linux安裝後的基本調優和安全設定

標籤：security   system   linux安裝   instead   controls   

關閉Selinux

1. 方法一：用vi /etc/selinux/config修改

[[email protected] ~]# vi /etc/selinux/config 

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=disable

# SELINUXTYPE= can take one of these two values:

#     targeted - Targeted processes are protected,

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted 

2.方法二：

sed -i s:替換並且修改檔案

[[email protected] ~]# sed -i ‘s/SELINUX=enforcing/SELINUX=disable/‘ /etc/selinux/config

查看一下配置是否成功？

[[email protected] ~]# grep SELINUX=disable /etc/selinux/config 

SELINUX=disable

因為修改了配置需要重啟才生效，工作中不可能經常重啟系統，我們也將臨時生效修改下！

[[email protected] ~]# setenforce 0

[[email protected] ~]# getenforce 

Permissive

修改系統啟動模式：

runlevel: 查看運行層級

init: 切換運行層級

[[email protected] ~]# runlevel 

N 3

不同模式切換：

init 0 重啟

init 3 命令列模式

init 5 圖形模式

用vi永久修改預設運行層級：

[[email protected] ~]# vi /etc/inittab 

# Default runlevel. The runlevels used are:

#   0 - halt (Do NOT set initdefault to this) 關機

#   1 - Single user mode 單一使用者模式

#   2 - Multiuser, without NFS (The same as 3, if you do not have networking) 多使用者模式

#   3 - Full multiuser mode 命令列模式

#   4 - unused 不常用

#   5 - X11 圖形模式

#   6 - reboot (Do NOT set initdefault to this) 重啟

id:3:initdefault: 這裡預設是第3命令列模式

精簡啟動程式：

前期需要啟動的四個基本服務：crond network rsyslog ssh

查看層級3啟動的服務名稱：

[[email protected] ~]# LANG=en

[[email protected] ~]# chkconfig --list|grep "3:on"

NetworkManager 0:off1:off2:on3:on4:on5:on6:off

abrt-ccpp      0:off1:off2:off3:on4:off5:on6:off

abrtd          0:off1:off2:off3:on4:off5:on6:off

acpid          0:off1:off2:on3:on4:on5:on6:off

atd            0:off1:off2:off3:on4:on5:on6:off

auditd         0:off1:off2:on3:on4:on5:on6:off

autofs         0:off1:off2:off3:on4:on5:on6:off

blk-availability0:off1:on2:on3:on4:on5:on6:off

bluetooth      0:off1:off2:off3:on4:on5:on6:off

certmonger     0:off1:off2:off3:on4:on5:on6:off

cpuspeed       0:off1:on2:on3:on4:on5:on6:off

crond          0:off1:off2:on3:on4:on5:on6:off

cups           0:off1:off2:on3:on4:on5:on6:off

haldaemon      0:off1:off2:off3:on4:on5:on6:off

寫個指令碼一鍵完成處理：

[[email protected] ~]# vim serviceoff.sh

#/bin/bash

LANG=en

for liangenyu in `chkconfig --list|grep 3:on|awk ‘{print $1}‘`;

do chkconfig --level 3 $liangenyu off;

done

for liangenyu in crond network rsyslog sshd;

do chkconfig --level 3 $liangenyu on;

查看已成功：

[[email protected] ~]# chkconfig --list|grep "3:on"

crond          0:off1:off2:on3:on4:on5:on6:off

network        0:off1:off2:on3:on4:on5:on6:off

rsyslog        0:off1:off2:on3:on4:on5:on6:off

sshd           0:off1:off2:on3:on4:on5:on6:off

指令碼二：

[[email protected] ~]# vim serviceon.sh 

#!/bin/bash

for liangenyu in `chkconfig --list|grep "3:on"|awk ‘{print $1}‘|grep -vE "crond|network|sshd|rsyslog"`;

do chkconfig $liangenyu off;

done

執行指令碼，並且查看已成功！

[[email protected] ~]# ./serviceon.sh 

[[email protected] ~]# chkconfig --list|grep "3:on"

crond          0:off1:off2:on3:on4:on5:on6:off

network        0:off1:off2:on3:on4:on5:on6:off

rsyslog        0:off1:off2:on3:on4:on5:on6:off

sshd           0:off1:off2:on3:on4:on5:on6:off

更改SSH服務遠程登入配置：

linux遠程預設連接埠：22

預設超級使用者:root

[[email protected] ~]# vim /etc/ssh//ssh_config 

#       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options change a

# default value.

Port 52113 修改連接埠為52113

#Port 22   提示預設連接埠是22

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

# To disable tunneled clear text passwords, change to no here!

#PasswordAuthentication yes

PermitEmptyPasswords no 改為不允許空密碼登入

PasswordAuthentication yes

#LoginGraceTime 2m

PermitRootLogin no  ssh遠程不能用root登入

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

#X11Forwarding no

X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PrintMotd yes

#PrintLastLog yes

#TCPKeepAlive yes

#UseLogin no

#UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#ShowPatchLevel no

UseDNS no  DNS改為no

#PidFile /var/run/sshd.pid

#MaxStartups 10

#PermitTunnel no

#ChrootDirectory none

重啟sshd服務

/etc/init.d/sshd restart==service sshd restart

[[email protected] ssh]# service sshd restart

停止 sshd：                                                [確定]

正在啟動 sshd：                                            [確定]

本文出自 “linux營運分享” 部落格，請務必保留此出處http://liangey.blog.51cto.com/9097868/1571432

linux安裝後的基本調優和安全設定