CentOS操作系統安裝完成之後，我們需要對現有的系統進行一些簡單的設置，才能使用操作系統更加安全可靠，下面我們來向大家介紹一些最基本的安全防護策略，進一步提升操作系統的安全性。
1、修改客戶密碼的長度
密碼的安全是操作系統的第一步，所以我們必須要求有一個強壯的密碼，可以通過修改/etc/login.defs文件來實現我們要求的密碼長度。
/etc/login.defs原始內容如下：
[root@localhost ~]# vi /etc/login.defs
#
# Please note that the parameters in this configuration file control the
# behavior of the tools from the shadow-utils component. None of these
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
# passwd command) should therefore be configured elsewhere. Refer to
# /etc/pam.d/system-auth for more information.
#
# *REQUIRED*
# Directory where mailboxes reside, _or_ name of file, relative to the
# home directory. If you _do_ define both, MAIL_DIR takes precedence.
# QMAIL_DIR is for Qmail
#
#QMAIL_DIR Maildir
MAIL_DIR /var/spool/mail
#MAIL_FILE .mail
# Password aging controls:
#
# PASS_MAX_DAYS Maximum number of days a password may be used.
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
# PASS_MIN_LEN Minimum acceptable password length.
# PASS_WARN_AGE Number of days warning given before a password expires.
#
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_MIN_LEN 5
PASS_WARN_AGE 7
#
# Min/max values for automatic uid selection in useradd
#
UID_MIN 500
UID_MAX 60000
#
# Min/max values for automatic gid selection in groupadd
#
GID_MIN 500
GID_MAX 60000
#
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#
#USERDEL_CMD /usr/sbin/userdel_local
#
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
#
CREATE_HOME yes
# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK 077
# This enables userdel to remove user groups if no members exist.
#
USERGROUPS_ENAB yes
# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512
# Password aging controls:
#
# PASS_MAX_DAYS Maximum number of days a password may be used.
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
# PASS_MIN_LEN Minimum acceptable password length.
# PASS_WARN_AGE Number of days warning given before a password expires.
#
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_MIN_LEN 5
PASS_WARN_AGE 7
#
# Min/max values for automatic uid selection in useradd
#
UID_MIN 500
UID_MAX 60000
#
# Min/max values for automatic gid selection in groupadd
#
GID_MIN 500
GID_MAX 60000
#
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#
#USERDEL_CMD /usr/sbin/userdel_local
#
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
#
CREATE_HOME yes
# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK 077
# This enables userdel to remove user groups if no members exist.
#
USERGROUPS_ENAB yes
# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512
將密碼最小的長度調整爲8
PASS_MIN_LEN 8
2、註釋掉操作系統不需要使用的用戶和用戶組
Centos 6.4操作系統安裝好之後，我們需要針對一些不需要使用的用戶和用戶組來進行設置，減少可能發生的安全問題。
/etc/passwd原始內容如下：
[root@localhost ~]# vi /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
pulse:x:498:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
saslauth:x:497:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin
註釋掉以下用戶
#userdel adm:x:3:4:adm:/var/adm:/sbin/nologin
#userdel lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
#userdel sync:x:5:0:sync:/sbin:/bin/sync
#userdel shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
#userdel halt:x:7:0:halt:/sbin:/sbin/halt
#userdel uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
#userdel operator:x:11:0:operator:/root:/sbin/nologin
#userdel games:x:12:100:games:/usr/games:/sbin/nologin
#userdel gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
#userdel ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
/etc/group原始內容如下：
[root@localhost ~]# vi /etc/group
root:x:0:
bin:x:1:bin,daemon
daemon:x:2:bin,daemon
sys:x:3:bin,adm
adm:x:4:adm,daemon
tty:x:5:
disk:x:6:
lp:x:7:daemon
mem:x:8:
kmem:x:9:
wheel:x:10:
mail:x:12:mail,postfix
uucp:x:14:
man:x:15:
games:x:20:
gopher:x:30:
video:x:39:
dip:x:40:
ftp:x:50:
lock:x:54:
audio:x:63:
nobody:x:99:
users:x:100:
dbus:x:81:
usbmuxd:x:113:
utmp:x:22:
utempter:x:35:
desktop_admin_r:x:499:
desktop_user_r:x:498:
floppy:x:19:
vcsa:x:69:
rpc:x:32:
rtkit:x:497:
avahi-autoipd:x:170:
cdrom:x:11:
tape:x:33:
dialout:x:18:
wbpriv:x:88:
pulse:x:496:
pulse-access:x:495:
fuse:x:494:
haldaemon:x:68:haldaemon
ntp:x:38:
apache:x:48:
saslauth:x:76:
postdrop:x:90:
postfix:x:89:
abrt:x:173:
rpcuser:x:29:
nfsnobody:x:65534:
gdm:x:42:
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
sshd:x:74:
tcpdump:x:72:
slocate:x:21:
ldap:x:55:
註釋掉以下用戶組
#groupdel adm:x:4:adm,daemon
#groupdel lp:x:7:daemon
#groupdel uucp:x:14:
#groupdel games:x:20:
#groupdel dip:x:40:
3、檢查系統的安全登陸文件
通過檢查/var/log/secure該文件的信息，我們可以瞭解到有哪些用戶及IP地址進行登陸。
[root@localhost ~]# more /var/log/secure grep refused
::::::::::::::
/var/log/secure
::::::::::::::
Jan 16 22:33:29 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed
esktop/ConsoleKit/Session1 (system bus name :1.23, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo
cale zh_CN.UTF-8) (disconnected from bus)
Jan 16 22:33:32 localhost sshd[1728]: Received signal 15; terminating.
Jan 16 22:33:32 localhost sshd[2460]: Exiting on signal 15
Jan 16 22:33:32 localhost sshd[2460]: pam_unix(sshd:session): session closed for user root
Jan 17 15:54:27 localhost sshd[1737]: Server listening on 0.0.0.0 port 22.
Jan 17 15:54:27 localhost sshd[1737]: Server listening on :: port 22.
Jan 17 15:54:35 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes
ktop/ConsoleKit/Session1 (system bus name :1.24 [/usr/libexec/polkit-gnome-authentication-agent-1], object p
ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 17 15:54:50 localhost sshd[2461]: Accepted password for root from 192.168.1.3 port 55918 ssh2
Jan 17 15:54:50 localhost sshd[2461]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 17 16:01:55 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed
esktop/ConsoleKit/Session1 (system bus name :1.24, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo
cale zh_CN.UTF-8) (disconnected from bus)
Jan 17 16:01:58 localhost sshd[1737]: Received signal 15; terminating.
Jan 17 16:01:58 localhost sshd[2461]: Exiting on signal 15
Jan 17 16:01:58 localhost sshd[2461]: pam_unix(sshd:session): session closed for user root
Jan 29 10:49:52 localhost sshd[1728]: Server listening on 0.0.0.0 port 22.
Jan 29 10:49:52 localhost sshd[1728]: Server listening on :: port 22.
Jan 29 10:49:57 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes
ktop/ConsoleKit/Session1 (system bus name :1.23 [/usr/libexec/polkit-gnome-authentication-agent-1], object p
ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Jan 29 10:50:02 localhost sshd[2452]: Accepted password for root from 192.168.1.4 port 53853 ssh2
Jan 29 10:50:02 localhost sshd[2452]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): check pass; user unknown
Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0
tty=ftp ruser=fsdaf rhost=192.168.1.4
Jan 29 10:51:43 localhost vsftpd[2482]: pam_succeed_if(vsftpd:auth): error retrieving information about user
fsdaf
Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): check pass; user unknown
Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0
tty=ftp ruser=ithov rhost=192.168.1.4
Jan 29 10:51:58 localhost vsftpd[2484]: pam_succeed_if(vsftpd:auth): error retrieving information about user
ithov
Jan 29 10:54:35 localhost sshd[2452]: pam_unix(sshd:session): session closed for user root
Jan 29 10:54:36 localhost sshd[2493]: Accepted password for root from 192.168.1.4 port 54693 ssh2
Jan 29 10:54:36 localhost sshd[2493]: pam_unix(sshd:session): session opened for user root by (uid=0)
grep: 沒有那個文件或目錄
refused: 沒有那個文件或目錄
4、使用chattr命令給下列文件加上不可更改的屬性
有效防止非法用戶進行文件的修改。
[root@localhost ~]# chattr +i /etc/passwd
[root@localhost ~]# chattr +i /etc/shadow
[root@localhost ~]# chattr +i /etc/group
[root@localhost ~]# chattr +i /etc/gshadow
5、更改SSH端口加強登陸安全
CentOS 6.4安裝好之後，默認使用22端口進行連接，就像Windows Server 2008操作系統一樣使用3389，對於一般的用戶很容易就猜測到這個端口是提供什麼服務的，所以建議使用10000以上的端口，這樣別人在掃描的時候，能掃描到端口的機率也會降低一些。
不要允許使用低版本的SSH協議進行連接
[root@localhost ~]# vi /etc/ssh/sshd_config
將#protocol 2,1改爲
protocol 2
(注：centos 6下已默認取消了低版本協議，默認值爲protocol 2)
將PORT改爲1000以上端口
[root@localhost ~]# vi /etc/ssh/sshd_config
Port 10000
開啓防火牆端口，並重新啓動防火牆生效
[root@localhost ~]# vi /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT
[root@localhost ~]# service iptables restart
iptables：清除防火牆規則：[確定]
iptables：將鏈設置爲政策 ACCEPT：filter [確定]
iptables：正在卸載模塊：[確定]
iptables：應用防火牆規則：[確定]
iptables：載入額外模塊：ip_nat_ftp [確定]
6、防止IP欺騙
編輯/etc/host.conf文件並增加如下幾行來防止IP欺騙***。
order bind，hosts
multi off
nospoof on