首页 » 系统安全 » Linux/Unix » Centos » 正文

CentOS 7 主机加固手册-2

1、设置/boot/grub2/grub.cfg的权限为600 
# chmod  /boot/grub2/grub.cfg 600 

2、设置BootLoader密码
Grub2 BootLoader需要配置一个superuser并设置密码。创建一个superuser并放到/etc/grub.d里面,由于明文密码不安全,要使用grub2-mkpasswd-pbkdf2生成一个hash过得密码存储。
# password_pbkdf2

3、grub2 superuser名字不应该是管理员的名字
 grub2 superuser账号要避免使用常用的管理员用户名比如admin,root,administrator,要满足FISMA Moderate等级要求,BootLoader superuser的密码必须和root用户不一样。
# grub2-mkconfig -o /boot/grub2/grub.cfg

不应该手工像grub.cfg里面添加超级用户,因为 执行grub2-mkconfig 会覆盖掉这个文件

4、为单用户模式设置认证
# vi /etc/sysconfig/init  
SINGLE=/sbin/sulogin

5、禁止Ctrl+Alt+Del快捷键重启
# vi /etc/init/control-alt-delete.conf and modify the existing line:
exec /sbin/shutdown -r now “Control-Alt-Delete pressed”
To:
exec /usr/bin/logger -p security.info “Control-Alt-Delete pressed”

6、启用Screen
Screen是一个可以在多个进程之间多路复用一个物理终端的窗口管理器。
# yum install screen

7、禁用 Zeroconf Networking
当系统无法连接DHCP server的时候,就会尝试通过ZEROCONF来获取IP。然后网卡将会被设置为 169.254.0.0段的地址,可以禁止这项功能。
# echo “NOZEROCONF=yes” >> /etc/sysconfig/network

8、禁止IPv6自动启用
# vi /etc/modprobe.d/disabled.conf 
options ipv6 disable=1

9、禁止网卡使用IPv6
# vi /etc/sysconfig/network
NETWORKING_IPV6=no
IPV6INIT=no

10、 禁止对 RPC IPv6的支持
像NFSv4这样的RPC 服务会尝试使用 IPv6 ,为了防止这种行为打开 /etc/netconfig 将下面两行注释掉
udp6       tpi_clts      v     inet6    udp     –       –
tcp6       tpi_cots_ord  v     inet6    tcp     –       –

11、配置安全地root登录(这不请谨慎,ssh root将不能登录)
设置root只能从本地终端登录
echo “tty1″ > /etc/securetty
chmod 700 /root

12、设置默认UMASK 值
perl -npe ‘s/umask\s+0\d2/umask 077/g’ -i /etc/bashrc
perl -npe ‘s/umask\s+0\d2/umask 077/g’ -i /etc/csh.cshrc

13、 删除 Idle 用户

echo "Idle users will be removed after 15 minutes"
echo "readonly TMOUT=900" >> /etc/profile.d/os-security.sh
echo "readonly HISTFILE" >> /etc/profile.d/os-security.sh
chmod +x /etc/profile.d/os-security.sh

14、加固 Cron

echo "Locking down Cron"
touch /etc/cron.allow
chmod 600 /etc/cron.allow
awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
echo "Locking down AT"
touch /etc/at.allow
chmod 600 /etc/at.allow
awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny

15、加固Linux内核

# vi /etc/sysctl.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.tcp_max_syn_backlog = 1280
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_timestamps = 0

16、禁止所有TCP Wrappers(ssh谨慎使用)
TCP wrappers允许提供一种快捷方便的方法访问应用程序,比如
echo “ALL:ALL” >> /etc/hosts.deny
echo “sshd:ALL” >> /etc/hosts.allow

17、 基本的iptables防火墙规则
默认禁止全部入站,允许全部出站。

#Drop anything we aren't explicitly allowing. All outbound traffic is okay
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
# Accept Pings
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -j ACCEPT
# Log anything on eth0 claiming it's from a local or non-routable network
# If you're using one of these local networks, remove it from the list below
-A INPUT -i eth0 -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
-A INPUT -i eth0 -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
-A INPUT -i eth0 -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
-A INPUT -i eth0 -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -i eth0 -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
-A INPUT -i eth0 -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "
# Accept any established connections
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accept ssh traffic. Restrict this to known ips if possible.
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
#Log and drop everything else
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j DROP
COMMIT

18、启用 iptables
sudo systemctl enable iptables
systemctl start iptables.service 

19、 禁用异常协议
可以禁用如下协议:
Datagram Congestion Control Protocol (DCCP)
Stream Control Transmission Protocol (SCTP)
Reliable Datagram Sockets (RDS)
Transparent Inter-Process Communication (TIPC)

# echo "install dccp /bin/false" > /etc/modprobe.d/dccp.conf
# echo "install sctp /bin/false" > /etc/modprobe.d/sctp.conf
# echo "install rds /bin/false" > /etc/modprobe.d/rds.conf
# echo "install tipc /bin/false" > /etc/modprobe.d/tipc.conf

20、安装并启用rsyslog
yum -y install rsyslog
systemctl enable rsyslog.service
systemctl start rsyslog.service

21、配置Audit(不建议配置)
开启Auditd审计服务
systemctl enable auditd.service
systemctl start auditd.service

开机审计进程
在 /etc/grub.conf里面添加一行:
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1 

审计日志保留份数
打开/etc/audit/auditd.conf添加: 
num_logs = 5

Auditd 日志最大值
max_log_file = 30MB

审计 max_log_file_action
vi /etc/audit/auditd.conf  
max_log_file_action = rotate

Auditd space_left
Configure auditd to email you when space gets low, open /etc/audit/auditd.conf and modify the following:
vi  /etc/audit/auditd.conf 
space_left_action = email

Auditd admin_space_left
Configure auditd to halt when auditd log space is used up, forcing the system admin to rectify the space issue.
On some systems where monitoring is less important another action could be leveraged.
admin_space_left_action = halt

Auditd mail_acct
When space gets low auditd can send a email notification via email, to configure this and the following line to /etc/audit/auditd.conf:
action_mail_acct = root

启用auditd  audispd 插件
Aduitd并不能将logs直接发送到外部日志服务器,需要通过audispd这个插件先将日志发送给本地syslog服务器。启用这个插件:编辑/etc/audisp/plugins.d/syslog.conf ,然后设置active=yes。然后重启audispd daemon:
# service auditd restart

发表评论