ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# 禁用系统不需要的账户USERS_TO_DISABLE="games news uucp operator gopher"for user in $USERS_TO_DISABLE;doif id "$user">/dev/null2>&1;then        usermod -L "$user"        usermod -s /sbin/nologin "$user"        echo "已禁用账户: $user"fidone# 检查空密码账户awk -F:'($2 == "") {print "警告: " $1 " 账户密码为空"}'/etc/shadow

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 创建具有sudo权限的普通用户useradd -m -s /bin/bash -G wheel secadminpasswd secadmin# 配置sudo免密（谨慎使用）echo "secadmin ALL=(ALL) NOPASSWD:ALL">>/etc/sudoers.d/secadminchmod 440/etc/sudoers.d/secadmin

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/login.defs 密码策略配置PASS_MAX_DAYS   90# 密码最大有效期PASS_MIN_DAYS   7# 密码最小更改间隔PASS_MIN_LEN    12# 最小密码长度PASS_WARN_AGE   14# 密码过期警告天数# 安装并配置 pam_pwqualityyum install -y libpwqualityecho "password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1">>/etc/pam.d/system-auth

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 配置登录失败锁定cat >>/etc/pam.d/sshd << EOFauth required pam_tally2.so deny=5 unlock_time=300 even_deny_root root_unlock_time=300account required pam_tally2.soEOF# 查看被锁定的账户pam_tally2 --user=username# 解锁账户pam_tally2 --user=username --reset

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/ssh/sshd_config 安全配置Port2022# 更改默认端口Protocol2# 使用SSH协议版本2PermitRootLoginno# 禁止root直接登录PasswordAuthenticationno# 禁用密码认证PubkeyAuthentication yes           # 启用公钥认证AuthorizedKeysFile.ssh/authorized_keysMaxAuthTries3# 最大认证尝试次数MaxSessions2# 最大会话数ClientAliveInterval300# 客户端存活检测间隔ClientAliveCountMax2# 最大存活检测次数AllowUsers secadmin developer      # 仅允许特定用户登录DenyUsers root guest               # 拒绝特定用户登录

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 在客户端生成密钥对ssh-keygen -t ed25519 -b 4096-f ~/.ssh/id_ed25519 -N ""# 复制公钥到服务器ssh-copy-id -i ~/.ssh/id_ed25519.pub secadmin@server_ip# 服务器端设置正确权限chmod 700~/.sshchmod 600~/.ssh/authorized_keyschown -R secadmin:secadmin ~/.ssh

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# SSH登录监控和告警脚本LOG_FILE="/var/log/secure"ALERT_EMAIL="admin@company.com"# 监控SSH登录失败tail -f $LOG_FILE |while read line;doif echo "$line"| grep -q "Failed password";then        IP=$(echo "$line"| awk '{print $11}')        USER=$(echo "$line"| awk '{print $9}')        echo "SSH登录失败: $USER from $IP"| mail -s "SSH Security Alert" $ALERT_EMAIL# 自动封禁多次失败的IP        FAIL_COUNT=$(grep "Failed password" $LOG_FILE | grep "$IP"| wc -l)if[ $FAIL_COUNT -gt 5];then            iptables -A INPUT -s $IP -j DROP            echo "已封禁IP: $IP"fifidone

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# iptables安全配置脚本# 清空现有规则iptables -Fiptables -Xiptables -t nat -Fiptables -t nat -X# 设置默认策略iptables -P INPUT DROPiptables -P FORWARD DROPiptables -P OUTPUT ACCEPT# 允许本地回环iptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT# 允许已建立的连接iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# 允许SSH（自定义端口）iptables -A INPUT -p tcp --dport 2022-j ACCEPT# 允许HTTP和HTTPSiptables -A INPUT -p tcp --dport 80-j ACCEPTiptables -A INPUT -p tcp --dport 443-j ACCEPT# 防DDoS规则iptables -A INPUT -p tcp --dport 80-m limit --limit 25/minute --limit-burst 100-j ACCEPT

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 启用firewalldsystemctl enable --now firewalld# 配置默认区域firewall-cmd --set-default-zone=public# 添加服务规则firewall-cmd --permanent --zone=public--add-service=sshfirewall-cmd --permanent --zone=public--add-service=httpfirewall-cmd --permanent --zone=public--add-service=https# 自定义端口规则firewall-cmd --permanent --zone=public--add-port=2022/tcp# 限制SSH访问源firewall-cmd --permanent --zone=public--add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept'# 重载配置firewall-cmd --reload

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# 系统关键文件权限检查check_file_permissions(){local file=$1local expected_perm=$2local current_perm=$(stat -c "%a""$file"2>/dev/null)if["$current_perm"!="$expected_perm"];then        echo "警告: $file 权限异常，当前: $current_perm, 期望: $expected_perm"        chmod $expected_perm "$file"        echo "已修复: $file 权限设置为 $expected_perm"fi}# 检查关键系统文件权限check_file_permissions "/etc/passwd""644"check_file_permissions "/etc/shadow""600"check_file_permissions "/etc/group""644"check_file_permissions "/etc/gshadow""600"check_file_permissions "/etc/ssh/sshd_config""600"# 查找危险权限文件find /-type f \( -perm -4000-o -perm -2000 \) -exec ls -lg {} \; 2>/dev/null| head -20

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/fstab 安全挂载选项/dev/sda1 /home ext4 defaults,nodev,nosuid,noexec 02/dev/sda2 /tmp ext4 defaults,nodev,nosuid,noexec 02/dev/sda3 /var/log ext4 defaults,nodev,nosuid,noexec 02# 创建加密分区cryptsetup luksFormat /dev/sdb1cryptsetup luksOpen /dev/sdb1 encrypted_diskmkfs.ext4 /dev/mapper/encrypted_disk

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# 服务安全检查和加固脚本# 停用不必要的服务DISABLE_SERVICES="telnet rsh rlogin ypbind tftp talk ntalk"for service in $DISABLE_SERVICES;doif systemctl is-enabled $service >/dev/null2>&1;then        systemctl disable --now $service        echo "已停用服务: $service"fidone# 检查监听端口echo "=== 当前监听端口 ==="netstat -tlnp | grep LISTEN# 检查运行的服务echo "=== 运行中的服务 ==="systemctl list-units --type=service --state=running | grep -v "systemd"

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/nginx/nginx.conf 安全配置http {# 隐藏版本信息    server_tokens off;# 安全头设置    add_header X-Frame-Options DENY;    add_header X-Content-Type-Options nosniff;    add_header X-XSS-Protection"1; mode=block";    add_header Strict-Transport-Security"max-age=31536000; includeSubDomains";# 限制请求大小    client_max_body_size 10M;    client_body_buffer_size 128k;# 连接限制    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;    server {        listen 443 ssl http2;# SSL安全配置        ssl_protocols TLSv1.2TLSv1.3;        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;        ssl_prefer_server_ciphers off;# 应用限制        limit_conn conn_limit_per_ip 10;        limit_req zone=req_limit_per_ip burst=10 nodelay;}}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/rsyslog.conf 日志配置# 启用安全相关日志auth,authpriv.*/var/log/auth.logkern.*/var/log/kern.logmail.*/var/log/mail.log# 远程日志发送（可选）*.*@@log-server.company.com:514# 日志轮转配置cat >/etc/logrotate.d/security << EOF/var/log/auth.log {    daily    missingok    rotate 52    compress    delaycompress    notifempty    create 0640 syslog adm}EOF

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 安装和配置AIDEyum install -y aideaide --initmv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz# 定期完整性检查cat >/etc/cron.daily/aide-check <<'EOF'#!/bin/bashAIDE_REPORT=/tmp/aide_report_$(date +%Y%m%d)aide --check > $AIDE_REPORT 2>&1if[ $?-ne 0];then    mail -s "AIDE检测到系统变化" admin@company.com < $AIDE_REPORTfiEOFchmod +x /etc/cron.daily/aide-check

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# /etc/sysctl.conf 安全参数配置# 禁用IP转发net.ipv4.ip_forward =0net.ipv6.conf.all.forwarding =0# 禁用ICMP重定向net.ipv4.conf.all.accept_redirects =0net.ipv6.conf.all.accept_redirects =0net.ipv4.conf.all.send_redirects =0# 启用反向路径过滤net.ipv4.conf.all.rp_filter =1net.ipv4.conf.default.rp_filter =1# 防SYN洪水攻击net.ipv4.tcp_syncookies =1net.ipv4.tcp_max_syn_backlog =2048net.ipv4.tcp_synack_retries =2# 忽略ping请求net.ipv4.icmp_echo_ignore_all =1# 应用配置sysctl -p

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 限制core dumpecho "* soft core 0">>/etc/security/limits.confecho "* hard core 0">>/etc/security/limits.conf# 进程数量限制echo "* soft nproc 65536">>/etc/security/limits.confecho "* hard nproc 65536">>/etc/security/limits.conf# 内存随机化echo 2>/proc/sys/kernel/randomize_va_space

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# Linux系统安全检查脚本REPORT_FILE="/tmp/security_report_$(date +%Y%m%d).txt"echo "=== Linux系统安全检查报告 ==="> $REPORT_FILEecho "检查时间: $(date)">> $REPORT_FILEecho "">> $REPORT_FILE# 检查用户登录echo "=== 近期登录用户 ===">> $REPORT_FILElast-10>> $REPORT_FILE# 检查sudo使用记录echo "=== sudo使用记录 ===">> $REPORT_FILEgrep sudo /var/log/auth.log | tail -10>> $REPORT_FILE# 检查进程状态echo "=== 可疑进程检查 ===">> $REPORT_FILEps aux | awk '{print $1, $2, $11}'| grep -v "^\["| sort | uniq -c | sort -nr | head -20>> $REPORT_FILE# 检查网络连接echo "=== 网络连接状态 ===">> $REPORT_FILEnetstat -tupln | grep LISTEN >> $REPORT_FILE# 发送报告mail -s "每日安全检查报告" admin@company.com < $REPORT_FILE

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# CIS基准检查脚本片段check_password_policy(){    echo "检查密码策略..."if grep -q "PASS_MAX_DAYS.*90"/etc/login.defs;then        echo "✓ 密码最大有效期配置正确"else        echo "✗ 密码最大有效期配置异常"fi}check_ssh_config(){    echo "检查SSH配置..."if grep -q "^PermitRootLogin no"/etc/ssh/sshd_config;then        echo "✓ SSH禁止root登录配置正确"else        echo "✗ SSH允许root登录，存在安全风险"fi}# 执行检查check_password_policycheck_ssh_config

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# 安全事件应急响应脚本isolate_system(){    echo "系统隔离中..."# 断开网络（保留SSH管理）    iptables -P INPUT DROP    iptables -P FORWARD DROP    iptables -A INPUT -p tcp --dport 2022-s 192.168.1.100-j ACCEPT    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# 停止非必要服务    systemctl stop httpd nginx mysql    echo "系统已隔离，仅保留管理访问"}collect_evidence(){    EVIDENCE_DIR="/tmp/incident_$(date +%Y%m%d_%H%M%S)"    mkdir -p $EVIDENCE_DIR# 收集系统信息    ps aux > $EVIDENCE_DIR/processes.txt    netstat -tupln > $EVIDENCE_DIR/network.txt    lsof > $EVIDENCE_DIR/openfiles.txt# 收集日志    cp /var/log/auth.log $EVIDENCE_DIR/    cp /var/log/messages $EVIDENCE_DIR/    echo "证据收集完成: $EVIDENCE_DIR"}# 使用示例# isolate_system# collect_evidence

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/bin/bash# Linux服务器安全加固一键脚本set-eSCRIPT_NAME="Linux Security Hardening"LOG_FILE="/var/log/security_hardening.log"log(){    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"| tee -a $LOG_FILE}log "开始执行 $SCRIPT_NAME"# 1. 更新系统log "更新系统软件包..."yum update -y >> $LOG_FILE 2>&1# 2. 配置SSHlog "配置SSH安全设置..."cp /etc/ssh/sshd_config /etc/ssh/sshd_config.baksed -i 's/#Port 22/Port 2022/'/etc/ssh/sshd_configsed -i 's/#PermitRootLogin yes/PermitRootLogin no/'/etc/ssh/sshd_configsystemctl restart sshd# 3. 配置防火墙log "配置防火墙规则..."systemctl enable --now firewalldfirewall-cmd --permanent --remove-service=sshfirewall-cmd --permanent --add-port=2022/tcpfirewall-cmd --reloadlog "安全加固完成！请检查日志文件: $LOG_FILE"

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 安全监控数据收集脚本#!/bin/bash# 收集安全指标数据，用于可视化展示METRICS_FILE="/var/log/security_metrics.json"{    echo "{"    echo "  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\","    echo "  \"failed_logins\": $(grep "Failed password" /var/log/auth.log | wc -l),"    echo "  \"active_connections\": $(netstat -tn | grep :22 | wc -l),"    echo "  \"suspicious_processes\": $(ps aux | grep -E "(nc|wget|curl)" | wc -l),"    echo "  \"disk_usage\": $(df / | awk 'NR==2 {print $5}' | sed 's/%//'),"    echo "  \"load_average\": \"$(uptime | awk -F'load average:' '{print $2}')\""    echo "}"}> $METRICS_FILE