Introduction to Linux system hardening methods

This article mainly introduces the relevant information summarized by the three methods of strengthening the Linux system. Through this article, I hope you can master this part of the content. Friends in need can refer to

Strengthening the Linux system Summary of three methods

Linux command line history reinforcement

Record the commands executed by the user on the command line by configuring system environment variables.

vim /etc/profile.d/system_monitor.sh
# 添加下面代码
export TMOUT=600
readonly TMOUT
#history
USER_IP=`who -u am i 2>/dev/null | awk '{print $NF}' | sed -e 's/[()]//g'`
HISTDIR=/usr/share/.history
if [ -z $USER_IP ]; then
USER_IP=`hostname`
fi
if [ ! -d $HISTDIR ]; then
mkdir -p $HISTDIR
chmod 777 $HISTDIR
fi
if [ ! -d $HISTDIR/${LOGNAME} ]; then
mkdir -p $HISTDIR/${LOGNAME}
chmod 300 $HISTDIR/${LOGNAME}
fi
export HISTSIZE=4000
DT=`date +%Y%m%d_%H%M%S`
export HISTFILE="$HISTDIR/${LOGNAME}/${USER_IP}.history.$DT"
export HISTTIMEFORMAT="[%Y.%m.%d %H:%M:%S]"
chmod 600 $HISTFILE/${LOGNAME}/*.history* 2>/dev/null

Reload environment variables

source /etc/profile.d/system_monitor.sh

Effect: Each account’s login IP and running commands will be The records in this directory are as follows:

[root@localhost ~]# ll /usr/share/.history/root/
total 8
-rw-------. 1 root root 236 Apr 23 21:49 1.180.212.137.history.20170423_214918
-rw-------. 1 root root 564 Apr 23 21:54 1.180.212.137.history.20170423_214957

crond calls the black and white list

Cron has its own built-in feature, which allows Define who can and cannot run tasks. This is controlled through two files /etc/cron.allow and /etc/cron.deny. To lock users who use Cron, you can simply write their names in corn.deny, and to allow users to run cron, add their names to cron.allow. If you want to ban all users, only allow root user. As follows:

# echo 'root' >> /etc/cron.allow
# echo 'ALL' >> /etc/cron.deny

ssh service prohibits root login

1. Do not use the default port, modify the method;

Port 3714

2. Do not use the first version of the protocol;

Protocol 2

3. Limit the users who can log in;

AllowUsers user1 user2 #仅允许user1和user2用户登录

4. Set the idle session timeout;

5. Use the firewall to set the ssh remote access policy; only allow access from hosts in the specified network;

6. Only listen on the specified IP address;

ListenAddress

7. When based on password authentication, use a strong password policy;

# 使用mkpasswd命令生成密码；
mkpasswd -l 15 -s 3 -d 3 -C 3

8. Finally, use key-based authentication

9. Prohibit the use of empty passwords, enabled by default;

PermitEmptyPasswords no：是否允许空密码登录；

10. Prohibit management Log in directly;

PermitRootLogin yes # 是否允许管理员直接登录；安全起见，建议为no；

11. Limit ssh access frequency and concurrent online;

12.Do log analysis;

The above is the detailed content of Introduction to Linux system hardening methods. For more information, please follow other related articles on the PHP Chinese website!