前言:
现时你们对“centos62密码破解”都比较重视,各位老铁们都想要分析一些“centos62密码破解”的相关资讯。那么小编也在网上搜集了一些关于“centos62密码破解””的相关知识,希望同学们能喜欢,看官们快快来了解一下吧!一:配置只读账号
#!/bin/bashif [ $# -lt 1 ] then echo "Usage `basename $0` user_name user_pwd" exit 1fiuser_name="$1"user_pwd="$2"#judeif [ -e "/home/${user_name}" ] then echo "ERROR ${user_name} exist!" exit 1fiif [ -e "/var/spool/mail/${user_name}" ] then cd /var/spool/mail /bin/rm -rf /var/spool/mail/${user_name}fiif [ ! -e "/bin/rbash" ] then ln -s /bin/bash /bin/rbashfi#nameuseradd -s /bin/rbash ${user_name}#pwdif [ "${user_pwd}" = "" ] then echo ${user_name}:`echo ${user_name}|md5sum|cut -b 4-11`|chpasswd echo "PASSWD: `echo ${user_name}|md5sum|cut -b 4-11`"else echo ${user_name}:${user_pwd}|chpasswd echo "PASSWD: ${user_pwd}"fi#dirmkdir /home/${user_name}/bin#change PATHsed -i "/PATH\=/d" /home/${user_name}/.bash_profilesed -i "/PATH/iPATH\=\$HOME\/bin" /home/${user_name}/.bash_profile#chownchown root. /home/${user_name}/.bash_profile#chmodchmod 755 /home/${user_name}/.bash_profile#path#cmdcmd_list="ls cat more"for i in `echo $cmd_list`do ln -s /bin/${i} /home/${user_name}/bin/${i}doneexit
二:pam_tally2
1. 查看用户被锁情况
pam_tally2 --user user02
2.解锁用户
pam_tall2 -r -u user02
3.配置文件
/etc/pam.d/sshd
參數說明:
deny=n 代表拒絕存取,如果超過n次
lock_time=n 代表1次失敗後就鎖n秒
unlock_time=n 代表幾次失敗就鎖n秒,搭配deny=2就是兩次失敗就鎖n秒
even_deny_root 代表也限制root帳號
root_unlock_time=n 這個跟unlcok_time一樣,只是這只給root帳號用,如果要區別一般帳號的話,就可以額外作這個限制
三:检测账号最近登录情况
for i in `cat /etc/passwd|awk -F\: '{print $1}'`;do echo $i;last $i|grep -v wtmp|tail -2;done
四:密码复杂度配置及登录失败配置
centos 7
vi /etc/pam.d/system-auth
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
password requisite pam_cracklib.so retry=5 difok=3 minlen=10 ucredit=-1 lcredit=-3 dcredit=-3 dictpath=/usr/share/cracklib/pw_dict
参数含义:
尝试次数:5 ;最少不同字符:3 ;最小密码长度:10 ;最少大写字母:1;最少小写字母:3 ;最少数字:3 ;字典位置:/usr/share/cracklib/pw_dict
密码检测
yum install cracklib*
[root@k3 docker]# echo "123"|cracklib-check
123: WAY 过短
[root@k3 docker]# echo "Ledou123"|cracklib-check
Ledou123: 过于简单化/系统化
[root@k3 docker]# echo "Ledou@123"|cracklib-check
Ledou@123: OK
[root@k3 docker]# passwd meng2
更改用户 meng2 的密码 。
新的 密码:
无效的密码: 它没有包含足够的不同字符
无效的密码: 过于简单
重新输入新的 密码:
passwd:所有的身份验证令牌已经成功更新。
[root@k3 docker]#
#ubuntu
apt-get install libpam-cracklib
vim /etc/pam.d/common-password
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
用户连续N次输入错误密码进行登陆时自动锁定X分钟
在第二行,添加内容,一定要写在前面,如果写在后面,虽然用户被锁定,但是只要用户输入正确的密码,还是可以登录的!
vim /etc/pam.d/login
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
even_deny_root 也限制root用户;
deny 设置普通用户和root用户连续错误登陆的最大次数,超过最大次数,则锁定该用户;
unlock_time 设定普通用户锁定后,多少时间后解锁,单位是秒;
root_unlock_time 设定root用户锁定后,多少时间后解锁,单位是秒;
限制远程登录,需要改sshd文件
vim /etc/pam.d/sshd
在第二行上添加
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
是否账号:
pam_tally2 -r -u shuai.he
查看用户登录失败的次数:
pam_tally2 --user
五:安全审计
1.密码复杂度
apt-get install libpam-cracklib
vim /etc/pam.d/common-password
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
2.登录失败次数
vim /etc/pam.d/login
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
vim /etc/pam.d/sshd
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
3.多余账号清理
for i in kevin.liu shawn alan.lian faith.wang fiona.li benar.chen shuai.he;do echo $i;userdel $i;done
4.auditd 服务启用
apt install auditd
systemctl status auditd
systemctl restart auditd
5.syslog 日志定期备份
systemctl status syslog
systemctl restart syslog
#计划任务
#log
05 05 */3 * * cd /data/backup; tar zcvf syslog_`date +%Y-%m-%d`.tgz /var/log/syslog*
六:给ssh-key 增加密码
[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
Permissions 0644 for 'mengshiye' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: mengshiye
Enter old passphrase:
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
Permissions 0644 for 'mengshiye' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: mengshiye
Bad passphrase.
[root@VM_230_62_centos ~]# chmod 600 mengshiye
[root@VM_230_62_centos ~]# ll mengshiye
-rw------- 1 root root 1675 Mar 3 17:55 mengshiye
[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p
Key has comment 'mengshiye'
Enter new passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved with the new passphrase.
[root@VM_230_62_centos ~]#
标签: #centos62密码破解