一：配置只读账号
#!/bin/bash
if [ $# -lt 1 ]
then
echo "Usage `basename $0` user_name user_pwd"
exit 1
fi
user_name="$1"
user_pwd="$2"
#jude
if [ -e "/home/${user_name}" ]
then
echo "ERROR ${user_name} exist!"
exit 1
fi
if [ -e "/var/spool/mail/${user_name}" ]
then
cd /var/spool/mail
/bin/rm -rf /var/spool/mail/${user_name}
fi
if [ ! -e "/bin/rbash" ]
then
ln -s /bin/bash /bin/rbash
fi
#name
useradd -s /bin/rbash ${user_name}
#pwd
if [ "${user_pwd}" = "" ]
then
echo ${user_name}:`echo ${user_name}|md5sum|cut -b 4-11`|chpasswd
echo "PASSWD: `echo ${user_name}|md5sum|cut -b 4-11`"
else
echo ${user_name}:${user_pwd}|chpasswd
echo "PASSWD: ${user_pwd}"
fi
#dir
mkdir /home/${user_name}/bin
#change PATH
sed -i "/PATH\=/d" /home/${user_name}/.bash_profile
sed -i "/PATH/iPATH\=\$HOME\/bin" /home/${user_name}/.bash_profile
#chown
chown root. /home/${user_name}/.bash_profile
#chmod
chmod 755 /home/${user_name}/.bash_profile
#path
#cmd
cmd_list="ls cat more"
for i in `echo $cmd_list`
do
ln -s /bin/${i} /home/${user_name}/bin/${i}
done
exit二：pam_tally2
1. 查看用户被锁情况
pam_tally2 --user user02
2.解锁用户
pam_tall2 -r -u user02
3.配置文件
/etc/pam.d/sshd
參數說明:
deny=n 代表拒絕存取，如果超過n次
lock_time=n 代表1次失敗後就鎖n秒
unlock_time=n 代表幾次失敗就鎖n秒，搭配deny=2就是兩次失敗就鎖n秒
even_deny_root 代表也限制root帳號
root_unlock_time=n 這個跟unlcok_time一樣，只是這只給root帳號用，如果要區別一般帳號的話，就可以額外作這個限制
三：检测账号最近登录情况
for i in `cat /etc/passwd|awk -F\: '{print $1}'`;do echo $i;last $i|grep -v wtmp|tail -2;done
四：密码复杂度配置及登录失败配置
centos 7
vi /etc/pam.d/system-auth
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
password requisite pam_cracklib.so retry=5 difok=3 minlen=10 ucredit=-1 lcredit=-3 dcredit=-3 dictpath=/usr/share/cracklib/pw_dict
参数含义：
尝试次数：5 ；最少不同字符：3 ；最小密码长度：10 ；最少大写字母：1；最少小写字母：3 ；最少数字：3 ；字典位置：/usr/share/cracklib/pw_dict
密码检测
yum install cracklib*
[root@k3 docker]# echo "123"|cracklib-check
123: WAY 过短
[root@k3 docker]# echo "Ledou123"|cracklib-check
Ledou123: 过于简单化/系统化
[root@k3 docker]# echo "Ledou@123"|cracklib-check
Ledou@123: OK
[root@k3 docker]# passwd meng2
更改用户 meng2 的密码 。
新的 密码：
无效的密码： 它没有包含足够的不同字符
无效的密码： 过于简单
重新输入新的 密码：
passwd：所有的身份验证令牌已经成功更新。
[root@k3 docker]#
#ubuntu
apt-get install libpam-cracklib
vim /etc/pam.d/common-password
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
用户连续N次输入错误密码进行登陆时自动锁定X分钟
在第二行，添加内容，一定要写在前面，如果写在后面，虽然用户被锁定，但是只要用户输入正确的密码，还是可以登录的！
vim /etc/pam.d/login
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
even_deny_root 也限制root用户；
deny 设置普通用户和root用户连续错误登陆的最大次数，超过最大次数，则锁定该用户；
unlock_time 设定普通用户锁定后，多少时间后解锁，单位是秒；
root_unlock_time 设定root用户锁定后，多少时间后解锁，单位是秒；
限制远程登录，需要改sshd文件
vim /etc/pam.d/sshd
在第二行上添加
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
是否账号：
pam_tally2 -r -u shuai.he
查看用户登录失败的次数:
pam_tally2 --user
五：安全审计
1.密码复杂度
apt-get install libpam-cracklib
vim /etc/pam.d/common-password
password requisite pam_cracklib.so retry=5 difok=3 minlen=6 ucredit=-2 lcredit=-2 dcredit=-2
2.登录失败次数
vim /etc/pam.d/login
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
vim /etc/pam.d/sshd
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=10
3.多余账号清理
for i in kevin.liu shawn alan.lian faith.wang fiona.li benar.chen shuai.he;do echo $i;userdel $i;done
4.auditd 服务启用
apt install auditd
systemctl status auditd
systemctl restart auditd
5.syslog 日志定期备份
systemctl status syslog
systemctl restart syslog
#计划任务
#log
05 05 */3 * * cd /data/backup; tar zcvf syslog_`date +%Y-%m-%d`.tgz /var/log/syslog*
六：给ssh-key 增加密码
[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
Permissions 0644 for 'mengshiye' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: mengshiye
Enter old passphrase:
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
Permissions 0644 for 'mengshiye' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: mengshiye
Bad passphrase.
[root@VM_230_62_centos ~]# chmod 600 mengshiye
[root@VM_230_62_centos ~]# ll mengshiye
-rw------- 1 root root 1675 Mar 3 17:55 mengshiye
[root@VM_230_62_centos ~]# ssh-keygen -f mengshiye -p
Key has comment 'mengshiye'
Enter new passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved with the new passphrase.
[root@VM_230_62_centos ~]#