龙空技术网

linux主机安全记录配置

lisanmengmeng 213

前言:

现时你们对“centos62密码破解”都比较重视,各位老铁们都想要分析一些“centos62密码破解”的相关资讯。那么小编也在网上搜集了一些关于“centos62密码破解””的相关知识,希望同学们能喜欢,看官们快快来了解一下吧!

一:配置只读账号

#!/bin/bashif [ $# -lt 1 ]  then   echo "Usage `basename $0` user_name user_pwd"   exit 1fiuser_name="$1"user_pwd="$2"#judeif [ -e "/home/${user_name}" ] then   echo "ERROR ${user_name} exist!"   exit 1fiif [ -e "/var/spool/mail/${user_name}" ]  then   cd /var/spool/mail   /bin/rm -rf /var/spool/mail/${user_name}fiif [ ! -e "/bin/rbash" ] then   ln -s /bin/bash  /bin/rbashfi#nameuseradd -s /bin/rbash ${user_name}#pwdif [ "${user_pwd}" = "" ] then   echo ${user_name}:`echo ${user_name}|md5sum|cut -b 4-11`|chpasswd   echo "PASSWD: `echo ${user_name}|md5sum|cut -b 4-11`"else   echo ${user_name}:${user_pwd}|chpasswd   echo "PASSWD: ${user_pwd}"fi#dirmkdir /home/${user_name}/bin#change PATHsed -i "/PATH\=/d" /home/${user_name}/.bash_profilesed -i "/PATH/iPATH\=\$HOME\/bin" /home/${user_name}/.bash_profile#chownchown root. /home/${user_name}/.bash_profile#chmodchmod 755 /home/${user_name}/.bash_profile#path#cmdcmd_list="ls cat more"for i in `echo $cmd_list`do  ln -s /bin/${i}  /home/${user_name}/bin/${i}doneexit

二:pam_tally2

1. 查看用户被锁情况

pam_tally2 --user user02

2.解锁用户

pam_tall2 -r -u user02

3.配置文件

/etc/pam.d/sshd

參數說明:

deny=n 代表拒絕存取,如果超過n次

lock_time=n 代表1次失敗後就鎖n秒

unlock_time=n 代表幾次失敗就鎖n秒,搭配deny=2就是兩次失敗就鎖n秒

even_deny_root 代表也限制root帳號

root_unlock_time=n 這個跟unlcok_time一樣,只是這只給root帳號用,如果要區別一般帳號的話,就可以額外作這個限制

三:检测账号最近登录情况

for i in `cat /etc/passwd|awk -F\: '{print $1}'`;do echo $i;last $i|grep -v wtmp|tail -2;done

四:密码复杂度配置及登录失败配置

centos 7

vi /etc/pam.d/system-auth

password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2

password requisite pam_cracklib.so retry=5 difok=3 minlen=10 ucredit=-1 lcredit=-3 dcredit=-3 dictpath=/usr/share/cracklib/pw_dict

参数含义:

尝试次数:5 ;最少不同字符:3 ;最小密码长度:10 ;最少大写字母:1;最少小写字母:3 ;最少数字:3 ;字典位置:/usr/share/cracklib/pw_dict

密码检测

yum install cracklib*

[root@k3 docker]# echo "123"|cracklib-check

123: WAY 过短

[root@k3 docker]# echo "Ledou123"|cracklib-check

Ledou123: 过于简单化/系统化

[root@k3 docker]# echo "Ledou@123"|cracklib-check

Ledou@123: OK

[root@k3 docker]# passwd meng2

更改用户 meng2 的密码 。

新的 密码:

无效的密码: 它没有包含足够的不同字符

无效的密码: 过于简单

重新输入新的 密码:

passwd:所有的身份验证令牌已经成功更新。

[root@k3 docker]#

#ubuntu

apt-get install libpam-cracklib

vim /etc/pam.d/common-password

password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2

用户连续N次输入错误密码进行登陆时自动锁定X分钟

在第二行,添加内容,一定要写在前面,如果写在后面,虽然用户被锁定,但是只要用户输入正确的密码,还是可以登录的!

vim /etc/pam.d/login

auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10

even_deny_root 也限制root用户;

deny 设置普通用户和root用户连续错误登陆的最大次数,超过最大次数,则锁定该用户;

unlock_time 设定普通用户锁定后,多少时间后解锁,单位是秒;

root_unlock_time 设定root用户锁定后,多少时间后解锁,单位是秒;

限制远程登录,需要改sshd文件

vim /etc/pam.d/sshd

在第二行上添加

auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10

是否账号:

pam_tally2 -r -u shuai.he

查看用户登录失败的次数:

pam_tally2 --user

五:安全审计

1.密码复杂度

apt-get install libpam-cracklib

vim /etc/pam.d/common-password

password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2

2.登录失败次数

vim /etc/pam.d/login

auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10

vim /etc/pam.d/sshd

auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10

3.多余账号清理

for i in kevin.liu shawn alan.lian faith.wang fiona.li benar.chen shuai.he;do echo $i;userdel $i;done

4.auditd 服务启用

apt install auditd

systemctl status auditd

systemctl restart auditd

5.syslog 日志定期备份

systemctl status syslog

systemctl restart syslog

#计划任务

#log

05 05 */3 * * cd /data/backup; tar zcvf syslog_`date +%Y-%m-%d`.tgz /var/log/syslog*

六:给ssh-key 增加密码

[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p

@ WARNING: UNPROTECTED PRIVATE KEY FILE! @

Permissions 0644 for 'mengshiye' are too open.

It is required that your private key files are NOT accessible by others.

This private key will be ignored.

bad permissions: ignore key: mengshiye

Enter old passphrase:

@ WARNING: UNPROTECTED PRIVATE KEY FILE! @

Permissions 0644 for 'mengshiye' are too open.

It is required that your private key files are NOT accessible by others.

This private key will be ignored.

bad permissions: ignore key: mengshiye

Bad passphrase.

[root@VM_230_62_centos ~]# chmod 600 mengshiye

[root@VM_230_62_centos ~]# ll mengshiye

-rw------- 1 root root 1675 Mar 3 17:55 mengshiye

[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p

Key has comment 'mengshiye'

Enter new passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved with the new passphrase.

[root@VM_230_62_centos ~]#

标签: #centos62密码破解