Centos 6.4安全防护设置指南,centos6.4设置指南1、修改客户密码的长

Centos 6.4安全防护设置指南,centos6.4设置指南1、修改客户密码的长

CentOS操作系统安装完成之后，我们需要对现有的系统进行一些简单的设置，才能使用操作系统更加安全可靠，下面我们来向大家介绍一些最基本的安全防护策略，进一步提升操作系统的安全性。

1、修改客户密码的长度

密码的安全是操作系统的第一步，所以我们必须要求有一个强壮的密码，可以通过修改/etc/login.defs文件来实现我们要求的密码长度。

/etc/login.defs原始内容如下：

[root@localhost ~]# vi /etc/login.defs

#

# Please note that the parameters in this configuration file control the

# behavior of the tools from the shadow-utils component. None of these

# tools uses the PAM mechanism, and the utilities that use PAM (such as the

# passwd command) should therefore be configured elsewhere. Refer to

# /etc/pam.d/system-auth for more information.

#

# *REQUIRED*

# Directory where mailboxes reside, _or_ name of file, relative to the

# home directory. If you _do_ define both, MAIL_DIR takes precedence.

# QMAIL_DIR is for Qmail

#

#QMAIL_DIR Maildir

MAIL_DIR /var/spool/mail

#MAIL_FILE .mail

# Password aging controls:

#

# PASS_MAX_DAYS Maximum number of days a password may be used.

# PASS_MIN_DAYS Minimum number of days allowed between password changes.

# PASS_MIN_LEN Minimum acceptable password length.

# PASS_WARN_AGE Number of days warning given before a password expires.

#

PASS_MAX_DAYS 99999

PASS_MIN_DAYS 0

PASS_MIN_LEN 5

PASS_WARN_AGE 7

#

# Min/max values for automatic uid selection in useradd

#

UID_MIN 500

UID_MAX 60000

#

# Min/max values for automatic gid selection in groupadd

#

GID_MIN 500

GID_MAX 60000

#

# If defined, this command is run when removing a user.

# It should remove any at/cron/print jobs etc. owned by

# the user to be removed (passed as the first argument).

#

#USERDEL_CMD /usr/sbin/userdel_local

#

# If useradd should create home directories for users by default

# On RH systems, we do. This option is overridden with the -m flag on

# useradd command line.

#

CREATE_HOME yes

# The permission mask is initialized to this value. If not specified,

# the permission mask will be initialized to 022.

UMASK 077

# This enables userdel to remove user groups if no members exist.

#

USERGROUPS_ENAB yes

# Use SHA512 to encrypt password.

ENCRYPT_METHOD SHA512

# Password aging controls:

#

# PASS_MAX_DAYS Maximum number of days a password may be used.

# PASS_MIN_DAYS Minimum number of days allowed between password changes.

# PASS_MIN_LEN Minimum acceptable password length.

# PASS_WARN_AGE Number of days warning given before a password expires.

#

PASS_MAX_DAYS 99999

PASS_MIN_DAYS 0

PASS_MIN_LEN 5

PASS_WARN_AGE 7

#

# Min/max values for automatic uid selection in useradd

#

UID_MIN 500

UID_MAX 60000

#

# Min/max values for automatic gid selection in groupadd

#

GID_MIN 500

GID_MAX 60000

#

# If defined, this command is run when removing a user.

# It should remove any at/cron/print jobs etc. owned by

# the user to be removed (passed as the first argument).

#

#USERDEL_CMD /usr/sbin/userdel_local

#

# If useradd should create home directories for users by default

# On RH systems, we do. This option is overridden with the -m flag on

# useradd command line.

#

CREATE_HOME yes

# The permission mask is initialized to this value. If not specified,

# the permission mask will be initialized to 022.

UMASK 077

# This enables userdel to remove user groups if no members exist.

#

USERGROUPS_ENAB yes

# Use SHA512 to encrypt password.

ENCRYPT_METHOD SHA512

将密码最小的长度调整为8

PASS_MIN_LEN 8

2、注释掉操作系统不需要使用的用户和用户组

Centos 6.4操作系统安装好之后，我们需要针对一些不需要使用的用户和用户组来进行设置，减少可能发生的安全问题。

/etc/passwd原始内容如下：

[root@localhost ~]# vi /etc/passwd

root:x:0:0:root:/root:/bin/bash

bin:x:1:1:bin:/bin:/sbin/nologin

daemon:x:2:2:daemon:/sbin:/sbin/nologin

adm:x:3:4:adm:/var/adm:/sbin/nologin

lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

sync:x:5:0:sync:/sbin:/bin/sync

shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

halt:x:7:0:halt:/sbin:/sbin/halt

mail:x:8:12:mail:/var/spool/mail:/sbin/nologin

uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin

operator:x:11:0:operator:/root:/sbin/nologin

games:x:12:100:games:/usr/games:/sbin/nologin

gopher:x:13:30:gopher:/var/gopher:/sbin/nologin

ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

nobody:x:99:99:Nobody:/:/sbin/nologin

dbus:x:81:81:System message bus:/:/sbin/nologin

usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin

vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin

rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin

rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin

avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin

pulse:x:498:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin

haldaemon:x:68:68:HAL daemon:/:/sbin/nologin

ntp:x:38:38::/etc/ntp:/sbin/nologin

apache:x:48:48:Apache:/var/www:/sbin/nologin

saslauth:x:497:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin

postfix:x:89:89::/var/spool/postfix:/sbin/nologin

abrt:x:173:173::/etc/abrt:/sbin/nologin

rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin

nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin

gdm:x:42:42::/var/lib/gdm:/sbin/nologin

sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin

tcpdump:x:72:72::/:/sbin/nologin

ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin

注释掉以下用户

#userdel adm:x:3:4:adm:/var/adm:/sbin/nologin

#userdel lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

#userdel sync:x:5:0:sync:/sbin:/bin/sync

#userdel shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

#userdel halt:x:7:0:halt:/sbin:/sbin/halt

#userdel uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin

#userdel operator:x:11:0:operator:/root:/sbin/nologin

#userdel games:x:12:100:games:/usr/games:/sbin/nologin

#userdel gopher:x:13:30:gopher:/var/gopher:/sbin/nologin

#userdel ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

/etc/group原始内容如下：

[root@localhost ~]# vi /etc/group

root:x:0:

bin:x:1:bin,daemon

daemon:x:2:bin,daemon

sys:x:3:bin,adm

adm:x:4:adm,daemon

tty:x:5:

disk:x:6:

lp:x:7:daemon

mem:x:8:

kmem:x:9:

wheel:x:10:

mail:x:12:mail,postfix

uucp:x:14:

man:x:15:

games:x:20:

gopher:x:30:

video:x:39:

dip:x:40:

ftp:x:50:

lock:x:54:

audio:x:63:

nobody:x:99:

users:x:100:

dbus:x:81:

usbmuxd:x:113:

utmp:x:22:

utempter:x:35:

desktop_admin_r:x:499:

desktop_user_r:x:498:

floppy:x:19:

vcsa:x:69:

rpc:x:32:

rtkit:x:497:

avahi-autoipd:x:170:

cdrom:x:11:

tape:x:33:

dialout:x:18:

wbpriv:x:88:

pulse:x:496:

pulse-access:x:495:

fuse:x:494:

haldaemon:x:68:haldaemon

ntp:x:38:

apache:x:48:

saslauth:x:76:

postdrop:x:90:

postfix:x:89:

abrt:x:173:

rpcuser:x:29:

nfsnobody:x:65534:

gdm:x:42:

stapusr:x:156:

stapsys:x:157:

stapdev:x:158:

sshd:x:74:

tcpdump:x:72:

slocate:x:21:

ldap:x:55:

注释掉以下用户组

#groupdel adm:x:4:adm,daemon

#groupdel lp:x:7:daemon

#groupdel uucp:x:14:

#groupdel games:x:20:

#groupdel dip:x:40:

3、检查系统的安全登陆文件

通过检查/var/log/secure该文件的信息，我们可以了解到有哪些用户及IP地址进行登陆。

[root@localhost ~]# more /var/log/secure grep refused

::::::::::::::

/var/log/secure

::::::::::::::

Jan 16 22:33:29 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed

esktop/ConsoleKit/Session1 (system bus name :1.23, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo

cale zh_CN.UTF-8) (disconnected from bus)

Jan 16 22:33:32 localhost sshd[1728]: Received signal 15; terminating.

Jan 16 22:33:32 localhost sshd[2460]: Exiting on signal 15

Jan 16 22:33:32 localhost sshd[2460]: pam_unix(sshd:session): session closed for user root

Jan 17 15:54:27 localhost sshd[1737]: Server listening on 0.0.0.0 port 22.

Jan 17 15:54:27 localhost sshd[1737]: Server listening on :: port 22.

Jan 17 15:54:35 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes

ktop/ConsoleKit/Session1 (system bus name :1.24 [/usr/libexec/polkit-gnome-authentication-agent-1], object p

ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)

Jan 17 15:54:50 localhost sshd[2461]: Accepted password for root from 192.168.1.3 port 55918 ssh2

Jan 17 15:54:50 localhost sshd[2461]: pam_unix(sshd:session): session opened for user root by (uid=0)

Jan 17 16:01:55 localhost polkitd(authority=local): Unregistered Authentication Agent for session /org/freed

esktop/ConsoleKit/Session1 (system bus name :1.24, object path /org/gnome/PolicyKit1/AuthenticationAgent, lo

cale zh_CN.UTF-8) (disconnected from bus)

Jan 17 16:01:58 localhost sshd[1737]: Received signal 15; terminating.

Jan 17 16:01:58 localhost sshd[2461]: Exiting on signal 15

Jan 17 16:01:58 localhost sshd[2461]: pam_unix(sshd:session): session closed for user root

Jan 29 10:49:52 localhost sshd[1728]: Server listening on 0.0.0.0 port 22.

Jan 29 10:49:52 localhost sshd[1728]: Server listening on :: port 22.

Jan 29 10:49:57 localhost polkitd(authority=local): Registered Authentication Agent for session /org/freedes

ktop/ConsoleKit/Session1 (system bus name :1.23 [/usr/libexec/polkit-gnome-authentication-agent-1], object p

ath /org/gnome/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)

Jan 29 10:50:02 localhost sshd[2452]: Accepted password for root from 192.168.1.4 port 53853 ssh2

Jan 29 10:50:02 localhost sshd[2452]: pam_unix(sshd:session): session opened for user root by (uid=0)

Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): check pass; user unknown

Jan 29 10:51:43 localhost vsftpd[2482]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0

tty=ftp ruser=fsdaf rhost=192.168.1.4

Jan 29 10:51:43 localhost vsftpd[2482]: pam_succeed_if(vsftpd:auth): error retrieving information about user

fsdaf

Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): check pass; user unknown

Jan 29 10:51:58 localhost vsftpd[2484]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0

tty=ftp ruser=ithov rhost=192.168.1.4

Jan 29 10:51:58 localhost vsftpd[2484]: pam_succeed_if(vsftpd:auth): error retrieving information about user

ithov

Jan 29 10:54:35 localhost sshd[2452]: pam_unix(sshd:session): session closed for user root

Jan 29 10:54:36 localhost sshd[2493]: Accepted password for root from 192.168.1.4 port 54693 ssh2

Jan 29 10:54:36 localhost sshd[2493]: pam_unix(sshd:session): session opened for user root by (uid=0)

grep: 没有那个文件或目录

refused: 没有那个文件或目录

4、使用chattr命令给下列文件加上不可更改的属性

有效防止非法用户进行文件的修改。

[root@localhost ~]# chattr +i /etc/passwd

[root@localhost ~]# chattr +i /etc/shadow

[root@localhost ~]# chattr +i /etc/group

[root@localhost ~]# chattr +i /etc/gshadow

5、更改SSH端口加强登陆安全

CentOS 6.4安装好之后，默认使用22端口进行连接，就像Windows Server 2008操作系统一样使用3389，对于一般的用户很容易就猜测到这个端口是提供什么服务的，所以建议使用10000以上的端口，这样别人在扫描的时候，能扫描到端口的机率也会降低一些。

不要允许使用低版本的SSH协议进行连接

[root@localhost ~]# vi /etc/ssh/sshd_config

将#protocol 2,1改为

protocol 2

(注：centos 6下已默认取消了低版本协议，默认值为protocol 2)

将PORT改为1000以上端口

[root@localhost ~]# vi /etc/ssh/sshd_config

Port 10000

开启防火墙端口，并重新启动防火墙生效

[root@localhost ~]# vi /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT

[root@localhost ~]# service iptables restart

iptables：清除防火墙规则：[确定]

iptables：将链设置为政策 ACCEPT：filter [确定]

iptables：正在卸载模块：[确定]

iptables：应用防火墙规则：[确定]

iptables：载入额外模块：ip_nat_ftp [确定]

6、防止IP欺骗

编辑/etc/host.conf文件并增加如下几行来防止IP欺骗攻击。

order bind，hosts

multi off

nospoof on