返回列表 发帖

系统安全

Linux下挂载U盘:
lsblk   #查看哪个是U盘设备
mount /dev/sda1 /mnt/  #挂载U盘


###

禁止使用U盘:( 让安装 usb-storage 模块的操作实际上变成运行 /bin/true )
[root@Zabbix_server_01 ~]# echo "install usb-storage /bin/true" >> /etc/modprobe.d/usb-storage.conf

[root@Zabbix_server_01 ~]# cat /etc/modprobe.d/usb-storage.conf
install usb-storage /bin/true






###

禁止Alt+Ctrl+Del键盘组合键,防止恶意或误操作导致系统重启。
/etc/init/control-alt-delete.conf文件的默认样子:
[root@Zabbix_server_01 ~]# cat /etc/init/control-alt-delete.conf
# control-alt-delete - emergency keypress handling
#
# This task is run whenever the Control-Alt-Delete key combination is
# pressed.  Usually used to shut down the machine.
#
# Do not edit this file directly. If you want to change the behaviour,
# please create a file control-alt-delete.override and put your changes there.

start on control-alt-delete

exec /sbin/shutdown -r now "Control-Alt-Delete pressed"



配置方法:(把对应的行注释掉)
[root@Zabbix_server_01 ~]# sed -i 's,^start.*,#start on control-alt-delete,' /etc/init/control-alt-delete.conf

[root@Zabbix_server_01 ~]# sed -i 's,^exec.*,#exec /sbin/shutdown -r now "Control-Alt-Delete pressed",' /etc/init/control-alt-delete.conf


完成的效果:
[root@Zabbix_server_01 ~]# cat /etc/init/control-alt-delete.conf
# control-alt-delete - emergency keypress handling
#
# This task is run whenever the Control-Alt-Delete key combination is
# pressed.  Usually used to shut down the machine.
#
# Do not edit this file directly. If you want to change the behaviour,
# please create a file control-alt-delete.override and put your changes there.

#start on control-alt-delete

#exec /sbin/shutdown -r now "Control-Alt-Delete pressed"








###

关闭图像界面:(将系统运行级别设置为3)
[root@Zabbix_server_01 ~]# sed -i 's/^id:.*/id:3:initdefault:/g' /etc/inittab

[root@Zabbix_server_01 ~]# tail -9 /etc/inittab
#   0 - halt (Do NOT set initdefault to this)
#   1 - Single user mode
#   2 - Multiuser, without NFS (The same as 3, if you do not have networking)
#   3 - Full multiuser mode
#   4 - unused
#   5 - X11
#   6 - reboot (Do NOT set initdefault to this)
#
id:3:initdefault:

备注:
0:关机状态(使用此级别时将会关闭主机)
1:单用户模式(不需要密码验证即可登录系统,多用于系统维护)
2:字符界面的多用户模式(不支持访问网络)
3:字符界面的完整多用户模式(默认运行级别)
4:未分配使用
5:图形界面的多用户模式(提供了图形桌面操作环境)
6:重新启动(使用此级别时将会重启主机)







###

禁止DNS反向解析:

[root@Zabbix_server_01 ~]# cat /etc/ssh/sshd_config |grep UseDNS
#UseDNS yes

[root@Zabbix_server_01 ~]# sed -i 's/^[#]\{0,1\}UseDNS.*/UseDNS no/' /etc/ssh/sshd_config

[root@Zabbix_server_01 ~]# cat /etc/ssh/sshd_config |grep UseDNS
UseDNS no







###

设置Banner登录信息:

[root@Zabbix_server_01 ~]# cat /etc/ssh/sshd_config |grep Banner
#Banner none

[root@Zabbix_server_01 ~]# sed -i "s/^[#]\{0,1\}Banner.*/Banner \/etc\/redhat-release/g"  /etc/ssh/sshd_config

[root@Zabbix_server_01 ~]# cat /etc/ssh/sshd_config |grep Banner
Banner /etc/redhat-release

[root@Zabbix_server_01 ~]# service sshd restart
停止 sshd:[确定]
正在启动 sshd:[确定]


效果:
图片1.png






###

系统默认的登录提示信息是这样子的:
图片2.png

修改信息:
mv /etc/issue /etc/issue.bak
mv /etc/issue.net /etc/issue.net.bak
echo 'hello.' > /etc/issue
echo 'welcome to zhuohua.' >> /etc/issue

echo 'hello.' > /etc/issue.net
echo 'welcome to zhuohua.' >> /etc/issue.net

图片6.png


效果:(无需重启系统即可生效)
图片3.png








###

查询当前登录了的用户:
[root@Zabbix_server_01 ~]# users
root root zhuohua

[root@Zabbix_server_01 ~]# who
zhuohua tty1         2020-02-08 12:06
root     pts/0        2020-02-08 11:58 (192.168.168.159)
root     pts/1        2020-02-08 12:05 (192.168.168.159)
注释:
tty1 是在服务器本地登录
pts/0、pts/1 是在客户端远程SSH登录

[root@Zabbix_server_01 ~]# w
12:06:45 up 11 min,  3 users,  load average: 0.19, 0.05, 0.01
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
zhuohua  tty1     -                12:06   41.00s  0.00s  0.00s -bash
root     pts/0    192.168.168.159  11:58    0.00s  0.03s  0.00s w
root     pts/1    192.168.168.159  12:05    4.00s  0.02s  0.02s top




查询成功登录的用户的历史记录:
last
图片4.png



查询登录失败的用户记录:
lastb
图片5.png








###

禁止普通用户登录系统:
[root@Zabbix_server_01 ~]# touch /etc/nologin
[root@Zabbix_server_01 ~]#
[root@Zabbix_server_01 ~]# ll /etc/nologin
-rw-r--r-- 1 root root 0 2月   8 12:15 /etc/nologin

笺注:
本地登录、远程SSH登录都是不行的,但已经登录的用户不受影响;
这种方法不会影响用户root


允许普通用户正常登录系统:
[root@Zabbix_server_01 ~]# rm -rf /etc/nologin




相关文章:
日志文件
sed命令
进程



#################################
#################################
亲,学习研究也要劳逸结合哦,来我微店逛逛,买点东西好好犒劳犒劳自己和家人吧^_^^_^


苏泊尔电压力锅家用智能5L高压饭煲特价
dianfanbao.png


苏泊尔电磁炉火锅家用智能正品学生电池炉灶特价炒菜
diancilu.png


苏泊尔电蒸锅多功能家用蒸气锅三层大容量电蒸笼蒸锅蒸菜自动断电
dianzhengguo.png

返回列表