How to harden Linux server operating system

This article mainly shares with you how to harden the Linux server operating system. This help manual is designed to guide system managers or security inspectors to check and harden the security compliance of the Linux operating system. Friends in need can refer to it. I hope it can Help everyone.

1. Account number and password

1.1 Disable or delete useless accounts

Reduce useless accounts in the system and reduce security risks.

Operation steps

• Use the command userdel d6025a37ea8687b5422f951f7288bdc5 to delete unnecessary accounts.

• Use the command passwd -l d6025a37ea8687b5422f951f7288bdc5 to lock unnecessary accounts.

• Use the command passwd -u d6025a37ea8687b5422f951f7288bdc5 to unlock the necessary account.

1.2 Check special accounts

Check whether there is an account with empty password and root authority.

Operation steps

1. Check the empty password and root permission account to confirm whether there is an abnormal account:

• Use the commandawk -F: '($2=="")' /etc/shadow View the empty password account.

• Use the command awk -F: '($3==0)' /etc/passwd View the account with UID zero.

Reinforce the empty password account:

• ##Use the command

  passwd d6025a37ea8687b5422f951f7288bdc5 Set a password for the empty password account.

• Confirm that the account with UID zero is only the root account.

1.3 Add password policy

Enhance the complexity of passwords and reduce the possibility of being guessed.

Operation steps

1. Use the command

   vi /etc/login.defs to modify the configuration file.

• PASS_MAX_DAYS 90 #The maximum number of days for the new user’s password

• PASS_MIN_DAYS 0 # The minimum number of days for the password of a new user

• PASS_WARN_AGE 7 #The number of days to be reminded in advance for the password expiration of a new user

Use the chage command to modify user settings.

For example,
chage -m 0 -M 30 -E 2000-01-01 -W 7 9606d51850bafc13035204ea57ae5d33 means that the maximum number of days for this user's password is set to 30, and the minimum number of days is set to 0, the password will expire on January 1, 2000, and the user will be warned seven days before expiration.

If you enter the wrong password three times in a row, your account will be locked for five minutes. Use the command

vi /etc/pam.d/common-auth to modify the configuration file and add auth required pam_tally.so onerr=fail deny=3 unlock_time=300 in the configuration file.

1.4 Restrict user su

Restrict users who can su to root.

Operation steps

Use the command

vi /etc/pam.d/su to modify the configuration file and add lines in the configuration file. For example, to only allow users in the test group to su to root, add auth required pam_wheel.so group=test.

1.4 Prohibit root users from logging in directly

Restrict root users from logging in directly.

Operation steps

1. Create a normal permission account and configure a password to prevent remote login;

2. Use the command

   vi /etc/ssh/sshd_configModify the configuration file to change the value of PermitRootLogin to no, save it, and then use service sshd restart to restart the service.

2. Service

2.1 Shut down unnecessary services

Close unnecessary services (such as ordinary services and xinetd services) to reduce risks.

Operation steps

Use command

chkconfig --level 863d2a519bdc626891b6f9b3b2d6c588 c7e7ea64493f98a92f8b3b7bcfd14bdf on|off|reset Setting Whether the service is started when the system is powered on at the specified init level.

2.2 SSH service security

Strengthen the security of the SSH service to prevent successful brute force cracking.

Operation steps

Use the command

vim /etc/ssh/sshd_config to edit the configuration file.

• The root account is not allowed to log in to the system directly.

  Set the value of PermitRootLogin to no.
  

• Modify the protocol version used by SSH.

  Set Protocol version to 2.
  

• Modify the number of allowed password errors (default 6).

  Set the value of MaxAuthTries to 3.
  

After the configuration file modification is completed, restart the sshd service to take effect.

3. File system

3.1 Set the umask value

Set the default umask value to enhance security.

Operation steps

Use the command

vi /etc/profile to modify the configuration file and add the line umask 027, which is the new The owner of the created file has read, write and execute permissions, users in the same group have read and execute permissions, and other users have no permissions.

3.2 Set login timeout

Set the connection timeout after system login to enhance security.

Operation steps

Use the command

vi /etc/profile to modify the configuration file. The lines starting with TMOUT= Note, set to TMOUT=180, that is, the timeout period is three minutes.

4. Log

4.1 syslogd log

Enable the logging function and configure logging.

Operation steps

Linux system enables the following types of logs by default:

• System log (default)/var/log/ messages

• cron log (default)/var/log/cron

• ##Security log (default)/var/log/secure

Note: Some systems may use syslog-ng logs. The configuration file is: /etc/syslog-ng/syslog-ng.conf.

You can configure detailed logs according to your needs.

4.2 Record the login and operation logs of all users

Record the login operation logs of all users through script code to prevent no evidence after a security incident occurs.

Operation steps

1. Run [root@xxx /]# vim /etc/profile to open the configuration file.

2. Enter the following content in the configuration file:

history
USER=`whoami`
USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`
if [ "$USER_IP" = "" ]; then
USER_IP=`hostname`
fi
if [ ! -d /var/log/history ]; then
mkdir /var/log/history
chmod 777 /var/log/history
fi
if [ ! -d /var/log/history/${LOGNAME} ]; then
mkdir /var/log/history/${LOGNAME}
chmod 300 /var/log/history/${LOGNAME}
fi
export HISTSIZE=4096
DT=`date +"%Y%m%d_%H:%M:%S"`
export HISTFILE="/var/log/history/${LOGNAME}/${USER}@${USER_IP}_$DT"
chmod 600 /var/log/history/${LOGNAME}/*history* 2>/dev/null

3. Run [root@xxx /]# source /etc/profile to load the configuration to take effect. .

Note: /var/log/history is the storage location of logs and can be customized.

Through the above steps, you can create a new folder named for each user in the /var/log/history directory. Every time a user logs out, a log file with user name, login IP, and time will be generated. Contains all operations performed by this user (except root user).

At the same time, it is recommended that you use the OSS service to collect storage logs.

Related recommendations:

php Detailed explanation of the most complete basic commands to obtain server operating system information

php Get server operating system related information Method

php Determine the type of server operating system_PHP tutorial

The above is the detailed content of How to harden Linux server operating system. For more information, please follow other related articles on the PHP Chinese website!