Skip to content

Commit 6b58743

Browse files
WeiyiGeekWeiyiGeek
committed
ubuntu 22.04 security
1 parent fa969cd commit 6b58743

29 files changed

+3029
-18
lines changed

‎OS-操作系统/Linux/Ubuntu/Ubuntu-InitializeSecurity.sh‎

Lines changed: 28 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# @Author: WeiyiGeek
33
# @Description: Ubuntu TLS Security Initiate
44
# @Create Time: 2019年9月1日 16:43:33
5-
# @Last Modified time: 2021-11-15 11:06:31
5+
# @Last Modified time: 2020-11-15 11:06:31
66
# @E-mail: master@weiyigeek.top
77
# @Blog: https://www.weiyigeek.top
88
# @wechat: WeiyiGeeker
@@ -23,9 +23,11 @@ IP=192.168.1.2
2323
GATEWAY=192.168.1.1
2424
DNSIP=("223.5.5.5" "223.6.6.6")
2525
SSHPORT=20211
26-
DefaultUser="WeiyiGeek" # 系统创建的用户名称非root用户
27-
ROOTPASS=WeiyiGeek # 密码建议12位以上且包含数字、大小写字母以及特殊字符。
28-
APPPASS=WeiyiGeek
26+
ROOTPASS=r2022.WeiyiGeek.top # 密码建议12位以上且包含数字、大小写字母以及特殊字符
27+
USERNAME="WeiyiGeek" # 系统创建的用户名称非root用户
28+
USERPASS=u2022.WeiyiGeek.top
29+
APPUSER=app
30+
APPPASS=a2022.WeiyiGeek.top
2931

3032
## 名称: err 、info 、warning
3133
## 用途：全局Log信息打印函数
@@ -197,7 +199,7 @@ defaultuser=(root daemon bin sys games man lp mail news uucp proxy www-data back
197199
for i in $(cat /etc/passwd | cut -d ":" -f 1,7);do
198200
flag=0; name=${i%%:*}; terminal=${i##*:}
199201
if [[ "${terminal}" == "/bin/bash" || "${terminal}" == "/bin/sh" ]];then
200-
log::warning "${i} 用户，shell终端为 /bin/bash 或者 /bin/sh"
202+
log::warning "${name} 用户，shell终端为 /bin/bash 或者 /bin/sh"
201203
fi
202204
for j in ${defaultuser[@]};do
203205
if [[ "${name}" == "${j}" ]];then
@@ -206,25 +208,30 @@ for i in $(cat /etc/passwd | cut -d ":" -f 1,7);do
206208
fi
207209
done
208210
if [[ $flag -eq 0 ]];then
209-
log::warning "${i} 非默认用户"
211+
log::warning "${name} 非默认用户"
210212
fi
211213
done
212214
cp /etc/shadow /etc/shadow-`date +%Y%m%d`.bak
213215
passwd -l adm&>/dev/null 2&>/dev/null; passwd -l daemon&>/dev/null 2&>/dev/null; passwd -l bin&>/dev/null 2&>/dev/null; passwd -l sys&>/dev/null 2&>/dev/null; passwd -l lp&>/dev/null 2&>/dev/null; passwd -l uucp&>/dev/null 2&>/dev/null; passwd -l nuucp&>/dev/null 2&>/dev/null; passwd -l smmsplp&>/dev/null 2&>/dev/null; passwd -l mail&>/dev/null 2&>/dev/null; passwd -l operator&>/dev/null 2&>/dev/null; passwd -l games&>/dev/null 2&>/dev/null; passwd -l gopher&>/dev/null 2&>/dev/null; passwd -l ftp&>/dev/null 2&>/dev/null; passwd -l nobody&>/dev/null 2&>/dev/null; passwd -l nobody4&>/dev/null 2&>/dev/null; passwd -l noaccess&>/dev/null 2&>/dev/null; passwd -l listen&>/dev/null 2&>/dev/null; passwd -l webservd&>/dev/null 2&>/dev/null; passwd -l rpm&>/dev/null 2&>/dev/null; passwd -l dbus&>/dev/null 2&>/dev/null; passwd -l avahi&>/dev/null 2&>/dev/null; passwd -l mailnull&>/dev/null 2&>/dev/null; passwd -l nscd&>/dev/null 2&>/dev/null; passwd -l vcsa&>/dev/null 2&>/dev/null; passwd -l rpc&>/dev/null 2&>/dev/null; passwd -l rpcuser&>/dev/null 2&>/dev/null; passwd -l nfs&>/dev/null 2&>/dev/null; passwd -l sshd&>/dev/null 2&>/dev/null; passwd -l pcap&>/dev/null 2&>/dev/null; passwd -l ntp&>/dev/null 2&>/dev/null; passwd -l haldaemon&>/dev/null 2&>/dev/null; passwd -l distcache&>/dev/null 2&>/dev/null; passwd -l webalizer&>/dev/null 2&>/dev/null; passwd -l squid&>/dev/null 2&>/dev/null; passwd -l xfs&>/dev/null 2&>/dev/null; passwd -l gdm&>/dev/null 2&>/dev/null; passwd -l sabayon&>/dev/null 2&>/dev/null; passwd -l named&>/dev/null 2&>/dev/null
214216

215217
# (2) 用户密码设置和口令策略设置
216218
log::info "[-] 配置满足策略的root管理员密码 "
217-
echo ${ROOTPASS} | passwd --stdin root
219+
echo "root:${ROOTPASS}" | chpasswd
220+
221+
log::info "[-] 配置满足策略的${USERNAME}管理员密码 "
222+
echo "${USERNAME}:${USERPASS}" | chpasswd
223+
224+
log::info "[-] 配置满足策略的app普通用户密码(根据需求配置)"
225+
groupadd ${APPUSER}
226+
useradd -m -s /bin/bash -c "application primary user" -g ${APPUSER} ${APPUSER}
227+
echo "${APPUSER}:${APPPASS}" | chpasswd
218228

219-
log::info "[-] 配置满足策略的app普通用户密码(根据需求配置)"
220-
groupadd application
221-
useradd -m -s /bin/bash -c "application primary user" -g application app
222-
echo ${APPPASS} | passwd --stdin app
223229

224230
log::info "[-] 强制用户在下次登录时更改密码 "
225-
chage -d 0 -m 0 -M 90 -W 15 root && passwd --expire root
226-
chage -d 0 -m 0 -M 90 -W 15 ${DefaultUser} && passwd --expire ${DefaultUser}
227-
chage -d 0 -m 0 -M 90 -W 15 app && passwd --expire app
231+
chage -d 0 -m 0 -M 90 -W 15 root && passwd --expire root
232+
chage -d 0 -m 0 -M 90 -W 15 ${USERNAME} && passwd --expire ${USERNAME}
233+
chage -d 0 -m 0 -M 90 -W 15 ${APPUSER} && passwd --expire ${APPUSER}
234+
228235

229236
log::info "[-] 用户口令复杂性策略设置 (密码过期周期0~90、到期前15天提示、密码长度至少15、复杂度设置至少有一个大小写、数字、特殊字符、密码三次不能一样、尝试次数为三次)"
230237
egrep -q "^\s*PASS_MIN_DAYS\s+\S*(\s*#.*)?\s*$" /etc/login.defs && sed -ri "s/^(\s*)PASS_MIN_DAYS\s+\S*(\s*#.*)?\s*$/\PASS_MIN_DAYS 0/" /etc/login.defs || echo "PASS_MIN_DAYS 0" >> /etc/login.defs
@@ -241,15 +248,16 @@ touch /etc/security/opasswd && chown root:root /etc/security/opasswd && chmod 60
241248

242249
# (3) 用户sudo权限以及重要目录和文件的权限设置
243250
log::info "[-] 用户sudo权限以及重要目录和文件的新建默认权限设置"
244-
# 如uBuntu安装时您创建的用户 WeiyiGeek 防止直接通过 sudo passwd 修改root密码(此时必须要求输入WeiyiGeek密码后才可修改root密码)
251+
# 如ubuntu安装时您创建的用户 WeiyiGeek 防止直接通过 sudo passwd 修改root密码(此时必须要求输入WeiyiGeek密码后才可修改root密码)
245252
# Tips: Sudo允许授权用户权限以另一个用户（通常是root用户）的身份运行程序,
246-
# DefaultUser="weiyigeek"
247-
sed -i "/# Members of the admin/i ${DefaultUser} ALL=(ALL) PASSWD:ALL" /etc/sudoers
253+
# USERNAME="weiyigeek"
254+
sed -i "/# Members of the admin/i ${USERNAME} ALL=(ALL) PASSWD:ALL" /etc/sudoers
248255

249256

250257
log::info "[-] 配置用户 umask 为022 "
251258
egrep -q "^\s*umask\s+\w+.*$" /etc/profile && sed -ri "s/^\s*umask\s+\w+.*$/umask 022/" /etc/profile || echo "umask 022" >> /etc/profile
252259
egrep -q "^\s*umask\s+\w+.*$" /etc/bash.bashrc && sed -ri "s/^\s*umask\s+\w+.*$/umask 022/" /etc/bashrc || echo "umask 022" >> /etc/bash.bashrc
260+
253261
# log::info "[-] 设置用户目录创建默认权限, (初始为077比较严格)，在设置 umask 为022 及 777 - 022 "
254262
# egrep -q "^\s*(umask|UMASK)\s+\w+.*$" /etc/login.defs && sed -ri "s/^\s*(umask|UMASK)\s+\w+.*$/UMASK 022/" /etc/login.defs || echo "UMASK 022" >> /etc/login.defs
255263

@@ -287,6 +295,8 @@ sudo egrep -q "^\s*AllowAgentForwarding\s+.+$" /etc/ssh/sshd_config && sed -ri "
287295
egrep -q "^(#)?\s*IgnoreRhosts\s+.+$" /etc/ssh/sshd_config && sed -ri "s/^(#)?\s*IgnoreRhosts\s+.+$/IgnoreRhosts yes/" /etc/ssh/sshd_config || echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config
288296
# 禁止root远程登录（推荐配置-根据需求配置）
289297
egrep -q "^\s*PermitRootLogin\s+.+$" /etc/ssh/sshd_config && sed -ri "s/^\s*PermitRootLogin\s+.+$/PermitRootLogin no/" /etc/ssh/sshd_config || echo "PermitRootLogin no" >> /etc/ssh/sshd_config
298+
299+
290300
# 登陆前后欢迎提示设置
291301
egrep -q "^\s*(banner|Banner)\s+\W+.*$" /etc/ssh/sshd_config && sed -ri "s/^\s*(banner|Banner)\s+\W+.*$/Banner \/etc\/issue/" /etc/ssh/sshd_config || \
292302
echo "Banner /etc/issue" >> /etc/ssh/sshd_config
@@ -295,7 +305,7 @@ log::info "[-] 远程SSH登录前后提示警告Banner设置"
295305
sudo tee /etc/issue <<'EOF'
296306
****************** [ 安全登陆 (Security Login) ] *****************
297307
Authorized only. All activity will be monitored and reported.By Security Center.
298-
Owner: WeiyiGeek, Site: https://www.weiyigeek.top
308+
Author: WeiyiGeek, Site: https://www.weiyigeek.top
299309
300310
EOF
301311
# SSH登录后提示Banner

SecurityDetection/CentOS/CentOS6-Reinforce.sh renamed to OperatingSystem/Detection/CentOS/CentOS6-Reinforce.sh

File renamed without changes.

SecurityDetection/CentOS/CentOS7-Reinforce.sh renamed to OperatingSystem/Detection/CentOS/CentOS7-Reinforce.sh

File renamed without changes.

SecurityDetection/CentOS/SafetyCheck.sh renamed to OperatingSystem/Detection/CentOS/SafetyCheck.sh

File renamed without changes.

‎OperatingSystem/Security/Ubuntu/Readme.assets/image-20220823143235577.png‎

174 KB
Loading

‎OperatingSystem/Security/Ubuntu/Readme.assets/image-20220823143354742.png‎

50.9 KB
Loading

‎OperatingSystem/Security/Ubuntu/Readme.md‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
#### :hammer_and_wrench: Ubuntu 系统安全加固工具
2+
3+
描述: 本工具集主要针对于 Ubuntu 22.04 、20.04 LTS 操作系统进行安全加固以及系统初始化操作。
4+
5+
:atom_symbol:**脚本说明:**
6+
7+
```bash
8+
# Ubuntu 22.04 LTS
9+
# 温馨提示: 请以root用户权限下执行该脚本
10+
./Ubuntu22.04-InitializeReinforce.sh
11+
__ __ _ _ _____ _
12+
\ \ / / (_) (_)/ ____| | |
13+
\ \ /\ / /__ _ _ _ _| | __ ___ ___| | __
14+
\ \/ \/ / _ \ | | | | | | |_ |/ _ \/ _ \ |/ /
15+
\ /\ / __/ | |_| | | |__| | __/ __/ <
16+
\/ \/ \___|_|\__, |_|\_____|\___|\___|_|\_\
17+
__/ |
18+
|___/
19+
======================================================================
20+
@ Desc: Ubuntu 22.04 Security Reinforce and System initialization
21+
@ Mail bug reports: master@weiyigeek.top or pull request (pr)
22+
@ Author : WeiyiGeek
23+
@ Follow me on Blog : https://blog.weiyigeek.top/
24+
@ Follow me on Wechat : https://weiyigeek.top/wechat.html?key=欢迎关注
25+
@ Communication group : https://weiyigeek.top/visit.html
26+
======================================================================
27+
28+
Usage: ./Ubuntu22.04-InitializeReinforce.sh [--start ] [--network] [--function] [--clear] [--version] [--help]
29+
Option:
30+
--start Start System initialization and security reinforcement.
31+
--network Configure the system network and DNS resolution server.
32+
--function PCall the specified shell function.
33+
--clear Clear all system logs, cache and backup files.
34+
--version Print version and exit.
35+
--help Print help and exit.
36+
37+
Mail bug reports or suggestions to <master@weiyigeek.top> or pull request (pr).
38+
current version : 1.0
39+
```
40+
41+
<br/>
42+
43+
:atom_symbol:**脚本目录:**
44+
描述: 为了方便后期维护以及大家pr，此处进行分类并做成了函数调用方式进行，每个函数都是可独立运行的。
45+
```bash
46+
:~$ tree Ubuntu/
47+
Ubuntu/
48+
├── Ubuntu22.04-InitializeReinforce.sh
49+
├── config
50+
│   └── Ubuntu22.04.conf
51+
├── example
52+
│   └── 22.04
53+
└── scripts
54+
├── os-base.sh
55+
├── os-clean.sh
56+
├── os-exceptions.sh
57+
├── os-info.sh
58+
├── os-manual.sh
59+
├── os-network.sh
60+
├── os-optimize.sh
61+
├── os-security.sh
62+
├── os-service.sh
63+
└── os-software.sh
64+
65+
4 directories, 12 files
66+
```
67+
68+
69+
:atom_symbol:**脚本函数:**
70+
71+
描述: 如下脚本将根据参数在 `Ubuntu22.04-InitializeReinforce.sh` 分别进行调用执行, 也可采用`--function `参数进行指定调用。
72+
73+
```bash
74+
❯ grep -r -n "函数名称" -A 1 *
75+
scripts/os-base.sh:26:# 函数名称: base_hostname
76+
scripts/os-base.sh-27-# 函数用途: 主机名称设置
77+
--
78+
scripts/os-base.sh:55:# 函数名称: ubuntu_mirror
79+
scripts/os-base.sh-56-# 函数用途: ubuntu 系统主机软件仓库镜像源
80+
--
81+
scripts/os-base.sh:126:# 函数名称: ubuntu_software
82+
scripts/os-base.sh-127-# 函数用途: ubuntu 系统主机内核版本升级以常规软件安装
83+
--
84+
scripts/os-base.sh:153:# 函数名称: base_timezone
85+
scripts/os-base.sh-154-# 函数用途: 主机时间同步校准与时区设置
86+
--
87+
scripts/os-base.sh:192:# 函数名称: base_banner
88+
scripts/os-base.sh-193-# 函数用途: 远程本地登陆主机信息展示
89+
--
90+
scripts/os-base.sh:345:# 函数名称: base_reboot
91+
scripts/os-base.sh-346-# 函数用途: 是否进行重启或者关闭服务器
92+
--
93+
scripts/os-clean.sh:27:# 函数名称: system_clean
94+
scripts/os-clean.sh-28-# 函数用途: 删除安全加固过程临时文件清理为基线镜像做准备
95+
--
96+
scripts/os-exceptions.sh:26:# 函数名称: problem_usercrond
97+
scripts/os-exceptions.sh-27-# 函数用途: 解决普通用户定时任务无法定时执行问题
98+
--
99+
scripts/os-exceptions.sh:45:# 函数名称: problem_multipath
100+
scripts/os-exceptions.sh-46-# 函数用途: 解决 ubuntu multipath add missing path 错误
101+
--
102+
scripts/os-network.sh:27:# 函数名称: net_config
103+
scripts/os-network.sh-28-# 函数用途: 主机IP地址与网关设置
104+
--
105+
scripts/os-network.sh:70:# 函数名称: net_dns
106+
scripts/os-network.sh-71-# 函数用途: 设置主机DNS解析服务器
107+
--
108+
scripts/os-optimize.sh:27:# 函数名称: optimize_kernel
109+
scripts/os-optimize.sh-28-# 函数用途: 系统内核参数的优化配置
110+
--
111+
scripts/os-optimize.sh:84:# 函数名称: resources_limits
112+
scripts/os-optimize.sh-85-# 函数用途: 系统资源文件打开句柄数优化配置
113+
--
114+
scripts/os-optimize.sh:115:# 函数名称: swap_partition
115+
scripts/os-optimize.sh-116-# 函数用途: 创建系统swap分区
116+
--
117+
scripts/os-security.sh:27:# 函数名称: sec_usercheck
118+
scripts/os-security.sh-28-# 函数用途: 用于锁定或者删除多余的系统账户
119+
--
120+
scripts/os-security.sh:65:# 函数名称: sec_userconfig
121+
scripts/os-security.sh-66-# 函数用途: 针对拥有ssh远程登陆权限的用户进行密码口令设置。
122+
--
123+
scripts/os-security.sh:131:# 函数名称: sec_passpolicy
124+
scripts/os-security.sh-132-# 函数用途: 用户密码复杂性策略设置 (密码过期周期0~90、到期前15天提示、密码长度至少12、复杂度设置至少有一个大小写、数字、特殊字符、密码三次不能一样、尝试次数为三次）
125+
--
126+
scripts/os-security.sh:166:# 函数名称: sec_sshdpolicy
127+
scripts/os-security.sh-167-# 函数用途: 系统sshd服务安全策略设置
128+
--
129+
scripts/os-security.sh:194:# 函数名称: sec_loginpolicy
130+
scripts/os-security.sh-195-# 函数用途: 用户登陆安全策略设置
131+
--
132+
scripts/os-security.sh:230:# 函数名称: sec_historypolicy
133+
scripts/os-security.sh-231-# 函数用途: 用户终端执行的历史命令记录安全策略设置
134+
--
135+
scripts/os-security.sh:261:# 函数名称: sec_grubpolicy
136+
scripts/os-security.sh-262-# 函数用途: 系统 GRUB 安全设置防止物理接触从grub菜单中修改密码
137+
--
138+
scripts/os-security.sh:304:# 函数名称: sec_firewallpolicy
139+
scripts/os-security.sh-305-# 函数用途: 系统防火墙策略设置, 建议操作完成后重启计算机.
140+
--
141+
scripts/os-security.sh:335:# 函数名称: sec_ctrlaltdel
142+
scripts/os-security.sh-336-# 函数用途: 禁用 ctrl+alt+del 组合键对系统重启 (必须要配置我曾入过坑)
143+
--
144+
scripts/os-security.sh:355:# 函数名称: sec_recyclebin
145+
scripts/os-security.sh-356-# 函数用途: 设置文件删除回收站别名(防止误删文件)(必须要配置,我曾入过坑)
146+
--
147+
scripts/os-security.sh:405:# 函数名称: sec_supolicy
148+
scripts/os-security.sh-406-# 函数用途: 切换用户日志记录和切换命令更改名称为SU(可选)
149+
--
150+
scripts/os-security.sh:425:# 函数名称: sec_privilegepolicy
151+
scripts/os-security.sh-426-# 函数用途: 系统用户sudo权限与文件目录创建权限策略设置
152+
--
153+
scripts/os-service.sh:26:# 函数名称: svc_apport
154+
scripts/os-service.sh-27-# 函数用途: 禁用烦人的apport错误报告
155+
--
156+
scripts/os-service.sh:52:# 函数名称: svc_snapd
157+
scripts/os-service.sh-53-# 函数用途: 不使用snapd容器的环境下禁用或者卸载多余的snap软件及其服务
158+
--
159+
scripts/os-service.sh:75:# 函数名称: svc_cloud-init
160+
scripts/os-service.sh-76-# 函数用途: 非云的环境下禁用或者卸载多余的cloud-init软件及其服务
161+
--
162+
scripts/os-service.sh:101:# 函数名称: svc_debugshell
163+
scripts/os-service.sh-102-# 函数用途: 在系统启动时禁用debug-shell服务
164+
--
165+
scripts/os-software.sh:26:# 函数名称: install_chrony
166+
scripts/os-software.sh-27-# 函数用途: 安装配置 chrony 时间同步服务器
167+
--
168+
scripts/os-software.sh:79:# 函数名称: install_java
169+
scripts/os-software.sh-80-# 函数用途: 安装配置java环境
170+
--
171+
scripts/os-software.sh:110:## 函数名称: install_docker
172+
scripts/os-software.sh-111-## 函数用途: 在 Ubuntu 主机上安装最新版本的Docker
173+
--
174+
scripts/os-software.sh:201:## 函数名称: install_cockercompose
175+
scripts/os-software.sh-202-## 函数用途: 在 Ubuntu 主机上安装最新版本的Dockercompose
176+
```
177+
178+
179+
180+
:atom_symbol:**脚本使用:**
181+
182+
描述: 通常针对于才安装的服务器系统，针对ubuntu初始化可以在 `Ubuntu22.04.conf` 中进行相应配置，然后在执行该脚本。
183+
184+
```bash
185+
# 执行权限赋予
186+
chmod +x -R *
187+
188+
# 开始初始化加固
189+
Ubuntu22.04-InitializeReinforce.sh --start
190+
```
191+
192+
![image-20220823143235577](.\Readme.assets\image-20220823143235577.png)
193+
194+
195+
196+
加固结果查看：
197+
```bash
198+
ssh -p 20221 ubuntu@10.10.99.236
199+
su - root
200+
```
201+
202+
![image-20220823143354742](.\Readme.assets\image-20220823143354742.png)
203+
204+
温馨提示：脚本中默认root密码为`R2022.weiyigeek.top`。
205+
温馨提示: 防火墙策略只开放了80，443，22，20221等端口。

0 commit comments

Comments
 (0)