Linux系统安全加固脚本

#!/bin/bash # ========================================== # Linux系统安全加固脚本 # 用途：对Linux服务器进行基础安全加固 # 注意：请先在测试环境验证，生产环境操作前务必备份 # 使用方法：以root身份执行 bash security_hardening.sh # ========================================== if [ "$(id -u)" -ne 0 ]; then echo "请以root身份运行此脚本" exit 1 fi echo "========== 系统安全加固开始 ==========" echo "执行时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "" BACKUP_DIR="/root/security_backup_$(date '+%Y%m%d_%H%M%S')" mkdir -p "$BACKUP_DIR" echo "配置文件备份目录: $BACKUP_DIR" echo "" # 1. SSH安全加固 echo "【1. SSH安全加固】" cp /etc/ssh/sshd_config "$BACKUP_DIR/sshd_config.bak" # 修改SSH默认端口（可选，取消注释） # sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config # 禁用root远程登录 sed -i 's/^#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config echo " ✓ 禁用root远程登录" # 禁用密码登录（确保已配置密钥登录后再开启） # sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config # echo " ✓ 禁用密码登录（仅密钥）" # 禁用空密码 sed -i 's/^#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config echo " ✓ 禁用空密码登录" # 设置登录尝试次数 sed -i 's/^#MaxAuthTries 6/MaxAuthTries 3/' /etc/ssh/sshd_config echo " ✓ 最大登录尝试次数设为3" # 重启SSH if command -v systemctl &>/dev/null; then systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null fi echo "" # 2. 密码策略 echo "【2. 密码策略加固】" if [ -f /etc/login.defs ]; then cp /etc/login.defs "$BACKUP_DIR/login.defs.bak" sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 90/' /etc/login.defs sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS 1/' /etc/login.defs sed -i 's/^PASS_MIN_LEN.*/PASS_MIN_LEN 8/' /etc/login.defs sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE 7/' /etc/login.defs echo " ✓ 密码最长使用90天，最短8位，提前7天提醒" fi echo "" # 3. 防火墙配置 echo "【3. 防火墙配置】" if command -v ufw &>/dev/null; then ufw default deny incoming ufw default allow outgoing ufw allow 22/tcp ufw allow 80/tcp ufw allow 443/tcp ufw --force enable echo " ✓ UFW防火墙已启用（放行22/80/443）" elif command -v firewall-cmd &>/dev/null; then systemctl start firewalld systemctl enable firewalld firewall-cmd --permanent --add-service=ssh firewall-cmd --permanent --add-service=http firewall-cmd --permanent --add-service=https firewall-cmd --reload echo " ✓ firewalld已启用（放行ssh/http/https）" else echo " ⚠ 未检测到ufw/firewalld，请手动配置iptables" fi echo "" # 4. 禁用危险服务 echo "【4. 禁用不必要的服务】" for svc in telnet.socket rsh.socket rlogin.socket rexec.socket vsftpd; do if systemctl list-unit-files | grep -q "^$svc"; then systemctl stop "$svc" 2>/dev/null systemctl disable "$svc" 2>/dev/null echo " ✓ 已禁用: $svc" fi done echo "" # 5. 内核参数加固 echo "【5. 内核参数加固】" cp /etc/sysctl.conf "$BACKUP_DIR/sysctl.conf.bak" cat >> /etc/sysctl.conf << 'EOF' # === 安全加固参数 === # 禁止IP转发（非路由器服务器） net.ipv4.ip_forward = 0 # 禁止源路由 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 # 禁止ICMP重定向 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 # 开启SYN洪水攻击保护 net.ipv4.tcp_syncookies = 1 # 禁止广播ICMP net.ipv4.icmp_echo_ignore_broadcasts = 1 # 忽略 bogus ICMP net.ipv4.icmp_ignore_bogus_error_responses = 1 # 开启反向路径过滤 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # 记录可疑数据包 net.ipv4.conf.all.log_martians = 1 EOF sysctl -p >/dev/null 2>&1 echo " ✓ 内核安全参数已加载" echo "" # 6. 文件权限加固 echo "【6. 关键文件权限加固】" chmod 600 /etc/passwd 2>/dev/null chmod 600 /etc/shadow 2>/dev/null chmod 600 /etc/gshadow 2>/dev/null chmod 644 /etc/group 2>/dev/null echo " ✓ 关键文件权限已设置" echo "" # 7. 设置登录超时 echo "【7. 登录超时设置】" if ! grep -q "TMOUT" /etc/profile; then echo "export TMOUT=300" >> /etc/profile echo " ✓ 无操作5分钟自动登出" else echo " - 已配置TMOUT，跳过" fi echo "" echo "========== 安全加固完成 ==========" echo "配置文件已备份至: $BACKUP_DIR" echo "" echo "⚠️ 注意事项：" echo " 1. 请确认SSH配置正确后再断开当前连接，避免无法登录" echo " 2. 如需禁用密码登录，请先确保密钥登录配置正常" echo " 3. 如服务器有特殊业务端口，需在防火墙中额外放行" echo "" echo "建议执行后重启服务器使所有配置生效。"

[]