Linux安全加固配置
#! /bin/bash
# copyright by hwb
# Function:對賬戶的密碼的一些加固
read -p "設置密碼最多可多少天不修改：" A
read -p "設置密碼修改之間最小的天數：" B
read -p "設置密碼最短的長度：" C
read -p "設置密碼失效前多少天通知用戶：" D
sed -i '/^PASS_MAX_DAYS/c\PASS_MAX_DAYS '$A'' /etc/login.defs
sed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS '$B'' /etc/login.defs
sed -i '/^PASS_MIN_LEN/c\PASS_MIN_LEN '$C'' /etc/login.defs
sed -i '/^PASS_WARN_AGE/c\PASS_WARN_AGE '$D'' /etc/login.defs
echo "已對密碼進行加固，新用戶不得和舊密碼相同，且新密碼必須同時包含數字、小寫字母，大寫字母！！"
sed -i '/pam_pwquality.so/c\password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-auth
echo "已對密碼進行加固，如果輸入錯誤密碼超過3次，則鎖定賬戶！！"
n=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "|wc -l`
if [ $n -eq 0 ];then
sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=3 unlock_time=150 even_deny_root root_unlock_time300' /etc/pam.d/sshd
fi
echo "已設置禁止root用戶遠程登錄！！"
sed -i '/PermitRootLogin/c\PermitRootLogin no' /etc/ssh/sshd_config
read -p "設置歷史命令保存條數：" E
read -p "設置賬戶自動注銷時間：" F
sed -i '/^HISTSIZE/c\HISTSIZE='$E'' /etc/profile
sed -i '/^HISTSIZE/a\TMOUT='$F'' /etc/profile
echo "已設置只允許wheel組的用戶可以使用su命令切換到root用戶！"
sed -i '/pam_wheel.so use_uid/c\auth required pam_wheel.so use_uid ' /etc/pam.d/su
n=`cat /etc/login.defs | grep SU_WHEEL_ONLY | wc -l`
if [ $n -eq 0 ];then
echo SU_WHEEL_ONLY yes >> /etc/login.defs
fi
echo "即將對系統中的賬戶進行檢查...."
echo "系統中有登錄權限的用戶有："
awk -F: '($7=="/bin/bash"){print $1}' /etc/passwd
echo "********************************************"
echo "系統中UID=0的用戶有："
awk -F: '($3=="0"){print $1}' /etc/passwd
echo "********************************************"
N=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
echo "系統中空密碼用戶有：$N"
if [ $N -eq 0 ];then
echo "恭喜你，系統中無空密碼用戶！！"
echo "********************************************"
else
i=1
while [ $N -gt 0 ]
do
None=`awk -F: '($2==""){print $1}' /etc/shadow|awk 'NR=='$i'{print}'`
echo "------------------------"
echo $None
echo "必須為空用戶設置密碼！！"
passwd $None
let N--
done
M=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
if [ $M -eq 0 ];then
echo "恭喜，系統中已經沒有空密碼用戶了！"
else
echo "系統中還存在空密碼用戶：$M"
fi
fi
echo "即將對系統中重要文件進行鎖定，鎖定后將無法添加刪除用戶和組"
read -p "警告：此腳本運行后將無法添加刪除用戶和組！！確定輸入Y，取消輸入N；Y/N：" i
case $i in
[Y,y])
chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/group
chattr +i /etc/gshadow
echo "鎖定成功！"
;;
[N,n])
chattr -i /etc/passwd
chattr -i /etc/shadow
chattr -i /etc/group
chattr -i /etc/gshadow
echo "取消鎖定成功！！"
;;
*)
echo "請輸入Y/y or N/n"
esac
