Linux(RHEL5)系统安全常规优化（Linux (RHEL5) system security routine optimization）.docVIP

Linux(RHEL5)系统安全常规优化（Linux (RHEL5) system security routine optimization） Basic safety measures 1. Delete or disable users and groups that are not used in the system # passwd-l wang / / disables wang # passwd - u wang / / unlock account wang or Vi /etc/shadow/shadow/save: wq! Because the file is read only Add two exclamation points before password characters! 2. Verify that the login shell for the program or service is not available # vi /etc/passwd / / change the users login shell to/sbin/nologin or # usermod-s/sbin/nologin wang 3. Limit user password validity (maximum days) # vi /etc/login.defs / / is valid for the newly created user PASS_MAX_DAYS 30 or # chage-m 30 wang / / only valid for existing wang users 4. The password must be changed when the user logs in next time # chage - d 0 wang or # vi/etc/shadow / / set the value of the wang user LAST DAY (colon: split third column) in the shadow file to 0 5. Limit the minimum length of user passwords # vi/etc/PAM. D/system - auth The password requisite pam_cracklib. So try_first_pass retry = 3 minlen = 12 Retry retry time minlen security level 6. Limit the number of history of command recording # vi/etc/profile HISTSIZE = 50 (by default 1000) The history of the command is cleared when the history-c ~ /.bash_logout / / logout/logout 7. Set idle timeout automatic cancellation terminal # vi/etc/profile Export TMOUT = 600 / / add this trip using SU to switch user identity Su [-] username [-] difference: Use: equivalent to - login, means to use the target users login shell environment, working directory, PATH variable, etc Not to use: to maintain the original use of environmental inconvenience The case illustrates the use of su Allow wang users to switch from the su command to root to perform administrative tasks Other users are prohibited from using the su command to switch using identity (1) users will be allowed to join the wheel group # gpasswd - a wang wheel # id wang / / check the additional groups of wang users (2)