181 lines
9.8 KiB
Bash
181 lines
9.8 KiB
Bash
|
||
#!/bin/bash
|
||
##############################################################################################################################
|
||
#脚本功能：
|
||
#1.口令定期更换策略设置个90天，最小密码长度为8位，密码过期警告提前7天。
|
||
#2.口令复杂度设置：密码长度至少为12位，包含至少四种字符类型（大写字母、小写字母、数字、特殊字符）。
|
||
#3.登录失败处理策略设置：登录失败次数为5次，锁定时间为10分钟。
|
||
#4.登录连接超时默认配置设置：登录连接超时时间为10分钟。
|
||
#5.日志本地保存时间设置为6个月。
|
||
#6.禁止root ssh远程登录
|
||
#7.启动日志与审计服务rsyslog和auditd
|
||
#8.sshd开启PAM认证
|
||
#9.安装系统工具
|
||
##############################################################################################################################
|
||
# 定义新的配置参数
|
||
LOGIN_DEFS_POLICY_MAX_DAYS="PASS_MAX_DAYS 90"
|
||
LOGIN_DEFS_POLICY_MIN_DAYS="PASS_MIN_DAYS 0"
|
||
LOGIN_DEFS_POLICY_MIN_LEN="PASS_MIN_LEN 8"
|
||
LOGIN_DEFS_POLICY_WARN_AGE="PASS_WARN_AGE 7"
|
||
# 编辑/etc/login.defs配置文件
|
||
echo "正在编辑 /etc/login.defs 文件..."
|
||
# 检查并替换或添加设置
|
||
if grep -q "^PASS_MAX_DAYS" /etc/login.defs; then
|
||
sed -i "s/^PASS_MAX_DAYS.*/${LOGIN_DEFS_POLICY_MAX_DAYS}/" /etc/login.defs
|
||
fi
|
||
|
||
if grep -q "^PASS_MIN_DAYS" /etc/login.defs; then
|
||
sed -i "s/^PASS_MIN_DAYS.*/${LOGIN_DEFS_POLICY_MIN_DAYS}/" /etc/login.defs
|
||
fi
|
||
|
||
if grep -q "^PASS_MIN_LEN" /etc/login.defs; then
|
||
sed -i "s/^PASS_MIN_LEN.*/${LOGIN_DEFS_POLICY_MIN_LEN}/" /etc/login.defs
|
||
fi
|
||
|
||
if grep -q "^PASS_WARN_AGE" /etc/login.defs; then
|
||
sed -i "s/^PASS_WARN_AGE.*/${LOGIN_DEFS_POLICY_WARN_AGE}/" /etc/login.defs
|
||
fi
|
||
|
||
# 编辑/etc/security/pwquality.conf配置文件口令复杂度
|
||
PWQUALITY_POLICY_MINLEN="minlen = 12"
|
||
PWQUALITY_POLICY_MINCLASS="minclass = 4"
|
||
PWQUALITY_POLICY_DCREDIT="dcredit = -1"
|
||
PWQUALITY_POLICY_UCREDIT="ucredit = -1"
|
||
PWQUALITY_POLICY_LCREDIT="lcredit = -1"
|
||
PWQUALITY_POLICY_OCREDIT="ocredit = -1"
|
||
PWQUALITY_POLICY_FOR_ROOT="enforce_for_root"
|
||
PWQUALITY_POLICY_DIFOK="difok = 5"
|
||
|
||
echo "正在编辑 /etc/security/pwquality.conf 文件配置文件口令复杂度"
|
||
if grep -q "^minlen" /etc/security/pwquality.conf; then
|
||
sed -i "s/^minlen.*/${PWQUALITY_POLICY_MINLEN}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# minlen" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# minlen.*/${PWQUALITY_POLICY_MINLEN}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^minclass" /etc/security/pwquality.conf; then
|
||
sed -i "s/^minclass.*/${PWQUALITY_POLICY_MINCLASS}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# minclass" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# minclass.*/${PWQUALITY_POLICY_MINCLASS}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^dcredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^dcredit.*/${PWQUALITY_POLICY_DCREDIT}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# dcredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# dcredit.*/${PWQUALITY_POLICY_DCREDIT}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^ucredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^ucredit.*/${PWQUALITY_POLICY_UCREDIT}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# ucredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# ucredit.*/${PWQUALITY_POLICY_UCREDIT}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^lcredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^lcredit.*/${PWQUALITY_POLICY_LCREDIT}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# lcredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# lcredit.*/${PWQUALITY_POLICY_LCREDIT}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^ocredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^ocredit.*/${PWQUALITY_POLICY_OCREDIT}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# ocredit" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# ocredit.*/${PWQUALITY_POLICY_OCREDIT}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^enforce_for_root" /etc/security/pwquality.conf; then
|
||
:
|
||
elif grep -q "^# enforce_for_root" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# enforce_for_root/${PWQUALITY_POLICY_FOR_ROOT}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
if grep -q "^difok" /etc/security/pwquality.conf; then
|
||
sed -i "s/^difok.*/${PWQUALITY_POLICY_DIFOK}/" /etc/security/pwquality.conf
|
||
elif grep -q "^# difok.*" /etc/security/pwquality.conf; then
|
||
sed -i "s/^# difok.*/${PWQUALITY_POLICY_DIFOK}/" /etc/security/pwquality.conf
|
||
fi
|
||
|
||
# 执行以下命令，来更新`system-auth`和`password-auth`文件
|
||
egrep -q "^\s*password\s+requisite\s+pam_pwquality.so\s+" /etc/pam.d/system-auth && sed -ri '/^\s*password\s+requisite\s+pam_pwquality.so\s+/ { /^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*(\s+try_first_pass)(\s+.*)?$/! s/^(\s*password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1try_first_pass \2/ }' /etc/pam.d/system-auth && sed -ri '/^\s*password\s+requisite\s+pam_pwquality.so\s+/ { /^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*(\s+retry=[0-9]+)(\s+.*)?$/! s/^(\s*password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1retry=5 \2/ }' /etc/pam.d/system-auth && sed -ri "s/(^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*\s+)retry=[0-9]+(\s+.*)?$/\1retry=5\3/" /etc/pam.d/system-auth
|
||
sleep 2s
|
||
egrep -q "^\s*password\s+requisite\s+pam_pwquality.so\s+" /etc/pam.d/password-auth && sed -ri '/^\s*password\s+requisite\s+pam_pwquality.so\s+/ { /^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*(\s+try_first_pass)(\s+.*)?$/! s/^(\s*password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1try_first_pass \2/ }' /etc/pam.d/password-auth && sed -ri '/^\s*password\s+requisite\s+pam_pwquality.so\s+/ { /^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*(\s+retry=[0-9]+)(\s+.*)?$/! s/^(\s*password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1retry=5 \2/ }' /etc/pam.d/password-auth && sed -ri "s/(^\s*password\s+requisite\s+pam_pwquality.so(\s+\S+)*\s+)retry=[0-9]+(\s+.*)?$/\1retry=5\3/" /etc/pam.d/password-auth
|
||
|
||
# 密码验证失败处理策略
|
||
echo "正在编辑 /etc/pam.d/password-auth 文件配置密码验证失败处理策略"
|
||
if grep -Pq "^auth\s*required\s*pam_faillock.so\s*authfail\s*even_deny_root\s*deny=5\s*unlock_time=600\s*$" /etc/pam.d/system-auth; then
|
||
:
|
||
else
|
||
sed -ri "/^auth.*pam_env.so$/i auth required pam_faillock.so preauth silent even_deny_root deny=5 unlock_time=600\nauth required pam_faillock.so authfail even_deny_root deny=5 unlock_time=600" /etc/pam.d/system-auth
|
||
fi
|
||
|
||
if grep -Pq "^auth\s*required\s*pam_faillock.so\s*authfail\s*even_deny_root\s*deny=5\s*unlock_time=600\s*$" /etc/pam.d/password-auth; then
|
||
:
|
||
else
|
||
sed -ri "/^auth.*pam_env.so$/i auth required pam_faillock.so preauth silent even_deny_root deny=5 unlock_time=600\nauth required pam_faillock.so authfail even_deny_root deny=5 unlock_time=600" /etc/pam.d/password-auth
|
||
fi
|
||
|
||
|
||
# 终端超时自动登出设置要求针对所有用户，自动登退时间为600s
|
||
echo "正在编辑 /etc/profile 文件配置终端超时自动登出设置要求针对所有用户，自动登退时间为600s"
|
||
if grep -q "^export TMOUT" /etc/profile; then
|
||
sed -i "s/^export TMOUT.*/export TMOUT=600/" /etc/profile
|
||
else
|
||
echo "export TMOUT=600" >> /etc/profile
|
||
fi
|
||
|
||
# 设置日志本地保存时间6个月
|
||
echo "正在编辑 /etc/logrotate.conf 文件设置日志本地保存时间6个月"
|
||
if grep -q "^rotate" /etc/logrotate.conf; then
|
||
sed -i "s/rotate.*/rotate 26/" /etc/logrotate.conf
|
||
fi
|
||
|
||
# 禁止root ssh远程登录
|
||
echo "正在编辑 /etc/ssh/sshd_config 文件禁止root ssh远程登录"
|
||
if grep -q "^PermitRootLogin" /etc/ssh/sshd_config; then
|
||
sed -i "s/^PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config
|
||
else
|
||
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
|
||
fi
|
||
|
||
if grep -q "^PubkeyAuthentication" /etc/ssh/sshd_config; then
|
||
sed -i "s/^PubkeyAuthentication.*/PubkeyAuthentication yes/" /etc/ssh/sshd_config
|
||
else
|
||
sed -i "s/^#PubkeyAuthentication.*/PubkeyAuthentication yes/" /etc/ssh/sshd_config
|
||
fi
|
||
# 禁用 ssh DNS 解析
|
||
if grep -q "^UseDNS" /etc/ssh/sshd_config; then
|
||
sed -i "s/^UseDNS.*/UseDNS no/" /etc/ssh/sshd_config
|
||
else
|
||
sed -i "s/^#UseDNS.*/UseDNS no/" /etc/ssh/sshd_config
|
||
fi
|
||
# 开启ssh PAM认证
|
||
if grep -q "^UsePAM" /etc/ssh/sshd_config; then
|
||
sed -i "s/^UsePAM.*/UsePAM yes/" /etc/ssh/sshd_config
|
||
else
|
||
sed -i "s/^#UsePAM.*/UsePAM yes/" /etc/ssh/sshd_config
|
||
fi
|
||
|
||
# 重启sshd服务,生效配置
|
||
echo "正在重启sshd服务....."
|
||
if grep -Pq '^PubkeyAuthentication yes' /etc/ssh/sshd_config;then
|
||
systemctl restart sshd
|
||
fi
|
||
sleep 2s
|
||
# 开启rsyslog服务，开启auditd服务
|
||
echo "正在启动rsyslog和auditd服务"
|
||
systemctl restart rsyslog.service
|
||
systemctl start rsyslog.service && systemctl enable rsyslog.service
|
||
sleep 2s
|
||
systemctl start auditd.service && systemctl enable auditd.service
|
||
echo "请自行修改操作系统默认密码。并做好密码保存。"
|
||
echo "已禁止root ssh远程登录，请使用scloudadmin账号登录，如无法登录请通过ipmi远程控制登录"
|
||
|
||
#9.安装系统工具
|
||
echo "安装sysstat ipmitool vim pciutils net-tools工具包"
|
||
dnf -y install sysstat.x86_64
|
||
dnf -y install ipmitool.x86_64
|
||
dnf -y install vim
|
||
dnf -y install pciutils.x86_64
|
||
dnf -y install net-tools.x86_64
|
||
echo "所有操作已完成。"
|