Linux system security

Simple optimization:

1. Remove unnecessary packages (such as postfix, etc.)
Yum remove-y postfix

Installation Management:
1. Password
1.1 At least 8 characters, case, special character and number combination, change periodically
1.2 Password length can be edited/etc/login.defs modified
2. User
2.1 Static root user remote login
2.2 Edit/etc/hosts.allow or/etc/hosts.deny to limit the source IP that is allowed to log on
Example: ALL:ALL:DENY deny all users access

3. Network
3.1 Masking ICMP responses:
3.1.1 Temporary shield: Echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
3.1.2 Permanent masking:/etc/sysctl.conf add: Net.ipv4.icmp_echo_ignore_all = 1,sysctl-p the configuration takes effect.
3.2 Disable IP spoofing: Edit/etc/host.conf Add Nospoof on
3.3 To prevent SYN attacks:
For several links of Syn attack, the corresponding processing methods are proposed:
Mode 1: Reduce the number of Syn-ack packets (default is 5):
Sysctl-w net.ipv4.tcp_synack_retries=3
Sysctl-w net.ipv4.tcp_syn_retries=3
Method 2: Use SYN Cookie technology:
Sysctl-w Net.ipv4.tcp_syncookies=1//Do not establish three-time handshake
Mode 3: Increase the backlog queue (default is 1024):
Sysctl-w net.ipv4.tcp_max_syn_backlog=2048

4. Delete System Information at login:
rm-rf/etc/issue*

System parameter Optimization
Increase the number of files opened by the system
#ulimit-N 65536

Linux system security