Shell script code for linux server security reinforcement

Copy codeThe Code is as follows :#! /Bin/sh
# Desc: setup linux system security
# Author: corzd
# Powered by www.freebsdsystem.org
# Version 0.1.2 written by 2011.05.03
# Account setup

Passwd-l xfs
Passwd-l news
Passwd-l nscd
Passwd-l Signature
Passwd-l vcsa
Passwd-l games
Passwd-l nobody
Passwd-l avahi
Passwd-l haldaemon
Passwd-l gopher
Passwd-l ftp
Passwd-l mailnull
Passwd-l pcap
Passwd-l mail
Passwd-l shutdown
Passwd-l halt
Passwd-l uucp
Passwd-l operator
Passwd-l sync
Passwd-l adm
Passwd-l lp

# Chattr/etc/passwd/etc/shadow
Chattr + I/etc/passwd
Chattr + I/etc/shadow
Chattr + I/etc/group
Chattr + I/etc/gshadow
# Add continue input failure 3, passwd unlock time 5 minite
Sed-I's # auth required pam_env.so \ nauth required incluonerr = fail deny = 3 unlock_time = 300 \ nauth required/lib/security/$ ISA/assumonerr = fail deny = 3 unlock_time = 300 # '/etc/pam. d/system-auth
# System timeout 5 minite auto logout
Echo "TMOUT = 300">/etc/profile

# Will system save history command list to 10
Sed-I "s/HISTSIZE = 1000/HISTSIZE = 10/"/etc/profile

# Enable/etc/profile go!
Source/etc/profile

# Add syncookie enable/etc/sysctl. conf
Echo "net. ipv4.tcp _ syncookies = 1">/etc/sysctl. conf

Sysctl-p # exec sysctl. conf enable
# Optimizer sshd_config

Sed-I "s/# MaxAuthTries 6/MaxAuthTries 6/"/etc/ssh/sshd_config
Sed-I "s/# UseDNS yes/UseDNS no/"/etc/ssh/sshd_config

# Limit chmod important commands
Chmod 700/bin/ping
Chmod 700/usr/bin/finger
Chmod 700/usr/bin/who
Chmod 700/usr/bin/w
Chmod 700/usr/bin/locate
Chmod 700/usr/bin/whereis
Chmod 700/sbin/ifconfig
Chmod 700/usr/bin/pico
Chmod 700/bin/vi
Chmod 700/usr/bin/which
Chmod 700/usr/bin/gcc
Chmod 700/usr/bin/make
Chmod 700/bin/rpm

# History security

Chattr + a/root/. bash_history
Chattr + I/root/. bash_history

# Write important command md5
Cat> list <"EOF "&&
/Bin/ping
/Bin/finger
/Usr/bin/who
/Usr/bin/w
/Usr/bin/locate
/Usr/bin/whereis
/Sbin/ifconfig
/Bin/pico
/Bin/vi
/Usr/bin/vim
/Usr/bin/which
/Usr/bin/gcc
/Usr/bin/make
/Bin/rpm
EOF

For I in 'cat list'
Do
If [! -X $ I]; then
Echo "$ I not found, no md5sum! "
Else
Md5sum $ I>/var/log/'hostname'. log
Fi
Done
Rm-f list