centos8系统加固CentOS7一键安全加固及系统优化脚本

导读点击上方"walkingcloud"关注CentOS7一键安全加固及系统优化脚本init_centos7.sh脚本内容如下脚本说明：本脚本在https://....

点击上方"walkingcloud"关注

CentOS7一键安全加固及系统优化脚本

init_centos7.sh 脚本内容如下

脚本说明：本脚本在 https://github.com/vtrois/spacepack上下载，并在其脚本基础上做了调整，根据前期CentOS7安全加固系列文章，添加了部分加固项

#!/usr/bin/envbash##Author:SeatonJiang<seaton@vtrois.com>#GithubURL:https://github.com/vtrois/spacepack#License:MIT#Date:2020-08-13exportPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/binRGB_DANGER=\033[31;1mRGB_WAIT=\033[37;2mRGB_Success=\033[32mRGB_WARNING=\033[33;1mRGB_INFO=\033[36;1mRGB_END=\033[0mCHECK_CENTOS=$(cat/etc/redhat-release|sed-rs/.*([0-9] )\..*/\1/)CHECK_RAM=$(cat/proc/meminfo|grep"MemTotal"|awk-F""{ram=$2/1000000}{printf("%.0f",ram)})LOCK=/var/log/init_centos7_record.logtool_info(){echo-e"========================================================================================="echo-e"InitCentOS7Script"echo-e"Formoreinformationpleasevisithttps://github.com/vtrois/spacepack"echo-e"========================================================================================="}check_root(){if[[$EUID-ne0]];thenecho-e"${RGB_DANGER}Thisscriptmustberunasroot!${RGB_END}"exit1fi}check_lock(){if[!-f"$LOCK"];thentouch$LOCKelseecho-e"${RGB_DANGER}Detectsthattheinitializationiscompleteanddoesnotneedtobeinitializedanyfurther!${RGB_END}"exit1fi}check_os(){if["${CHECK_CENTOS}"!=7];thenecho-e"${RGB_DANGER}ThisscriptmustberuninCentOS7!${RGB_END}"exit1fi}new_swap(){echo"=============swap=============">>${LOCK}2>&1if["${CHECK_RAM}"-le2];thenecho-en"${RGB_WAIT}Configuring...${RGB_END}"ddif=/dev/zeroof=/swapfilebs=1024count=1048576>>${LOCK}2>&1chmod600/swapfile>>${LOCK}2>&1mkswap/swapfile>>${LOCK}2>&1swapon/swapfile>>${LOCK}2>&1echo/swapfileswapswapdefaults00>>/etc/fstabecho#Swap>>/etc/sysctl.confechovm.swappiness=10>>/etc/sysctl.confsysctl-p>>${LOCK}2>&1sysctl-nvm.swappiness>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"elseecho-e"${RGB_SUCCESS}Skip,noconfigurationneeded${RGB_END}"fi}open_bbr(){echo"=============bbr=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"echo"#BBR">>/etc/sysctl.confecho"net.core.default_qdisc=fq">>/etc/sysctl.confecho"net.ipv4.tcp_congestion_control=bbr">>/etc/sysctl.confsysctl-p>>${LOCK}2>&1sysctl-nnet.ipv4.tcp_congestion_control>>${LOCK}2>&1lsmod|grepbbr>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}disable_software(){echo"=============selinuxfirewalld=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"setenforce0>>${LOCK}2>&1sed-is/^SELINUX=.*$/SELINUX=disabled//etc/selinux/configsystemctldisablefirewalld.service>>${LOCK}2>&1systemctlstopfirewalld.service>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}time_zone(){echo"=============timezone=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"rm-rf/etc/localtime>>${LOCK}2>&1ln-sf/usr/share/zoneinfo/Asia/Shanghai/etc/localtime>>${LOCK}2>&1ls-ln/etc/localtime>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}custom_profile(){echo"=============customprofile=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"cat>/etc/profile.d/centos7init.sh<<EOFPS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h\[\e[35;40m\]\W\[\e[0m\]]\\\\$"GREP_OPTIONS="--color=auto"aliasl=ls-AFhltaliasgrep=grep--coloraliasegrep=egrep--coloraliasfgrep=fgrep--colorexportHISTTIMEFORMAT="%Y-%m-%d%H:%M:%S"EOFcat/etc/profile.d/centos7init.sh>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}adjust_ulimit(){echo"=============adjustulimit=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"sed-i/^#Endoffile/,$d/etc/security/limits.confcat>>/etc/security/limits.conf<<EOF#Endoffile*softcoreunlimited*hardcoreunlimited*softnproc1000000*hardnproc1000000*softnofile1000000*hardnofile1000000rootsoftcoreunlimitedroothardcoreunlimitedrootsoftnproc1000000roothardnproc1000000rootsoftnofile1000000roothardnofile1000000EOFcat/etc/security/limits.conf>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}kernel_optimum(){echo"=============kerneloptimum=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"[!-e"/etc/sysctl.conf_bak"]&&/bin/mv/etc/sysctl.conf{,_bak}cat>/etc/sysctl.conf<<EOF#Controlssourcerouteverificationnet.ipv4.conf.default.rp_filter=1net.ipv4.ip_nonlocal_bind=1net.ipv4.ip_forward=0net.ipv4.conf.all.accept_redirects=0net.ipv4.conf.all.accept_source_route=0net.ipv4.conf.default.accept_source_route=0net.ipv4.icmp_echo_ignore_broadcasts=1net.ipv4.conf.all.log_martians=1net.ipv4.conf.default.log_martians=1net.ipv4.conf.all.promote_secondaries=1net.ipv4.conf.default.promote_secondaries=1#ControlstheuseofTCPsyncookies#Numberofpid_maxkernel.core_uses_pid=1kernel.pid_max=1000000net.ipv4.tcp_syncookies=1#Controlsthemaximumsizeofamessage,inbytes#Controlsthedefaultmaxmimumsizeofamesagequeue#Controlsthemaximumsharedsegmentsize,inbytes#Controlsthemaximumnumberofsharedmemorysegments,inpageskernel.msgmnb=65536kernel.msgmax=65536kernel.shmmax=68719476736kernel.shmall=4294967296kernel.sysrq=1kernel.softlockup_panic=1kernel.printk=5#TCPkernelparamaternet.ipv4.tcp_mem=94500000915000000927000000net.ipv4.tcp_rmem=4096873804194304net.ipv4.tcp_wmem=4096163844194304net.ipv4.tcp_window_scaling=1net.ipv4.tcp_sack=1#Socketbuffernet.core.wmem_default=8388608net.core.rmem_default=8388608net.core.rmem_max=16777216net.core.wmem_max=16777216net.core.netdev_max_backlog=32768net.core.somaxconn=65535net.core.optmem_max=81920#TCPconnnet.ipv4.tcp_max_syn_backlog=262144net.ipv4.tcp_syn_retries=1net.ipv4.tcp_retries1=3net.ipv4.tcp_retries2=15#TCPconnreusenet.ipv4.tcp_timestamps=0net.ipv4.tcp_tw_reuse=1net.ipv4.tcp_fin_timeout=5net.ipv4.tcp_max_tw_buckets=7000net.ipv4.tcp_max_orphans=3276800net.ipv4.tcp_synack_retries=1#keepaliveconnnet.ipv4.tcp_keepalive_time=300net.ipv4.tcp_keepalive_intvl=30net.ipv4.tcp_keepalive_probes=3net.ipv4.ip_local_port_range=102465535net.ipv6.neigh.default.gc_thresh3=4096net.ipv4.neigh.default.gc_thresh3=4096EOFsysctl-p>>${LOCK}2>&1cat/etc/sysctl.conf>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}updatedb_optimum(){echo"=============updatedboptimum=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"sed-is,media,media/data,/etc/updatedb.confcat/etc/updatedb.conf>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}open_ipv6(){echo"=============openipv6=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"echo#IPV6>>/etc/sysctl.confechonet.ipv6.conf.all.disable_ipv6=0>>/etc/sysctl.confechonet.ipv6.conf.default.disable_ipv6=0>>/etc/sysctl.confechonet.ipv6.conf.lo.disable_ipv6=0>>/etc/sysctl.confsysctl-p>>${LOCK}2>&1cat/etc/sysctl.conf>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}disable_cad(){echo"=============disablecad=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"systemctlmaskctrl-alt-del.target>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}remove_users(){echo"=============removeusers=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"foruinadmlpsyncshutdownhaltmailoperatorgamesftpdouserdel${u}>>${LOCK}2>&1donecut-d:-f1/etc/passwd>>${LOCK}2>&1forginadmlpmailgamesftpdogroupdel${g}>>${LOCK}2>&1donecat/etc/group>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}sys_permissions(){echo"=============syspermissions=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"chmod644/etc/passwd>>${LOCK}2>&1chmod644/etc/group>>${LOCK}2>&1chmod000/etc/shadow>>${LOCK}2>&1chmod000/etc/gshadow>>${LOCK}2>&1ls-la/etc/passwd>>${LOCK}2>&1ls-la/etc/group>>${LOCK}2>&1ls-la/etc/shadow>>${LOCK}2>&1ls-la/etc/gshadow>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}password_policy(){echo"=============passwordpolicy=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"sed-is/^PASS_MAX_DAYS.*$/PASS_MAX_DAYS90//etc/login.defssed-is/^PASS_MIN_DAYS.*$/PASS_MIN_DAYS10//etc/login.defscat/etc/login.defs>>${LOCK}2>&1cat>>/etc/security/pwquality.conf<<EOFminlen=8dcredit=-1ucredit=-1ocredit=-1lcredit=-1EOFecho-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}change_useradd(){echo"=============changeuseradd=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"sed-is/^INACTIVE.*$/INACTIVE=180//etc/default/useraddcat/etc/default/useradd>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}sec_ssh(){echo"=============secssh=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"sed-is/UseDNS.*$/UseDNSno//etc/ssh/sshd_configsed-is/^#LoginGraceTime.*$/LoginGraceTime60//etc/ssh/sshd_configsed-is/^#PermitEmptyPasswords.*$/PermitEmptyPasswordsno//etc/ssh/sshd_configsed-is/^#PubkeyAuthentication.*$/PubkeyAuthenticationyes//etc/ssh/sshd_configsed-is/^#MaxAuthTries.*$/MaxAuthTries3//etc/ssh/sshd_configsed-i"s/#ClientAliveInterval0/ClientAliveInterval30/g"/etc/ssh/sshd_configsed-i"s/#ClientAliveCountMax3/ClientAliveCountMax3/g"/etc/ssh/sshd_configsed-i"s/X11Forwardingyes/X11Forwardingno/g"/etc/ssh/sshd_configsed-i"s/#Bannernone/Banner\/etc\/issue.net/g"/etc/ssh/sshd_configecho"Authorizedusersonly.Allactivitymaybemonitoredandreported.">/etc/issue.netsystemctlrestartsshd.service>>${LOCK}2>&1cat/etc/ssh/sshd_config>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}timeout_config(){echo"=============timeoutconfig=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"echo"exportTMOUT=1800">>/etc/profile.d/centos7init.shcat/etc/profile.d/centos7init.sh>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}lockout_policy(){echo"=============lockoutpolicy=============">>${LOCK}2>&1echo-en"${RGB_WAIT}Configuring...${RGB_END}"[!-e"/etc/pam.d/system-auth_bak"]&&/bin/mv/etc/pam.d/system-auth{,_bak}cat>/etc/pam.d/system-auth<<EOFauthrequiredpam_env.soauthrequiredpam_faillock.sopreauthsilentauditdeny=3unlock_time=300authrequiredpam_faildelay.sodelay=2000000auth[default=1ignore=ignoresuccess=ok]pam_succeed_if.souid>=1000quietauth[default=1ignore=ignoresuccess=ok]pam_localuser.soauthsufficientpam_unix.sonulloktry_first_passauth[default=die]pam_faillock.soauthfailauditdeny=3unlock_time=300authrequisitepam_succeed_if.souid>=1000quiet_successauthsufficientpam_sss.soforward_passauthrequiredpam_deny.soaccountrequiredpam_unix.soaccountsufficientpam_localuser.soaccountsufficientpam_succeed_if.souid<1000quietaccount[default=badsuccess=okuser_unknown=ignore]pam_sss.soaccountrequiredpam_permit.soaccountrequiredpam_faillock.sopasswordrequisitepam_pwquality.sotry_first_passlocal_users_onlypasswordsufficientpam_unix.sosha512shadownulloktry_first_passuse_authtokpasswordsufficientpam_sss.souse_authtokpasswordrequiredpam_deny.sosessionoptionalpam_keyinit.sorevokesessionrequiredpam_limits.so-sessionoptionalpam_systemd.sosession[success=1default=ignore]pam_succeed_if.soserviceincrondquietuse_uidsessionrequiredpam_unix.sosessionoptionalpam_sss.soEOF[!-e"/etc/pam.d/password-auth_bak"]&&/bin/mv/etc/pam.d/password-auth{,_bak}cat>/etc/pam.d/password-auth<<EOFauthrequiredpam_env.soauthrequiredpam_faillock.sopreauthsilentauditdeny=3unlock_time=300authrequiredpam_faildelay.sodelay=2000000auth[default=1ignore=ignoresuccess=ok]pam_succeed_if.souid>=1000quietauth[default=1ignore=ignoresuccess=ok]pam_localuser.soauthsufficientpam_unix.sonulloktry_first_passauth[default=die]pam_faillock.soauthfailauditdeny=3unlock_time=300authrequisitepam_succeed_if.souid>=1000quiet_successauthsufficientpam_sss.soforward_passauthrequiredpam_deny.soaccountrequiredpam_unix.soaccountsufficientpam_localuser.soaccountsufficientpam_succeed_if.souid<1000quietaccount[default=badsuccess=okuser_unknown=ignore]pam_sss.soaccountrequiredpam_permit.soaccountrequiredpam_faillock.sopasswordrequisitepam_pwquality.sotry_first_passlocal_users_onlypasswordsufficientpam_unix.sosha512shadownulloktry_first_passuse_authtokpasswordsufficientpam_sss.souse_authtokpasswordrequiredpam_deny.sosessionoptionalpam_keyinit.sorevokesessionrequiredpam_limits.so-sessionoptionalpam_systemd.sosession[success=1default=ignore]pam_succeed_if.soserviceincrondquietuse_uidsessionrequiredpam_unix.sosessionoptionalpam_sss.soEOFsystemctlrestartsshd.service>>${LOCK}2>&1cat/etc/pam.d/etc/pam.d/system-auth>>${LOCK}2>&1cat/etc/pam.d/password-auth>>${LOCK}2>&1echo-e"\r${RGB_SUCCESS}ConfigurationSuccess${RGB_END}"}reboot_os(){echo-e"\n${RGB_WARNING}Pleaserestarttheserverandseeiftheservicesstartupfine.${RGB_END}"echo-en"${RGB_WARNING}DoyouwanttorestartOS?[y/n]:${RGB_END}"while:;doreadREBOOT_STATUSif[[!"${REBOOT_STATUS}"=~^[y,n]$]];thenecho-en"${RGB_DANGER}Inputerror,pleaseonlyinputyorn:${RGB_END}"elsebreakfidone["${REBOOT_STATUS}"==y]&&reboot}main(){echo-e"\n${RGB_INFO}1/18:StartInitCentOS7Script${RGB_END}"echo-e"\n${RGB_INFO}2/18:Customizetheprofile(colorandalias)${RGB_END}"custom_profileecho-e"\n${RGB_INFO}3/18:Timezoneadjustment${RGB_END}"time_zoneecho-e"\n${RGB_INFO}4/18:Disableselinuxandfirewalld${RGB_END}"disable_softwareecho-e"\n${RGB_INFO}5/18:DisableCtrl Alt Del${RGB_END}"disable_cadecho-e"\n${RGB_INFO}6/18:Kernelparameteroptimization${RGB_END}"kernel_optimumecho-e"\n${RGB_INFO}7/18:Theupdatedboptimization${RGB_END}"updatedb_optimumecho-e"\n${RGB_INFO}8/18:Addingswapspace${RGB_END}"new_swapecho-e"\n${RGB_INFO}9/18:Adjustmentofulimit${RGB_END}"adjust_ulimitecho-e"\n${RGB_INFO}10/18:Enabletcpbbrcongestioncontrolalgorithm${RGB_END}"open_bbrecho-e"\n${RGB_INFO}11/18:EnableIPV6${RGB_END}"open_ipv6echo-e"\n${RGB_INFO}12/18:Removeunnecessaryusersandusergroupsfromthesystem${RGB_END}"remove_usersecho-e"\n${RGB_INFO}13/18:Systempermissionsforsensitivefiles${RGB_END}"sys_permissionsecho-e"\n${RGB_INFO}14/18:ModifyAccountPasswordSurvivalPolicy${RGB_END}"password_policyecho-e"\n${RGB_INFO}15/18:Maximumnumberofdaysanaccountisvalidafterpasswordexpirationstrategy${RGB_END}"change_useraddecho-e"\n${RGB_INFO}16/18:SecureconfigurationofSSH${RGB_END}"sec_sshecho-e"\n${RGB_INFO}17/18:TimeoutAuto-LogoutConfiguration${RGB_END}"timeout_configecho-e"\n${RGB_INFO}18/18:Configureaccountloginfailurelockoutpolicy${RGB_END}"lockout_policyreboot_os}cleartool_infocheck_rootcheck_oscheck_lockmain

测试执行截图如下

再次执行脚本会提示已经做了安全加固优化，无须再次执行