https://www.clearsec.org/wikis/docs/reinforce/%E7%BB%88%E7%AB%AF/Recent content in 终端 on ClearSec WikiHugozh-cnFri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/docs/reinforce/%E7%BB%88%E7%AB%AF/13%E9%BA%92%E9%BA%9F%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F%E7%AD%89%E4%BF%9D%E7%9A%84%E5%8A%A0%E5%9B%BA/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/docs/reinforce/%E7%BB%88%E7%AB%AF/13%E9%BA%92%E9%BA%9F%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F%E7%AD%89%E4%BF%9D%E7%9A%84%E5%8A%A0%E5%9B%BA/<h1 id="设置密码策略">设置密码策略</h1> <p>chage -m 8 -M 90 -W 7 username</p> <h2 id="设置登录限制及锁定">设置登录限制及锁定</h2> <p>pam_tally2 &ndash;user username &ndash;reset</p> <p>pam_tally2 &ndash;user username &ndash;deny=5 &ndash;lock-time=600</p> <h2 id="设置登录空闲超时">设置登录空闲超时</h2> <p>TMOUT=1800</p> <p>export TMOUT</p> <h2 id="建立三个账户并实现权限分离">建立三个账户并实现权限分离</h2> <p>useradd qwer</p> <p>useradd qazx</p> <p>useradd wsxc</p> <p>usermod -G wheel qwer</p> <p>usermod -G wheel qazx</p> <p>usermod -G wheel wsxc</p> <h2 id="删除无用的账户">删除无用的账户</h2> <p>userdel username</p> <h2 id="禁止root远程登录">禁止root远程登录</h2> <p>sed -i &rsquo;s/PermitRootLogin yes/PermitRootLogin no/g&rsquo; /etc/ssh/sshd_config</p> <p>systemctl restart sshd</p> <h2 id="开启ssh关闭telnet">开启SSH，关闭Telnet</h2> <p>systemctl enable sshd</p> <p>systemctl disable telnet</p> <h2 id="关闭未使用的端口">关闭未使用的端口</h2> <p>firewall-cmd &ndash;zone=public &ndash;add-port=port/protocol &ndash;permanent</p> <p>firewall-cmd &ndash;reload</p> <h2 id="配置登录限制及白名单">配置登录限制及白名单</h2> <p>iptables -A INPUT -p icmp -j ACCEPT</p>