Shell script code for linux server security reinforcement

Source: Internet
Author: User

Copy codeThe Code is as follows :#! /Bin/sh
# Desc: setup linux system security
# Author: corzd
# Powered by www.freebsdsystem.org
# Version 0.1.2 written by 2011.05.03
# Account setup

Passwd-l xfs
Passwd-l news
Passwd-l nscd
Passwd-l Signature
Passwd-l vcsa
Passwd-l games
Passwd-l nobody
Passwd-l avahi
Passwd-l haldaemon
Passwd-l gopher
Passwd-l ftp
Passwd-l mailnull
Passwd-l pcap
Passwd-l mail
Passwd-l shutdown
Passwd-l halt
Passwd-l uucp
Passwd-l operator
Passwd-l sync
Passwd-l adm
Passwd-l lp

# Chattr/etc/passwd/etc/shadow
Chattr + I/etc/passwd
Chattr + I/etc/shadow
Chattr + I/etc/group
Chattr + I/etc/gshadow
# Add continue input failure 3, passwd unlock time 5 minite
Sed-I's # auth required pam_env.so \ nauth required incluonerr = fail deny = 3 unlock_time = 300 \ nauth required/lib/security/$ ISA/assumonerr = fail deny = 3 unlock_time = 300 # '/etc/pam. d/system-auth
# System timeout 5 minite auto logout
Echo "TMOUT = 300">/etc/profile

# Will system save history command list to 10
Sed-I "s/HISTSIZE = 1000/HISTSIZE = 10/"/etc/profile

# Enable/etc/profile go!
Source/etc/profile

# Add syncookie enable/etc/sysctl. conf
Echo "net. ipv4.tcp _ syncookies = 1">/etc/sysctl. conf

Sysctl-p # exec sysctl. conf enable
# Optimizer sshd_config

Sed-I "s/# MaxAuthTries 6/MaxAuthTries 6/"/etc/ssh/sshd_config
Sed-I "s/# UseDNS yes/UseDNS no/"/etc/ssh/sshd_config

# Limit chmod important commands
Chmod 700/bin/ping
Chmod 700/usr/bin/finger
Chmod 700/usr/bin/who
Chmod 700/usr/bin/w
Chmod 700/usr/bin/locate
Chmod 700/usr/bin/whereis
Chmod 700/sbin/ifconfig
Chmod 700/usr/bin/pico
Chmod 700/bin/vi
Chmod 700/usr/bin/which
Chmod 700/usr/bin/gcc
Chmod 700/usr/bin/make
Chmod 700/bin/rpm

# History security

Chattr + a/root/. bash_history
Chattr + I/root/. bash_history

# Write important command md5
Cat> list <"EOF "&&
/Bin/ping
/Bin/finger
/Usr/bin/who
/Usr/bin/w
/Usr/bin/locate
/Usr/bin/whereis
/Sbin/ifconfig
/Bin/pico
/Bin/vi
/Usr/bin/vim
/Usr/bin/which
/Usr/bin/gcc
/Usr/bin/make
/Bin/rpm
EOF

For I in 'cat list'
Do
If [! -X $ I]; then
Echo "$ I not found, no md5sum! "
Else
Md5sum $ I>/var/log/'hostname'. log
Fi
Done
Rm-f list

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.