- Linux System Deployment Specification v1.0
- Objective:
- 1, to minimize the operation of the line;
- 2, as far as possible to achieve automated deployment;
- 3, as far as possible to reduce installation services and start-up services;
- 4, the use of security protocols as far as possible to provide services;
- 5, as far as possible to make business systems single;
- 6, as far as possible to monitor all the information can be monitored;
- 7, as far as possible to control all controllable security policies;
- 8. Update patches to patch bugs as regularly as possible;
- Specific specifications:
- A, account and password
- Account:
- 1. For each system maintenance personnel to establish a separate general rights account, for monitoring machine to establish a monitoring account, respectively, for daily system maintenance and system monitoring;
- 2. FTP server configuration virtual account;
- 3. Except the root account, the system maintenance personnel account and the monitoring machine account for all accounts outside the use of shell permissions;
- 4. Lock all accounts that are automatically created when the system is installed;
- Password:
- 1. Strength: 15 or more; Contains letters (uppercase and lowercase letters), numbers and special symbols; English words are not allowed;
- 2. Change frequency: 120 days;
- 3. Recommended way to choose a password: Come up with a sentence, with each word of the first letter and its inclusion, and replace the letter with its similar numbers or symbols to generate a password, but according to the first rule;
- B, program deployment
- 1, before deployment pay attention to check whether there are conflicting business ports and programs;
- 2, the use of automated installation scripts deployed to the Convention directory;
- 3. Delete temporary files and information files with confidentiality restrictions after deployment;
- 4, the command operation should not be directly with the password operation, such as: mysql–uroot–p123456
- 5, after the completion of service deployment, it is easy not to change the system environment, so as not to cause business failure;
- C, System optimization
- Adjust the following kernel parameters to improve the system's ability to prevent IP spoofing and Dos attacks:
- Example:
- Net.ipv4.ip_forward = 0 # for LVS, gateways or VPN servers, to be set to 1
- Net.ipv4.tcp_syncookies = 1
- Net.ipv4.conf.all.accept_source_route = 0
- net.ipv4.conf.all.accept_redirects = 0
- Net.ipv4.conf.all.rp_filter = 1 # for LVS back-end servers, set to 0
- Net.ipv4.icmp_echo_ignore_broadcasts = 1
- net.ipv4.icmp_ignore_bogus_error_responses = 1
- Net.ipv4.conf.all.log_martians = 1
- KERNEL.SYSRQ = 0
- Kernel.core_uses_pid = 1
- D. Service Optimization and security
- 1, the specific performance optimization, according to the hardware , the general need to modify less, depending on the circumstances;
- 2. Service Security
- For reference only:
- Apache
- 1, hidden version number
- Servertokens productonly
- Serversignature OFF
- Or
- Servertokens Prod
- Serversignature OFF
- 2. Disable Symbolic Links
- 3. Run nobody with a specific user
- 4, specify the listening port and IP (if no multi-IP service required)
- 5. root directory Permissions
- 6. Mod_security is an open source Web Application Security program (or Web application firewall) that integrates intrusion detection and defense engine functionality. It runs as a module of the Apache Web server, and the goal is to enhance the security of the Web application. Prevent Web applications from being exposed to known or unknown attacks.
- 7, Mod_evasive is an Apache (httpd) server anti-DDoS module
- 8, Mod_cband module, can limit the user and virtual host bandwidth. Includes: bandwidth limit, maximum download speed, Access request speed per second, and maximum number of concurrent access IP connections
- Php
- 1, hidden version number
- 2. Prohibit remote file function
- 3. Improve program Security
- 4, does not display the error message, needs to check the wrong turn on
- 5. Prohibit global variables (subject to availability)
- Sed-i ' s/expose_php = on/expose_php = Off/g '/home/system/php/lib/php.ini
- Sed-i ' S/allow_url_fopen = On/allow_url_fopen = Off/g '/home/system/php/lib/php.ini
- Sed-i ' S/MAGIC_QUOTES_GPC = OFF/MAGIC_QUOTES_GPC = On/g '/home/system/php/lib/php.ini
- Sed-i ' s/display_errors = on/display_errors = Off/g '/home/system/php/lib/php.ini
- Sed-i ' s/register_globals= on/register_globals= off/g '/home/system/php/lib/php.ini
- 5, Php-ids
- 6. Strengthen PHP scripting language security with Suhosin
- Mysql
- 1. Modify the root user password to remove the empty password
- 2. Delete the default test database
- 3. Run MSYQL with an independent user
- 4. Disable remote connection to the database (turn on specific IP as required)
- 5. Limit the number of connected users
- 6, strict control of user rights: To give users only the minimum required to complete their work, prohibit the grant process, SUPER, FILE permissions to non-administrative accounts;
- 7, prohibit the MySQL data directory to grant Read and write permissions to the MySQL user outside the OS user;
- E, System security
- Security measures for reference only, because the basic software implementation of only a small number of attacks effective, encountered a lot of attacks by the hardware firewall processing.
- Security measures for the CentOS system
- 1. Open Iptables
- Limit port scanning;
- Open the appropriate port for the business;
- Restricted port access for source IP restrictions;
- 2. Install Ossec-hids Intrusion Detection Program
- Ossec is an open-source intrusion detection system, including log analysis, comprehensive detection, rook-kit detection.
- 3. Protection against attacks
- Protection against a small number of Syn-flood attacks
- echo "1″>/proc/sys/net/ipv4/tcp_syn_retries
- echo "1″>/proc/sys/net/ipv4/tcp_synack_retries
- echo "1″>/proc/sys/net/ipv4/tcp_syncookies
- echo "4096″>/proc/sys/net/ipv4/tcp_max_syn_backlog
- Protection against a small number of DDoS attacks
- The first method:
- Installation
- wget http://www.inetbase.com/scripts/ddos/install.sh
- Chmod 0700 install.sh
- ./install.sh
- Uninstallation
- wget Http://www.inetbase.com/scripts/ddos/uninstall.ddos
- Chmod 0700 Uninstall.ddos
- ./uninstall.ddos
- The second method:
- [Email protected]]# cat ddos.sh
- #!/bin/bash
- /bin/netstat-na|grep Established|awk ' {print $ $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-rn|head-10|grep-v-e ' 192.168 |127.0′|awk ' {if ($2!=null && $1>4) {print $}} ' >/tmp/dropip
- For I in $ (CAT/TMP/DROPIP)
- Do
- /sbin/iptables-i input-s $i-j DROP
- /sbin/iptables-d input-s 122.228.193.245-j DROP
- echo "$i kill at ' Date '" >>/var/log/ddos
- Done
- [Email protected] ddos]#
- Protection against ARP attacks
- Binding to Ip+mac on a hardware device
- To the computer room to do two-way binding (pay)
- Protection against CC attacks
- Limit the number of connections per unit of time:
- Protection for Windows Server
- (1), install [Symantec Terminal Protection 12. Small Business Edition]. Endpoint_12, the virus and port scanning and other protection;
- (2), open firewall, IPSec.
- F. Security audits
- Frequency of Audit object tools
- Linux system nmap 1 months
- Nessus 3 months
- Password file John the Ripper 3 months
- Web Business Nikto 1 months
- AppScan 1 months
- Zed Attack Proxy 1 months
- Skipfish 1 months
- Note: Newly installed servers must undergo security audits before they are allowed into the product environment;
- After the new application is released, security audits must be conducted immediately;
- G, monitoring and alerting
- 1, using Nagios for different hardware and different services to monitor, to give the corresponding thresholds, to provide alarm;
- 2, using cacti to generate performance charts for system history data, easy to troubleshoot and prevent;
- Summarize:
- The above specifications are limited to understand the implementation of the system deployment needs to be noted, can be understood as, installation deployment, performance security, fault alarm and other stages of the work content, each need to be specific implementation of the operation, although not strictly according to the document description of an item completed, but must be in each phase of the corresponding treatment to ensure that the business system
Http://www.brentron.com/xitong/linux/6344.html
