1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85
| touch /etc/ssh_banner chown bin:bin /etc/ssh_banner chmod 644 /etc/ssh_banner echo " Authorized only. All activity will be monitored and reported " > /etc/ssh_banner vi /etc/ssh/sshd_config Banner /etc/ssh_banner PermitRootLogin no Protocol 2 service sshd restart
vi /etc/pam.d/su auth sufficient /lib64/security/pam_rootok.so auth required /lib64/security/pam_wheel.so use_uid group=wheel usermod –G wheel user groups user
vi /etc/login.defs PASS_MIN_DAYS = 7 PASS_WARN_AGE = 30
echo "xxxxx" |passwd --stdin root
vi /etc/syslog.conf *.* @loghost /etc/init.d/rsyslog restart
chattr +i /etc/passwd chattr +i /etc/shadow chattr +i /etc/group
rpm -qa|grep snmp rpm -e net-snmp-5.5-41.el6.x86_64 --nodeps rpm -e net-snmp-libs-5.5-41.el6.x86_64 --nodeps
cp -p /etc/sysctl.conf /etc/sysctl.conf.bak sysctl -w net.ipv4.conf.all.accept_source_route=""0"" sysctl -w net.ipv4.conf.all.accept_redirects=""0""
vi /etc/init/control-alt-delete.conf #exec /sbin/shutdown -r now "Control-Alt-Delete pressed"
vi /etc/profile export HISTFILESIZE=5 export TMOUT=300 export HISTSIZE=5
grub-md5-crypt vi /boot/grub/menu.lst password --md5 XXXXXXXX
vi /etc/securetty #注释掉tty*项和pts/* CONSOLE=/dev/tty01
#iptables iptables -L #清空所有默认规则 iptables -F #开启全通 iptables -P INPUT ACCEPT #允许来自于lo接口的数据包(本地访问) iptables -A INPUT -i lo -j ACCEPT #ssh卡慢 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT #常用操作 iptables -A INPUT -p tcp -s 192.168.0/24 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -–dport 80 -s 124.115.0.0/24 -j DROP #删除策略 iptables -D INPUT 顺序 #关闭全通 iptables -P INPUT DROP #保存策略 service iptables save systemctl enable iptables.service systemctl start iptables.service
#firewall firewall-cmd --list-all firewall-cmd --reload systemctl start firewalld.service systemctl stop firewalld.service systemctl status firewalld firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="x.x.x.x" port protocol="tcp" port="1-65535" accept" firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="x.x.x.0/24" port port="1-65535" protocol="tcp" accept"
|