Shell Script

#! /bin/bash
# Function:对账户的密码的一些加固
read -p "设置密码最多可多少天不修改：" A
read -p "设置密码修改之间最小的天数：" B
read -p "设置密码最短的长度：" C
read -p "设置密码失效前多少天通知用户：" D
sed -i '/^PASS_MAX_DAYS/c\PASS_MAX_DAYS '$A'' /etc/login.defs
sed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS '$B'' /etc/login.defs
sed -i '/^PASS_MIN_LEN/c\PASS_MIN_LEN '$C'' /etc/login.defs
sed -i '/^PASS_WARN_AGE/c\PASS_WARN_AGE '$D'' /etc/login.defsecho "已对密码进行加固，新用户不得和旧密码相同，且新密码必须同时包含数字、小写字母，大写字母！！"
sed -i '/pam_pwquality.so/c\password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-authecho "已对密码进行加固，如果输入错误密码超过3次，则锁定账户！！"
n=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "|wc -l`
if [ $n -eq 0 ];then
sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=3 unlock_time=150 even_deny_root root_unlock_time300' /etc/pam.d/sshd
fiecho  "已设置禁止root用户远程登录！！"
sed -i '/PermitRootLogin/c\PermitRootLogin no'  /etc/ssh/sshd_configread -p "设置历史命令保存条数：" E
read -p "设置账户自动注销时间：" F
sed -i '/^HISTSIZE/c\HISTSIZE='$E'' /etc/profile
sed -i '/^HISTSIZE/a\TMOUT='$F'' /etc/profileecho "已设置只允许wheel组的用户可以使用su命令切换到root用户！"
sed -i '/pam_wheel.so use_uid/c\auth required pam_wheel.so use_uid ' /etc/pam.d/su
n=`cat /etc/login.defs | grep SU_WHEEL_ONLY | wc -l`
if [ $n -eq 0 ];then
echo SU_WHEEL_ONLY yes >> /etc/login.defs
fiecho "即将对系统中的账户进行检查...."
echo "系统中有登录权限的用户有："
awk -F: '($7=="/bin/bash"){print $1}' /etc/passwd
echo "********************************************"
echo "系统中UID=0的用户有："
awk -F: '($3=="0"){print $1}' /etc/passwd
echo "********************************************"
N=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
echo "系统中空密码用户有：$N"
if [ $N -eq 0 ];thenecho "恭喜你，系统中无空密码用户！！"echo "********************************************"
elsei=1while [ $N -gt 0 ]doNone=`awk -F: '($2==""){print $1}' /etc/shadow|awk 'NR=='$i'{print}'`echo "------------------------"echo $Noneecho "必须为空用户设置密码！！"passwd $Nonelet N--doneM=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`if [ $M -eq 0 ];thenecho "恭喜，系统中已经没有空密码用户了！"else
echo "系统中还存在空密码用户：$M"fi
fiecho "即将对系统中重要文件进行锁定，锁定后将无法添加删除用户和组"
read -p "警告：此脚本运行后将无法添加删除用户和组！！确定输入Y，取消输入N；Y/N：" i
case $i in[Y,y])chattr +i /etc/passwdchattr +i /etc/shadowchattr +i /etc/groupchattr +i /etc/gshadowecho "锁定成功！"
;;[N,n])chattr -i /etc/passwdchattr -i /etc/shadowchattr -i /etc/groupchattr -i /etc/gshadowecho "取消锁定成功！！"
;;*)echo "请输入Y/y or N/n"
esac

其他方案

使用说明：
1.适用与系统Centos 7
2.有安全设置与系统业务有冲突时，请自行检查。
3.仅用于一次性安全加固，脚本有些许小bug，不用于安全修复。

主要功能说明：
一键加固默认安全选项包括:
1.开启防火墙，默认开启22端口，其他已放行端口不会关闭；
2.禁止telnet运行，禁止开机启动；
3.加强用户密码强度和限制登录错误次数、设置自动注销时间;
4.开启审核策略；
5.日志审计记录6个月；
6.禁止蓝牙启动；
7.DOS攻击防御；
8.记录历史命令。

隐藏或附加功能说明：
1.默认检测网络是否畅通。
2.在/etc目录下产生safe.log一键加固日志。
3.一键加固后，再次运行脚本可以检查本系统是否已经运行过本脚本。
4.一键加固后，再次运行脚本可以选择增加要开启的端口号。

操作说明：
1.将safe_linux.sh放入linux系统任意目录下 输入 sh safe_linux.sh 即可运行本此脚本。
2.根据系统提示，选择相应功能。
3.如需查看加固日志，输入 cat /etc/safe.log

#!/bin/bash
.  /etc/init.d/functions#判断能否上网
network(){
net_ok=" `curl -I -s www.baidu.com |sed -n "1p"|awk '{print $NF}'|sed s/[[:space:]]//g ` "
if [ $net_ok = "OK" ];then
#1表示网络畅通
network_status=1
action "网络状态：有网络."   /bin/true
else
#0表示网络不畅通
network_status=0
action "网络状态：无网络."   /bin/false
echo "无网络，可能会影响相关安全功能部署"
fi
}[ -t /etc/safe.log ] && touch /etc/safe.logselect_safe(){
cat <<-EOF一键加固默认安全选项包括:
1.开启防火墙，默认开启22端口，其他已放行端口不会关闭；
2.禁止telnet运行，禁止开机启动；
3.加强用户密码强度和限制登录错误次数、设置自动注销时间;
4.开启审核策略；
5.日志审计记录6个月； 
6.禁止蓝牙启动；
7.DOS攻击防御；
8.记录历史命令。"========选择安全加固选项=======1 输入1选择默认一键加固2 输入2或者其他任意按钮选择退出
===============================
EOF
}print_result_one(){
echo "==============================="
echo "本次一键安全加固结果如下："
firewall_result
telnet_result
usermanage_result
auditd_result
log_result
bluetooth_result
ddos_result
historycomand_result
echo "执行用户：`logname` 执行ip:`ifconfig ens33|sed -n '2p'|awk '{ print $2 }'`  一键加固执行时间：`date`   " >> /etc/safe.log
echo "1" >>/etc/safe.log
echo "==============================="
}function_main(){
read -p "请输入数字选择功能：" safe
case "$safe" in
1)
echo "开始一键加固......"
firewall_on
telnet_off
usermanage_on
auditd_on
log_on
bluetooth_off
ddos_on
historycomand_on
print_result_one
;;
*)
echo " 退出 "
exit 1
;;
esac
}firewall_on(){
systemctl start firewalld
echo "防火墙是 ` sed -n '3p' /fw.log|awk '{print $2}' ` "
echo "添加ssh端口22 ` firewall-cmd --zone=public --add-port=22/tcp --permanent ` "
}firewall_result(){
if [ " ` sed -n '3p' /fw.log|awk '{print $2}' ` "="active" ];then 
action "1.开启防火墙，默认开启22端口；"  /bin/true
else
action "1.开启防火墙，默认开启22端口；"  /bin/false
fi 
}telnet_off(){
#设置开机关闭telnet
chkconfig telnet off &> /dev/null
}telnet_result(){
#查询是否开启telnetif [ -z "`netstat -an | grep ":23"`" ];then
action "2.禁止telnet运行，禁止开机启动；"  /bin/true
else
action "2.禁止telnet运行，禁止开机启动；"  /bin/false
fi
}#设置普通用户的密码强度
usermanage_on(){
sed -i '/pam_pwquality.so/c\password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=  difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-auth
echo "普通用户的密码强度已设置"
echo "root用户的密码强度自行设置"#登录失败次数
ssh_num=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "|wc -l`
if [ $ssh_num -eq 0 ];then
sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=5 unlock_time=120 even_deny_root root_unlock_time150' /etc/pam.d/sshd
cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "
echo "登录失败次数为5，锁定普通用户120秒，锁定root用户150秒" 
fi#查看锁定用户
lock_user=`pam_tally2 |wc -l` 
if [ $lock_user -ne 0 ] ;then
echo "锁定用户为：`cat pam_tally2` "
fi#设置账户自动注销时间
sed -i '/^HISTSIZE/a\TMOUT='600'' /etc/profile 
echo "设置账户自动注销时间: 600s"
}usermanage_result(){
usermanage1="`sed -i '/^HISTSIZE/c\HISTSIZE='10000'' /etc/profile `"
usermanage2="`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so"|awk '{print $4 }'`" 
usermanage3="`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so"|awk '{print $5 }'`" 
if [ "$usermanage1"="HISTSIZE=10000" ] && [ "$usermanage2"="deny=5" ] && [ "$usermanage3"="unlock_time=120" ];then
action "3.加强用户密码强度和限制登录错误次数、设置自动注销时间；"  /bin/true
else
action "3.加强用户密码强度和限制登录错误次数、设置自动注销时间；"  /bin/false
fi
}#开启审核策略
auditd_on(){
#开启auditd审核策略
auditd_status=" ` systemctl status auditd|sed -n "3p" |awk '{print $2}' ` "
if [ $auditd_status = "active" ];then
echo "auditd状态是 $auditd_status"
else
systemctl start auditd
echo "auditd状态是 $auditd_status"
fi#开启rsyslog审核策略
rsyslog_status=" ` systemctl status rsyslog|sed -n "3p" |awk '{print $2}' ` "
if [ $rsyslog_status = "active" ];then
echo "rsyslog状态是 $rsyslog_status"
else
systemctl start rsyslog
echo "rsyslog状态是 $rsyslog_status"
fi
}auditd_result(){
auditd_status1=" ` systemctl status auditd|sed -n "3p" |awk '{print $2}' ` "
rsyslog_status1=" ` systemctl status rsyslog|sed -n "3p" |awk '{print $2}' ` "
if [ $auditd_status1 = "active" ] && [ $rsyslog_status1 = "active" ];then
action "4.开启审核策略；"  /bin/true
else
action "4.开启审核策略；"  /bin/false
fi
}#开启日志审计
log_on(){
#日志审计设置为6个月
sed -i 's/rotate [0-9][0-9]/rotate 6/g' /etc/logrotate.conf
sed -i 's/weekly/monthly/g' /etc/logrotate.conf
echo " 日志审计设置为`  more /etc/logrotate.conf | grep -v "^#\|^$" |grep rotate|sed -n '1p'|awk '{print $2}' `个月"
}log_result(){
log_num1=` more /etc/logrotate.conf | grep -v "^#\|^$" |grep rotate|sed -n '1p'|awk '{print $2}' `
log_num2=` more /etc/logrotate.conf | grep -v "^#\|^$" |grep monthly|sed -n {1p}`
if [ $log_num1="6" ] && [ $log_num2="monthly" ];then
action "5.日志审计记录6个月；"  /bin/true
else
action "5.日志审计记录6个月；"  /bin/false
fi
}bluetooth_status=" ` systemctl status bluetooth|sed -n "3p" |awk '{print $2}' ` "
bluetooth_off(){
if [ $bluetooth_status = "active" ];then
echo "蓝牙状态是 $bluetooth_status"
systemctl stop bluetooth
else
echo "蓝牙状态是 $bluetooth_status"
fi
}bluetooth_result(){
if [ $bluetooth_status = "inactive" ];then
action "6.禁止蓝牙启动；"  /bin/true
else
action "6.禁止蓝牙启动；"  /bin/false
fi
}#开启DDOS安全防护
ddos_on(){#开启SYN Cookies；当出现SYN等待队列溢出时，启用cookies来处理，可防范少量SYN攻击，默认为0，表示关闭；
echo "1" >/proc/sys/net/ipv4/tcp_syncookies #以下代码为自测自学的功能验证，以此开始。存在小bug但不影响一键加固功能:仅以等号后的值作为修改判断标准。如果 net.ipv4.tcp_syncookies的前后书写有错，则无法变更该值。#
tcp_syncookies1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_syncookies|sed -n '1p'|awk '{ print $NF }'`
tcp_syn_backlog1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_max_syn_backlog|sed -n '1p'|awk '{ print $NF }'`
tcp_synack_retries1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_synack_retries|sed -n '1p'|awk '{ print $NF }'`
tcp_syn_retries1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_syn_retries|sed -n '1p'|awk '{ print $NF }'`
tcp_rmem1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_rmem|sed -n '1p'|awk '{ print $NF }'`
tcp_wmem1=`cat /etc/sysctl.conf |grep net.ipv4.tcp_wmem|sed -n '1p'|awk '{ print $NF }'`if [ -z "$tcp_syncookies1" ]
thenecho "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
elif [ $tcp_syncookies1 -gt 1 ] || [ $tcp_syncookies1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_syncookies = [0-9]*[0-9]/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf
fiif [ -z "$tcp_syn_backlog1" ]
thenecho "net.ipv4.tcp_max_syn_backlog = 4096" >> /etc/sysctl.conf
elif [ $tcp_syn_backlog1 -gt 1 ] || [ $tcp_syn_backlog1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_max_syn_backlog = [0-9]*[0-9]/net.ipv4.tcp_max_syn_backlog = 4096/g' /etc/sysctl.conf
fiif [ -z "$tcp_synack_retries1" ]
thenecho "net.ipv4.tcp_synack_retries = 2" >> /etc/sysctl.conf
elif [ $tcp_synack_retries1 -gt 1 ] || [ $tcp_synack_retries1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_synack_retries = [0-9]*[0-9]/net.ipv4.tcp_synack_retries = 2/g' /etc/sysctl.conf
fiif [ -z "$tcp_syn_retries1" ]
thenecho "net.ipv4.tcp_syn_retries = 2" >> /etc/sysctl.conf
elif [ $tcp_syn_retries1 -gt 1 ] || [ $tcp_syn_retries1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_syn_retries = [0-9]*[0-9]/net.ipv4.tcp_syn_retries = 2/g' /etc/sysctl.conf
fiif [ -z "$tcp_rmem1" ]
thenecho "net.ipv4.tcp_rmem = 32768" >> /etc/sysctl.conf
elif [ $tcp_rmem1 -gt 1 ] || [ $tcp_rmem1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_rmem = [0-9]*[0-9]/net.ipv4.tcp_rmem = 32768/g' /etc/sysctl.conf
fiif [ -z "$tcp_wmem1" ]
thenecho "net.ipv4.tcp_wmem = 32768" >> /etc/sysctl.conf
elif [ $tcp_wmem1 -gt 1 ] || [ $tcp_rmem1 -eq 0 ]
thensed -i 's/net.ipv4.tcp_wmem = [0-9]*[0-9]/net.ipv4.tcp_wmem = 32768/g' /etc/sysctl.conf
fi
#以上代码为自测自学的功能验证，以此为止。#更改SYN包的最大请求队列
#sed -i 's/net.ipv4.tcp_max_syn_backlog =  [0-9]*/net.ipv4.tcp_max_syn_backlog = 2048/g' /etc/sysctl.conf
if [ ` rpm -qa|grep iptables|wc -l ` -eq 2 ];then
echo "iptables服务已安装，开始进行安全配置"
# 防止同步包洪水（Sync Flood）
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#--limit 1/s 限制syn并发数每秒1次，可以根据自己的需要修改防止各种端口扫描
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#Ping洪水攻击（Ping of Death）
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
elif [ $network_status -eq 1 ];then
echo "无iptables，开始安装"
yum install iptables -y
yum install iptables-services
systemctl start iptables.service
systemctl enable iptables
# 防止同步包洪水（Sync Flood）
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#--limit 1/s 限制syn并发数每秒1次，可以根据自己的需要修改防止各种端口扫描
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#Ping洪水攻击（Ping of Death）
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
else
echo "因无iptables和无网络，此项安全防护未部署"
fi   
}ddos_result(){
if [ `more /proc/sys/net/ipv4/tcp_syncookies` -eq 1 ] && [ $tcp_syncookies1 -eq 1 ] && [ $tcp_syn_backlog1 -eq 4096 ] && [ $tcp_wmem1 -eq 32768 ] && [ $tcp_rmem1 -eq 32768 ];then
action "7.DOS攻击防御；"  /bin/true
else
action "7.DOS攻击防御；"  /bin/false
fi
}#增加历史命令条数；为增加登录的IP地址、执行命令时间等历史命令
historycomand_on(){
#增加历史命令条数
sed -i 's/^HISTSIZE=[0-9]*[0-9]/HISTSIZE=10000/g' /etc/profile#增加登录的IP地址、执行命令时间
echo "USER_IP='`who -u am i 2>/dev/null| awk '{print $NF}' |sed -e 's/[()]//g' `' " >>/etc/profile
echo 'if [ "$USER_IP" = "" ];then
USER_IP=" `hostname` "
fi
export HISTTIMEFORMAT="%F %T $USER_IP `whoami` "
shopt -s histappend 
export PROMPT_COMMAND="history -a"
' >> /etc/profile
echo "已经增加历史命令条数。" 
} historycomand_result(){
if [ "` more /etc/profile|grep HISTSIZE= `"=10000 ] && [ `more /etc/profile|grep shopt -s|sed -n '1p'|awk '{ print $NF }'`="histappend" ];then
action "8.记录历史命令。"  /bin/true
else
action "8.记录历史命令。"  /bin/false
fi
}#*****防火墙增加端口*****
#输入功能选择项
insert(){
cat <<-EOF
=====选择增加或者删除端口======1 增加端口2 删除端口3 查询端口4 退出
===============================
EOF
}#刷新防火墙
flush(){
echo "防火墙刷新：` firewall-cmd --reload ` "
}#增加端口
add_port(){
read -p "请输入要开放的1个端口:  " num
echo "添加 ` firewall-cmd --zone=public --add-port=$num/tcp --permanent ` "}#删除端口
delete_port(){
read -p "请输入要删除的1个端口:  " n
echo "删除 ` firewall-cmd --zone=public --remove-port=$n/tcp --permanent ` "
}#查询端口
search_port(){
flush
echo "当前开放的端口及类型： ` firewall-cmd --zone=public --list-ports ` "
}#端口功能选择
select_p(){#循环功能
while true
do
insert
read -p "请输入数字选择功能：" fun
case "$fun" in 
1)
add_port
search_port
;;
2)
delete_port
search_port
;;
3)
search_port
;;
4)
exit 1
;;
*)
echo " 无输入或输入错误 "
exit 2
;;
esac
done
}#主函数
tcp_port(){
search_port
select_p
}#*****防火墙增加端口*****main(){
s1="`sed -n '$p' /etc/safe.log`"
if [ "$s1" = "1" ];then
action "********已经进行过一键加固无需再次加固********"  /bin/false
read -p "
1 输入 1 选择是否重复加固，
2 输入 2 开放系统所需端口
3 输入其他选择退出：" start_safe
case "$start_safe" in
1)
network
select_safe
function_main
;;
2)	
tcp_port
;;
*)
echo " 退出 "
exit 1
;;
esac
else
network
select_safe
function_main
fi
}
main