Secure Operation Koriyuki: Linux SYSTEM account and login security

Iii. deletion of System login welcome information

Some of the system's welcome information or version information, although it can bring some convenience to the System Manager, but this information can sometimes be exploited by hackers, as an accomplice to attack the server, in order to ensure the security of the system, you can modify or delete some system files, there are 4 files that need to be modified or deleted, respectively/etc/ Issue,/etc/issue.net,/etc/redhat-release and/ETC/MOTD.

Both the/etc/issue and/etc/issue.net files record the name and version number of the operating system, and when the user logs on to the system via a local terminal or a local virtual console, the contents of the/etc/issue file are displayed when the user Telnet to the system via SSH or Telnet. , the contents of the/etc/issue.net file are displayed after login. By default, the content of the/etc/issue.net file is not displayed after SSH login, to display this information can modify the/etc/ssh/sshd_config file, add the following content in this file:

1. Banner/etc/issue.net

In fact, these login tips are obviously leaking system information, for security purposes, it is recommended to delete or modify the contents of this file.

The/etc/redhat-release file also records the name and version number of the operating system, and for security reasons, you can delete the contents of this file.

The/ETC/MOTD file is a system announcement information. Each time the user logs in, the contents of the/ETC/MOTD file are displayed in the user's terminal. Through this file system administrator can release some software or hardware upgrades, system maintenance and other notification information, but this file is the most useful, can be issued some warning message, when the hacker logged into the system, will find these warning messages, and then have some deterrent effect. Read a foreign report, the hacker hacked a server, and this server gave a welcome login information, so the court does not make any decision.

Post Address: http://ixdba.blog.51cto.com/2895551/1552907

Http://www.holdjava.com/operationlinux/167084.htm

Secure Operation Koriyuki: Linux SYSTEM account and login security (RPM)