1 修改網絡卡名稱為eth0#mv ifcfg-eno16777729 ifcfg-eth0#vi /etc/sysconfig/grubGRUB_TIMEOUT=5GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"GRUB_DEFAULT=savedGRUB_DISABLE_SUBMENU=trueGRUB_TERMINAL_OUTPUT="console"GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0 rhgb quiet net.ifnames=0 biosdevname=0"GRUB_DISABLE_RECOVERY="true"修改 /etc/udev/rules.d/90-eno-fix.rules名稱#grub2-mkconfig -o /boot/grub2/grub.cfg #生成啟動選單Generating grub configuration file ...Found linux image: /boot/vmlinuz-3.10.0-327.el7.x86_64Found initrd image: /boot/initramfs-3.10.0-327.el7.x86_64.imgFound linux image: /boot/vmlinuz-0-rescue-e8675ae79abd41309dac42388f8d9116Found initrd image: /boot/initramfs-0-rescue-e8675ae79abd41309dac42388f8d9116.img#reboot#ip addr 或者#yum install net-tools #預設centos7不支援ifconfig 需要看裝net-tools包2.更新系統3.修改檔案屬性,最低許可權原則chmod 700 /bin/rpm 只有root許可權使用者才可以使用rpm命定,安裝軟體包chmod 664 /etc/hostschmod 644 /etc/passwdchmod 644 /etc/exportschmod 644 /etc/issuechmod 664 /var/log/wtmpchmod 664 /var/log/btmpchmod 644 /etc/serviceschmod 600 /etc/shadowchmod 600 /etc/login.defschmod 600 /etc/hosts.allowchmod 600 /etc/hosts.denychmod 600 /etc/securettychmod 600 /etc/securitychmod 600 /etc/ssh/ssh_host_keychmod 600 /etc/ssh/sshd_configchmod 600 /var/log/lastlogchmod 600 /var/log/messages4. 新增使用者fang[[email protected] ~]# useradd fang[[email protected] ~]# echo 123456 | passwd --stdin fangChanging password for user fang.passwd: all authentication tokens updated successfully.[[email protected] ~]# usermod -G wheel fang[[email protected] ~]# sed -i '6s/^#//g' /etc/pam.d/su[[email protected] ~]# grep wheel /etc/pam.d/su #只有WHEEL組的可以su# Uncomment the following line to implicitly trust users in the "wheel" group.#auth sufficient pam_wheel.so trust use_uid# Uncomment the following line to require a user to be in the "wheel" group.auth required pam_wheel.so use_uid擴充套件:為使用者fang新增sudo，除關機外的其他所有操作：# visudoCmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, /sbin/poweroff, /sbin/reboot, /sbin/initfang ALL=(ALL) ALL,!SHUTDOWN%wheel ALL=(ALL) ALL,!SHUTDOWN #修改wheel組的許可權，禁止關機Defaults logfile=/var/log/sudo.log5 禁用selinux[[email protected] ~]# grep -i ^selinux /etc/selinux/configSELINUX=enforcingSELINUXTYPE=targeted[[email protected] ~]# sed -i '/^SELINUX/s/enforcing/disabled/g' /etc/selinux/config[[email protected] ~]# getenforceEnforcing6.關閉防火牆安裝iptablessystemctl stop firewalld.service systemctl disable firewalld.serviceyum install iptables-services -y #安裝7.修改主機名[[email protected] ~]# hostnamectl set-hostname hequan.com[[email protected] ~]# hostnamehequan.com8.檢視並管理服務[[email protected] ~]# systemctl -t service[[email protected] ~]# systemctl list-unit-files -t serviceyum install -y bash-completion #補全服務名稱，退出bash再進就可以9.設定字符集[[email protected] ~]# echo $LANGzh_CN.UTF-8[[email protected] ~]# vi /etc/locale.confLANG="en_US.UTF-8"[[email protected] ~]# source /etc/locale.conf10.yumyum install -y cmake vim wget lrzsz htop安裝163源mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backupcd /etc/yum.repos.d/wget http://mirrors.163.com/.help/CentOS7-Base-163.repoyum clean allyum makecache其他yum -y install yum-plugin-priorities ##安裝優先順序外掛sed -i -e "s/\]$/\]\npriority=1/g" /etc/yum.repos.d/CentOS-Base.repo ##設定基本yum源的優先順序為1yum -y install epel-release ##安裝epel源sed -i -e "s/\]$/\]\npriority=5/g" /etc/yum.repos.d/epel.repo ##設定優先順序為5sed -i -e "s/enabled=1/enabled=0/g" /etc/yum.repos.d/epel.repo ##禁用epel源yum -y install http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm ##安裝rpmforge的源sed -i -e "s/\]$/\]\npriority=10/g" /etc/yum.repos.d/rpmforge.repo ##設定優先順序為10sed -i -e "s/enabled = 1/enabled = 0/g" /etc/yum.repos.d/rpmforge.repo ##禁用yum源使用方法：yum --enablerepo=rpmforge install [Package]安裝epel源yum -y install epel-release11 配置sshdListenAddress 0.0.0.0 ##只啟用ipv4/etc/ssh/sshd_configPermitRootLogin no ##禁止root使用ssh登入MaxAuthTries 2 ##兩次不行就切斷重新SSH啟動登入PubkeyAuthentication no ##禁止證書登陸AuthorizedKeysFile /dev/nullChallengeResponseAuthentication yes禁止SSH客戶端記住密碼加快ssh登入速度GSSAPIAuthentication no ##關閉 GSSAPIUseDNS no ##禁止DNS 反向解析一般 SSH 依次進行的認證方法的是 publickey, gssapi-keyex, gssapi-with-mic, password， 這個你可以ssh -v開啟 debug 模式在連線日誌看到。   一般使用者只使用 password 認證方式，但前面 3 個認證過程系統還是會嘗試，這就浪費時間了，也就造成 SSH 登入慢AllowTcpForwarding no禁止使用SSH對映Socks5翻牆等等12 加大開啟檔案數的限制（open files）ulimit -nulimit -avi /etc/security/limits.conf最後新增* soft nofile 1024000* hard nofile 1024000hive - nofile 1024000hive - nproc 1024000使用者程序限制# sed -i 's#4096#65535#g' /etc/security/limits.d/20-nproc.conf #加大普通使用者限制 也可以改為unlimited# egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf * soft nproc 65535root soft nproc unlimitedreboot13 優化核心cat /etc/sysctl.conf#CTCDN系統優化引數#關閉ipv6節省系統資源net.ipv6.conf.all.disable_ipv6 = 1net.ipv6.conf.default.disable_ipv6 = 1#決定檢查過期多久鄰居條目net.ipv4.neigh.default.gc_stale_time=120#使用arp_announce / arp_ignore解決ARP對映問題net.ipv4.conf.default.arp_announce = 2net.ipv4.conf.all.arp_announce=2net.ipv4.conf.lo.arp_announce=2# 避免放大攻擊net.ipv4.icmp_echo_ignore_broadcasts = 1# 開啟惡意icmp錯誤訊息保護net.ipv4.icmp_ignore_bogus_error_responses = 1#關閉路由轉發net.ipv4.ip_forward = 0net.ipv4.conf.all.send_redirects = 0net.ipv4.conf.default.send_redirects = 0#開啟反向路徑過濾net.ipv4.conf.all.rp_filter = 1net.ipv4.conf.default.rp_filter = 1#處理無源路由的包net.ipv4.conf.all.accept_source_route = 0net.ipv4.conf.default.accept_source_route = 0#關閉sysrq功能kernel.sysrq = 0#core檔名中新增pid作為副檔名kernel.core_uses_pid = 1# 開啟SYN洪水攻擊保護net.ipv4.tcp_syncookies = 1#修改訊息佇列長度kernel.msgmnb = 65536kernel.msgmax = 65536#設定最大記憶體共享段大小byteskernel.shmmax = 68719476736kernel.shmall = 4294967296#timewait的數量，預設180000net.ipv4.tcp_max_tw_buckets = 6000net.ipv4.tcp_sack = 1net.ipv4.tcp_window_scaling = 1net.ipv4.tcp_rmem = 4096 87380 4194304net.ipv4.tcp_wmem = 4096 16384 4194304net.core.wmem_default = 8388608net.core.rmem_default = 8388608net.core.rmem_max = 16777216net.core.wmem_max = 16777216#每個網路介面接收資料包的速率比核心處理這些包的速率快時，允許送到佇列的資料包的最大數目net.core.netdev_max_backlog = 262144#限制僅僅是為了防止簡單的DoS 攻擊net.ipv4.tcp_max_orphans = 3276800#未收到客戶端確認資訊的連線請求的最大值net.ipv4.tcp_max_syn_backlog = 262144net.ipv4.tcp_timestamps = 0#核心放棄建立連線之前傳送SYNACK 包的數量net.ipv4.tcp_synack_retries = 1#核心放棄建立連線之前傳送SYN 包的數量net.ipv4.tcp_syn_retries = 1#啟用timewait 快速回收net.ipv4.tcp_tw_recycle = 1#開啟重用。允許將TIME-WAIT sockets 重新用於新的TCP 連線net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_mem = 94500000 915000000 927000000net.ipv4.tcp_fin_timeout = 1#當keepalive 起用的時候，TCP 傳送keepalive 訊息的頻度。預設是2 小時net.ipv4.tcp_keepalive_time = 1800net.ipv4.tcp_keepalive_probes = 3net.ipv4.tcp_keepalive_intvl = 15#允許系統開啟的埠範圍net.ipv4.ip_local_port_range = 1024 65000#修改防火牆表大小，預設65536net.netfilter.nf_conntrack_max=655350net.netfilter.nf_conntrack_tcp_timeout_established=1200# 確保無人能修改路由表net.ipv4.conf.all.accept_redirects = 0net.ipv4.conf.default.accept_redirects = 0net.ipv4.conf.all.secure_redirects = 0net.ipv4.conf.default.secure_redirects = 0sysctl -p #生效14 時間設定yum install chronyvi /etc/chrony.confserver 0.centos.pool.ntp.orgserver 3.europe.pool.ntp.orgsystemctl enable chronyd.servicesystemctl start chronyd.servicetimedatectl set-timezone Asia/Shanghaitimedatectl set-time "2015-01-21 11:50:00"（可以只修改其中一個）修改日期時間timedatectl 檢視時間狀態chronyc sources -v 檢視時間同步源chronyc sourcestats -vhwclock -w #先同步一遍時間到硬體時間15、遠端5分鐘無操作自動登出:vim /etc/profile最後新增:export TMOUT=300   ---5分鐘自動登出下來找到HISTSIZE=1000修改為:HISTSIZE=100 --減少日記位元組為100KB,太大內容過多容易漏重要資訊.HISTTIMEFORMAT=”%Y-%m-%d %H:%M:%S”16.禁止IP偽裝vim /etc/host.conf在裡面加上：nospoof on17臨時檔案安全臨時檔案不應該有執行許可權/tmp/dev/sda3 /tmp ext4 nosuid，noexec，nodev，rw 0 0同時使用符號連線將/var/tmp 指向 /tmp/dev/shmnone /dev/shm tmpfs defaults，nosuid，noexec，rw 0 018 PAM 外掛認證加固配置配置檔案ls /etc/pam.d/chfn crond login passwd remote runuser-l smtp ssh-keycat sudo-i system-auth-acchsh fingerprint-auth newrole password-auth run_init smartcard-auth smtp.postfix su su-lconfig-util fingerprint-auth-ac other password-auth-ac runuser smartcard-auth-ac sshd sudo system-auth認證外掛ls /lib64/security/18.1. pam_tally2.so此模組的功能是，登陸錯誤輸入密碼3次，5分鐘後自動解禁，在未解禁期間輸入正確密碼也無法登陸。在配置檔案 /etc/pam.d/sshd 頂端加入auth required pam_tally2.so deny=3 onerr=fail unlock_time=300檢視失敗次數# pam_tally2Login Failures Latest failure Fromroot 14 07/12/13 15:44:37 192.168.6.2neo 8 07/12/13 15:45:36 192.168.6.2重置計數器# pam_tally2 -r -u rootLogin Failures Latest failure Fromroot 14 07/12/13 15:44:37 192.168.6.2# pam_tally2 -r -u neoLogin Failures Latest failure Fromneo 8 07/12/13 15:45:36 192.168.6.2pam_tally2 計數器日誌儲存在 /var/log/tallylog 注意，這是二進位制格式的檔案例 1. /etc/pam.d/sshd - pam_tally2.so# cat /etc/pam.d/sshd#%PAM-1.0auth required pam_tally2.so deny=3 onerr=fail unlock_time=300auth required pam_sepermit.soauth include password-authaccount required pam_nologin.soaccount include password-authpassword include password-auth# pam_selinux.so close should be the first session rulesession required pam_selinux.so closesession required pam_loginuid.so# pam_selinux.so open should only be followed by sessions to be executed in the user contextsession required pam_selinux.so open env_paramssession optional pam_keyinit.so force revokesession include password-auth以上配置root使用者不受限制, 如果需要限制root使用者，參考下面auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=180018.2. pam_listfile.so使用者登陸限制將下面一行新增到 /etc/pam.d/sshd 中，這裡採用白名單方式，你也可以採用黑名單方式auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail將允許登陸的使用者新增到 /etc/ssh/whitelist，除此之外的使用者將不能通過ssh登陸到你的系統# cat /etc/ssh/whitelistneowww例 2. /etc/pam.d/sshd - pam_listfile.so# cat /etc/pam.d/sshd#%PAM-1.0auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=failauth required pam_tally2.so deny=3 onerr=fail unlock_time=300auth required pam_sepermit.soauth include password-authaccount required pam_nologin.soaccount include password-authpassword include password-auth# pam_selinux.so close should be the first session rulesession required pam_selinux.so closesession required pam_loginuid.so# pam_selinux.so open should only be followed by sessions to be executed in the user contextsession required pam_selinux.so open env_paramssession optional pam_keyinit.so force revokesession include password-authsense=allow 白名單方式, sense=deny 黑名單方式auth required pam_listfile.so item=user sense=deny file=/etc/ssh/blacklist onerr=fail更多細節請檢視手冊 $ man pam_listfile18.3. pam_access.so編輯 /etc/pam.d/sshd 檔案，加入下面一行account required pam_access.so儲存後重啟sshd程序編輯 /etc/security/access.conf 檔案cat >> /etc/security/access.conf << EOF- : root : ALL EXCEPT 192.168.6.1EOF只能通過 192.168.6.1 登陸, 新增多個IP地址- : root : ALL EXCEPT 192.168.6.1 192.168.6.2測試是否生效18.4. pam_wheel.so限制普通使用者通過su命令提升許可權至root. 只有屬於wheel組的使用者允許通過su切換到root使用者編輯 /etc/pam.d/su 檔案，去掉下面的註釋auth required pam_wheel.so use_uid修改使用者組別，新增到wheel組# usermod -G wheel www# id wwwuid=501(www) gid=501(www) groups=501(www),10(wheel)沒有加入到wheel組的使用者使用su時會提示密碼不正確。$ su - rootPassword:su: incorrect password18.5設定使用者登入，普通使用者登入識別超過6次鎖定300s.echo "account required pam_tally.so deny=100 no_magic_root reset" >>/etc/pam.d/system-authecho "auth required pam_tally.so onerr=fail deny=6 unlock_time=300" >>/etc/pam.d/system-auth