Skip to content

Commit ac39873

Browse files
ppabcppabc
committed
update
1 parent d15ec43 commit ac39873

File tree

3 files changed

+104
-104
lines changed

3 files changed

+104
-104
lines changed

‎linux-init-script/check_safe.sh

+96-96
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,97 @@
1-
#!/bin/sh
2-
3-
passwd -l xfs
4-
passwd -l news
5-
passwd -l nscd
6-
passwd -l dbus
7-
passwd -l vcsa
8-
passwd -l games
9-
passwd -l nobody
10-
passwd -l avahi
11-
passwd -l haldaemon
12-
passwd -l gopher
13-
passwd -l ftp
14-
passwd -l mailnull
15-
passwd -l pcap
16-
passwd -l mail
17-
passwd -l shutdown
18-
passwd -l halt
19-
passwd -l uucp
20-
passwd -l operator
21-
passwd -l sync
22-
passwd -l adm
23-
passwd -l lp
24-
25-
# chattr /etc/passwd /etc/shadow
26-
chattr +i /etc/passwd
27-
chattr +i /etc/shadow
28-
chattr +i /etc/group
29-
chattr +i /etc/gshadow
30-
31-
# add continue input failure 3 ,passwd unlock time 5 minite
32-
sed -i 's#auth required pam_env.so#auth required pam_env.sonauth required pam_tally.so onerr=fail deny=3 unlock_time=300nauth required /lib/security/$ISA/pam_tally.so onerr=fail deny=3 unlock_time=300#' /etc/pam.d/system-auth
33-
# system timeout 5 minite auto logout
34-
echo "TMOUT=300" >>/etc/profile
35-
36-
# will system save history command list to 10
37-
sed -i "s/HISTSIZE=1000/HISTSIZE=10/" /etc/profile
38-
39-
# enable /etc/profile go!
40-
source /etc/profile
41-
42-
# add syncookie enable /etc/sysctl.conf
43-
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
44-
45-
sysctl -p # exec sysctl.conf enable
46-
# optimizer sshd_config
47-
48-
sed -i "s/#MaxAuthTries 6/MaxAuthTries 6/" /etc/ssh/sshd_config
49-
sed -i "s/#UseDNS yes/UseDNS no/" /etc/ssh/sshd_config
50-
51-
# limit chmod important commands
52-
chmod 700 /bin/ping
53-
chmod 700 /usr/bin/finger
54-
chmod 700 /usr/bin/who
55-
chmod 700 /usr/bin/w
56-
chmod 700 /usr/bin/locate
57-
chmod 700 /usr/bin/whereis
58-
chmod 700 /sbin/ifconfig
59-
chmod 700 /usr/bin/pico
60-
chmod 700 /bin/vi
61-
chmod 700 /usr/bin/which
62-
chmod 700 /usr/bin/gcc
63-
chmod 700 /usr/bin/make
64-
chmod 700 /bin/rpm
65-
66-
# history security
67-
68-
chattr +a /root/.bash_history
69-
chattr +i /root/.bash_history
70-
71-
# write important command md5
72-
cat > list << "EOF" &&
73-
/bin/ping
74-
/bin/finger
75-
/usr/bin/who
76-
/usr/bin/w
77-
/usr/bin/locate
78-
/usr/bin/whereis
79-
/sbin/ifconfig
80-
/bin/pico
81-
/bin/vi
82-
/usr/bin/vim
83-
/usr/bin/which
84-
/usr/bin/gcc
85-
/usr/bin/make
86-
/bin/rpm
87-
EOF
88-
89-
for i in `cat list`
90-
do
91-
if [ ! -x $i ];then
92-
echo "$i not found,no md5sum!"
93-
else
94-
md5sum $i >> /var/log/`hostname`.log
95-
fi
96-
done
1+
#!/bin/sh
2+
3+
passwd -l xfs
4+
passwd -l news
5+
passwd -l nscd
6+
passwd -l dbus
7+
passwd -l vcsa
8+
passwd -l games
9+
passwd -l nobody
10+
passwd -l avahi
11+
passwd -l haldaemon
12+
passwd -l gopher
13+
passwd -l ftp
14+
passwd -l mailnull
15+
passwd -l pcap
16+
passwd -l mail
17+
passwd -l shutdown
18+
passwd -l halt
19+
passwd -l uucp
20+
passwd -l operator
21+
passwd -l sync
22+
passwd -l adm
23+
passwd -l lp
24+
25+
# chattr /etc/passwd /etc/shadow
26+
chattr +i /etc/passwd
27+
chattr +i /etc/shadow
28+
chattr +i /etc/group
29+
chattr +i /etc/gshadow
30+
31+
# add continue input failure 3 ,passwd unlock time 5 minite
32+
sed -i 's#auth required pam_env.so#auth required pam_env.sonauth required pam_tally.so onerr=fail deny=3 unlock_time=300nauth required /lib/security/$ISA/pam_tally.so onerr=fail deny=3 unlock_time=300#' /etc/pam.d/system-auth
33+
# system timeout 5 minite auto logout
34+
echo "TMOUT=300" >>/etc/profile
35+
36+
# will system save history command list to 10
37+
sed -i "s/HISTSIZE=1000/HISTSIZE=10/" /etc/profile
38+
39+
# enable /etc/profile go!
40+
source /etc/profile
41+
42+
# add syncookie enable /etc/sysctl.conf
43+
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
44+
45+
sysctl -p # exec sysctl.conf enable
46+
# optimizer sshd_config
47+
48+
sed -i "s/#MaxAuthTries 6/MaxAuthTries 6/" /etc/ssh/sshd_config
49+
sed -i "s/#UseDNS yes/UseDNS no/" /etc/ssh/sshd_config
50+
51+
# limit chmod important commands
52+
chmod 700 /bin/ping
53+
chmod 700 /usr/bin/finger
54+
chmod 700 /usr/bin/who
55+
chmod 700 /usr/bin/w
56+
chmod 700 /usr/bin/locate
57+
chmod 700 /usr/bin/whereis
58+
chmod 700 /sbin/ifconfig
59+
chmod 700 /usr/bin/pico
60+
chmod 700 /bin/vi
61+
chmod 700 /usr/bin/which
62+
chmod 700 /usr/bin/gcc
63+
chmod 700 /usr/bin/make
64+
chmod 700 /bin/rpm
65+
66+
# history security
67+
68+
chattr +a /root/.bash_history
69+
chattr +i /root/.bash_history
70+
71+
# write important command md5
72+
cat > list << "EOF" &&
73+
/bin/ping
74+
/bin/finger
75+
/usr/bin/who
76+
/usr/bin/w
77+
/usr/bin/locate
78+
/usr/bin/whereis
79+
/sbin/ifconfig
80+
/bin/pico
81+
/bin/vi
82+
/usr/bin/vim
83+
/usr/bin/which
84+
/usr/bin/gcc
85+
/usr/bin/make
86+
/bin/rpm
87+
EOF
88+
89+
for i in `cat list`
90+
do
91+
if [ ! -x $i ];then
92+
echo "$i not found,no md5sum!"
93+
else
94+
md5sum $i >> /var/log/`hostname`.log
95+
fi
96+
done
9797
rm -f list

‎linux-init-script/init_centos6.sh

+4-4
Original file line numberDiff line numberDiff line change
@@ -186,14 +186,14 @@ cat > /opt/sh/ipt.sh << EOF
186186
/sbin/iptables -A OUTPUT -j ACCEPT
187187
/sbin/iptables -A INPUT -s 192.168.10.152 -j ACCEPT
188188
/sbin/iptables -A INPUT -s 192.168.20.102 -j ACCEPT
189-
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 80 -j ACCEPT
190-
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p tcp --dport 80 -j ACCEPT
189+
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
190+
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
191+
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 8080 -j ACCEPT
192+
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p tcp --dport 8080 -j ACCEPT
191193
/sbin/iptables -t raw -A PREROUTING -s 192.168.10.0/255.255.255.0 -p tcp --dport 80 -j NOTRACK
192194
/sbin/iptables -t raw -A PREROUTING -s 192.168.20.0/255.255.255.0 -p tcp --dport 80 -j NOTRACK
193195
/sbin/iptables -t raw -A OUTPUT -s 192.168.10.0/255.255.255.0 -p tcp --sport 80 -j NOTRACK
194196
/sbin/iptables -t raw -A OUTPUT -s 192.168.20.0/255.255.255.0 -p tcp --sport 80 -j NOTRACK
195-
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 22 -j ACCEPT
196-
/sbin/iptables -A INPUT -s 192.168.56.0/255.255.255.0 -p tcp --dport 22 -j ACCEPT
197197
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p icmp -j ACCEPT
198198
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p icmp -j ACCEPT
199199

‎linux-init-script/init_centos7.sh

+4-4
Original file line numberDiff line numberDiff line change
@@ -178,14 +178,14 @@ cat > /opt/sh/ipt.sh << EOF
178178
/sbin/iptables -A OUTPUT -j ACCEPT
179179
/sbin/iptables -A INPUT -s 192.168.10.152 -j ACCEPT
180180
/sbin/iptables -A INPUT -s 192.168.20.102 -j ACCEPT
181-
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 80 -j ACCEPT
182-
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p tcp --dport 80 -j ACCEPT
181+
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
182+
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
183+
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 8080 -j ACCEPT
184+
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p tcp --dport 8080 -j ACCEPT
183185
/sbin/iptables -t raw -A PREROUTING -s 192.168.10.0/255.255.255.0 -p tcp --dport 80 -j NOTRACK
184186
/sbin/iptables -t raw -A PREROUTING -s 192.168.20.0/255.255.255.0 -p tcp --dport 80 -j NOTRACK
185187
/sbin/iptables -t raw -A OUTPUT -s 192.168.10.0/255.255.255.0 -p tcp --sport 80 -j NOTRACK
186188
/sbin/iptables -t raw -A OUTPUT -s 192.168.20.0/255.255.255.0 -p tcp --sport 80 -j NOTRACK
187-
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p tcp --dport 22 -j ACCEPT
188-
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p tcp --dport 22 -j ACCEPT
189189
/sbin/iptables -A INPUT -s 192.168.10.0/255.255.255.0 -p icmp -j ACCEPT
190190
/sbin/iptables -A INPUT -s 192.168.20.0/255.255.255.0 -p icmp -j ACCEPT
191191

0 commit comments

Comments
 (0)