Linux学习总结（72）——Linux基线检查加固脚本

Posted 2021-08-14 科技D人生

#!/bin/bash
 
#设置密码复杂度
if [ -z "`cat /etc/pam.d/system-auth | grep -v "^#" | grep "pam_cracklib.so"`" ];then
  sed -i \'/password    required      pam_deny.so/a\\password    required      pam_cracklib.so  try_first_pass minlen=8 ucredit=-1   lcredit=-1   ocredit=-1 dcredit=-1 retry=3 difok=5\' /etc/pam.d/system-auth
fi
#密码输入失败3次，锁定5分钟
sed -i \'s#auth        required      pam_env.so#auth        required      pam_env.so\\nauth       required       pam_tally.so  onerr=fail deny=3 unlock_time=300\\nauth           required     /lib/security/$ISA/pam_tally.so onerr=fail deny=3 unlock_time=300#\' /etc/pam.d/system-auth
 
#修改默认访问权限
sed -i \'/UMASK/s/077/027/\' /etc/login.defs
 
#设置重要文件目录权限
chmod 644 /etc/passwd 
chmod 600 /etc/xinetd.conf
chmod 600 /etc/inetd.conf 
chmod 644 /etc/group 
chmod 000 /etc/shadow 
chmod 644 /etc/services 
chmod 600 /etc/security