基線安全與linux基線加固方法

1.基線

即安全基線配置，諸如操作系統、中間件和數據庫的一個整體配置，這個版本中各項配置都符合安全方面的標準。比如在系統安裝後需要按安全基線標準，將新機器中各項配置調整到一個安全、高效、合理的數值。

2.基線掃描

使用自動化工具、抓取系統和服務的配置項。將抓取到的實際值和標準值進行對比，將不符合的項顯示出來，最終以報告的形式體現出掃描結果

有的工具將配置採集和配置對比分開，通過自動化腳本採集配置後再通過特別的軟件轉換爲適合人類閱讀的文檔

3.自動化腳本

.sh文件爲執行文件。而.pl文件則包含着檢查命令。

下面給出兩個文件的截圖

4.Linux基線加固

下面對重要程度排名靠前的項進行腳本加固

基線加固腳本如下：

（*所有操作均在拷貝後執行）

echo ---------------開始--------------------
echo ---------------aboutkey----------------
cd /etc
if [ -f login.defs ];then
cp /etc/login.defs  /home/test1
MINDAY=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MIN_DAYS|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_DAYS.*/PASS_MIN_DAYS 6/' /home/test1/login.defs
WARNAGE=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_WARN_AGE|awk '{print $1}'`
sed -i ''$WARNAGE's/.*PASS_WARN.*/PASS_WARN_AGE 30/' /home/test1/login.defs
MAXDAY=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MAX_DAYS|awk '{print $1}'`
sed -i ''$MAXDAY's/.*PASS_MAX.*/PASS_MAX_DAYS 90/' /home/test1/login.defs
MINLEN=`cat -n /home/test1/login.defs | grep -v ".*#.*"| grep PASS_MIN_LEN|awk '{print $1}'`
sed -i ''$MINDAY's/.*PASS_MIN_LEN.*/PASS_MIN_ LEN 6/' /home/test1/login.defs
fi
echo --------------------ok---------------------------
echo -------------------stop the del------------------------
cd /etc/init
if [ -f control-alt-delete.conf ];then
cp /etc/init/control-alt-delete.conf /home/test1
#delete=`grep -n "/sbin/shutdown -r now" /home/test1/control-alt-delete.conf | cut -d ":" -f 1`
#sed -i ''$delete' r s/^/#/' /home/test1/control-alt-delete.conf
#cp /etc/init/control-alt-delete.conf /home/test1
#num1=`grep -n "/sbin/shutdown" /home/test1/control-alt-delete.conf | cut -d "" -f 1`
#sed -i ''$num' r s/^/#/' /home/test1/control-alt-delete.conf
#a=`cat -n /home/test1/control-alt-delete.conf|grep -v "#" | grep "/sbin/shutdown" | awk '{print $1}'`
#text=`sed -n "$a"p /home/test1/control-alt-delete.conf`
#sed -i ''$a'c # '$text'' /home/test1/control-alt-delete.conf
a=`cat -n /home/test1/control-alt-delete.conf|grep -v "#" | grep /sbin/shutdown | awk '{print $1}'`
	if [ -z $a ];then
	echo ok
	else
	sed -i ''$a' s/^/#/' /home/test1/control-alt-delete.conf
	fi
fi
echo ---------------------ok---------------------------------------
echo ------------------------grub and lilo key------------------------
grub="/home/test1/menu.lst"
if [ ! -x "$grub" ];then
touch "$grub"
echo password=123456 >> "$grub"
else 
echo password=123456 >> "$grub"
fi
lilo="/home/test1/lilo.conf"
if [ ! -x "$lilo" ];then
touch "$lilo"
echo password=123456 >> "$lilo"
else
echo password=123456 >> "$lilo"
fi
echo ---------------------ok--------------------------------------
echo ----------------------the history of mouthpasswd------------------
cd /etc
if [ -f profile ];then
cp /etc/profile /home/test1
#num=`sed -n /home/test1/profile | grep HISTFILESIZE | awk '{print $1}'`
 #/home/test1/profile | sed $num'c HISTFILESIZE=5'
echo "HISTFILESIZE=5" >> /home/test1/profile
echo "ulimit -S -c unlimited" >> /home/test1/profile
fi
echo -------------------------ok--------------------- 
echo ------------------------issue-----------------
#issu="/etc/issue.net"
cd /etc
if [ -f issue.net ];then
cp  issue.net  /home/test1/issue.net.bak
echo ok
fi
echo ok
if [ -f issue ];then
cp issue /home/test1/issue.bak
echo ok
fi
echo -----------------------allow/deny ip-------------------
cd /etc
if [ -f hosts.allow ];then
cp /etc/hosts.allow /home/test1
echo "all:172.18.12.:all" >> /home/test1/hosts.allow
echo "sshd:172.18.12.:all" >> /home/test1/hosts.allow
fi
cd /etc
if [ -f hosts.deny ];then
cp /etc/hosts.deny /home/test1
echo "all:all" >> /home/test1/hosts.deny
fi
echo -----------------ok------------------------
#/etc/init.d/xinetd restart
echo -----------------------------core dump-------------------
cd /etc/security
if [ -f limits.conf ];then 
cp /etc/security/limits.conf  /home/test1
echo "*soft core 0" >> /home/test1/limits.conf
echo "*hard core 0" >> /home/test1/limits.conf
fi
echo --------------ok-------------------------
echo ----------------------------passwdrepeat---------------------
cd /etc/pam.d
if [ -f system-auth ];then
cp /etc/pam.d/system-auth  /home/test1
#num=`grep -n "md5" /home/test1/system-auth | cut -d ":" -f 1`
#sed -i ''$num'	r s/$/ remember=5' /home/test1/system-auth
kk=`cat -n /home/test1/system-auth | grep -v ".*#.*"| grep md5|awk '{print $1}'`
echo $kk
version="password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=500"
sed -i ""$kk"c $version" /home/test1/system-auth
letter=`cat -n /home/test1/system-auth |grep password | grep requisite | awk '{print $1}'`
sed -i ''$letter's/pam_cracklib.so/& ucredit=-1 lcredit=-1 dcredit=-1 /' /etc/pam.d/system-auth
fi
echo -----------------ok--------------------
echo --------------------超出退出--------------
cd /etc
if [ -f profile ];then
cp /etc/profile /home/test1
echo "export TMOUT=600" >> /home/test1/profile
fi
echo ------------------ok-------------------
echo ------------------權限-------------------
chmod 644 /etc/passwd
chmod 644 /etc/group
chmod 400 /etc/shadow
#chmod 600 /etc/xinetd.conf
chmod 644 /etc/services
chmod 600 /etc/security
chmod 600 /etc/grub.conf
chmod 600 /boot/grub/grub.conf
chmod 600 /etc/lilo.conf

echo ------------------unmask--------------------
cp /etc/csh.cshrc /home/test1
cp /etc/csh.login /home/test1
cp /etc/bashrc /home/test1
cp /etc/profile /home/test1
sed -i '11 s/.*umask.*/umask 077/' /home/test1/csh.cshrc

sed -i '58 s/.*umask.*/umask 077/' /home/test1/csh.login

sed -i '66 s/.*UMASK.*/UMASK 077/' /home/test1/bashrc

sed -i '62s/.*umask.*/umask 077/' /home/test1/profile
echo --------------------before login banner-------------------
cd /etc
if [ -f ssh_banner ];then
touch /etc/ssh_banner
chown bin:bin /etc/ssh_banner
chmod 644 /etc/ssh_banner
echo "Authorized only.All activity will be monitored and reported" > /etc/ssh_banner
fi
echo -----------------------ok----------------------------
echo -------------------stop root ssh login------------------
cp /etc/pam.d/login /home/test1
echo "auth   required   pam_securetty.so" >> /home/test1/login
cp /etc/ssh/sshd_config /home/test1
echo "Banner /etc/ssh_banner" >> /home/test1/sshd_config
echo "PermitRootLogin no" >> /home/test1/sshd_config
service sshd restart
echo -------------------------ok-------------------
echo --------------------openssh----------------------------
openssh=`cat -n /home/test1/sshd_config | grep -v ".*#.*"| grep Protocol |awk '{print $1}'`
sed -i ''$openssh's/.*Protocol.*/Protocol 2/' /home/test1/sshd_config
echo -------------ok---------------------------