag2-ne 1]; then echo-e "\ n run the script again and enter the letter from A ---> J! "Exit 1 fiecho-e" \ n the option you choose is: $ option \ n "echo" 5 seconds later ...... "sleep 5 case $ option in A | a) initYum initI18n initFirewall initService; B | B) initSsh; C | c) initSafe; D | d) initAddUser ;; E | e) initOpenFiles; F | f) init1_ime; G | g) initKernel; H | h) initTool; I | I) initIPV6; J | j) initYum initI18n initFirewall initService initSsh initSafe initAddUser initOpenFiles initpolicime initKernel initTo Ol initIPV6; *) echo "Enter the letter from A ---> J. Thank you! "Exit; esac usage: copy it and save it as a shell file, such as initSystem. sh. Run sh initSystem. sh to use the script, as shown in:

:
 



Original article: http://300second.blog.51cto.com/7582/1043603