服务器修复
主要服务器漏洞展示
未禁用sync、shutdown、halt默认账户。
未创建系统管理员、审计管理员、安全管理员账户
设置系统管理员
# 设置系统管理员及密码
[root@localhost ~]# useradd systemgm
[root@localhost ~]# passwd systemgm
Changing password for user systemgm.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
password： MM@manager123.com
# 创建组并将用户添加到组（/var是要给用户权限访问的路径），并设置目录权限。
[root@localhost ~]# groupadd sysgroup
[root@localhost ~]# usermod -G sysgroup systemgm
[root@localhost ~]# chown -R systemgm:sysgroup /var
[root@localhost ~]# chmod 741 /var
设置安全管理员
# 创建用户并指定登录的起始目录
adduser anquangm
usermod -d /etc anquangm
[root@localhost ~]# sudo useradd -d /etc anquangm
[root@localhost ~]# passwd anquangm
password：M1a2n3q4u5a6n7M
[root@localhost ~]# groupadd anquangroup
[root@localhost ~]# usermod -G anquangroup anquangm
[root@localhost ~]# chown -R anquangm:anquangroup /etc
[root@localhost ~]# chmod 700 /etc
设置审计管理员
[root@localhost ~]# useradd shenjigm
[root@localhost ~]# passwd shenjigm
# 设置shenji用户只有sudo的查看权限
# 编辑/etc/sudoers
shenjigm ALL = (root) NOPASSWD: /usr/bin/cat , /usr/bin/less , /usr/bin/more , /usr/bin/tail , /usr/bin/head
# 设置只能shenji用户访问/var/log，配置目录权限
[root@localhost ~]# groupadd shenjigmGroup
[root@localhost ~]# usermod -G shenjigmGroup shenjigm
[root@localhost ~]# chown -R shenjigm:shenjigmGroup /var/log
[root@localhost ~]# chmod 700 /var/log
chown -R root:root /var
chown -R root:root /etc
chown -R root:root /var/log
chmod 775 /var
chmod 775 /etc
chmod 775 /var/log
OpenSSH升级报错排查
https://blog.csdn.net/TZ_GG/article/details/100888723
配置PASS_MAX_DAYS 99999、PASS_MIN_LEN 5
在/etc/login.defs中进行配置，修改后对新创建的用户生效
未配置TMOUT值
配置HISTSIZE=0
未配置登录失败/密码复杂度策略
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
auth required pam_tally2.so onerr=fail deny=5 unlock_time=300 even_deny_root unlock_time=300
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so
password requisite pam_cracklib.so retry=5 difok=3 minlen=8 ucredit=-1 lcredit=-3 dcredit=-3
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
umask值022配置为027
[root@localhost ~]# umask
0022
[root@localhost ~]# umask 027
[root@localhost ~]# umask
0027
[root@localhost ~]#
可以参考
https://blog.csdn.net/m0_57485346/article/details/129823602