[草稿]等保三级整改加固之ubuntu系统
今天接到一个客户提供的《xxx平台-网络安全等级保护整改建议书》，基于此报告在 Ubuntu 24.04 上进行了测试（以下脚本支持重复执行），由于仅对部分检查项进行了整改，所以还不完善，以后再补充吧。
1.身份鉴别
- 1.1 [中风险] 应对登录的用户进行身份标识和鉴别，身份标识具有唯一性，身份鉴别信息具有复杂度要求并定期更换
#.1.要求用户口令长度至少8位以上，每90天修改口令
cp -p /etc/login.defs /bak.login.defs.`date +%Y%m%d%H%M%s`
sed -i "s/#PASS_WARN_AGE/PASS_WARN_AGE/" /etc/login.defs
sed -i "s/#PASS_MAX_DAYS/PASS_MAX_DAYS/" /etc/login.defs
sed -i "s/#PASS_MIN_LEN/PASS_MIN_LEN/" /etc/login.defs
sed -i "s/#PASS_MIN_DAYS/PASS_MIN_DAYS/" /etc/login.defs
sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE 14/g' /etc/login.defs
sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 90/g' /etc/login.defs
sed -i 's/^PASS_MIN_LEN.*/PASS_MIN_LEN 8/g' /etc/login.defs
sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS 7/g' /etc/login.defs
cat /etc/login.defs | grep "^PASS"
#.2.要求口令由数字、字母和特殊字符中3种或3种以上的方式组成
apt update
apt install -y libpam-pwquality
cp -p /etc/security/pwquality.conf /bak.pwquality.conf.`date +%Y%m%d%H%M%s`
sed -i "s/# minlen/minlen/" /etc/security/pwquality.conf
sed -i "s/# minclass/minclass/" /etc/security/pwquality.conf
sed -i "s/# retry/retry/" /etc/security/pwquality.conf
sed -i 's/^minlen.*/minlen=8/g' /etc/security/pwquality.conf
sed -i 's/^minclass.*/minclass=3/g' /etc/security/pwquality.conf
sed -i 's/^retry.*/retry=5/g' /etc/security/pwquality.conf
cat /etc/security/pwquality.conf | egrep "(minlen|minclass|retry)"
#.3.配置PAM模块确保PAM配置调用pam_pwquality模块
cp -p /etc/pam.d/common-password /bak.common-password.`date +%Y%m%d%H%M%s`
sed -i '/^password/d' /etc/pam.d/common-password
echo "password requisite pam_pwquality.so retry=3 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1" >> /etc/pam.d/common-password
echo "password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt" >> /etc/pam.d/common-password
echo "password requisite pam_deny.so" >> /etc/pam.d/common-password
echo "password required pam_permit.so" >> /etc/pam.d/common-password
cat /etc/pam.d/common-password | grep "^password"
- 1.2 [中风险] 应具有登录失败处理功能，应配置并启用结束会话、限制非法登录次数和当登录连接超时自动退出等相关措施
#.1.设置定时自动登出
cp -p /etc/profile /bak.profile.`date +%Y%m%d%H%M%s`
sed -i '/^TMOUT/d' /etc/profile
echo "TMOUT=499" >> /etc/profile
echo "readonly TMOUT" >> /etc/profile
echo "export TMOUT" >> /etc/profile
source /etc/profile
export | grep TMOUT
#.2.设置远程SSH登录超时:15分钟
cp -p /etc/ssh/sshd_config /bak.sshd_config.`date +%Y%m%d%H%M%s`
sed -i "s/#ClientAliveInterval/ClientAliveInterval/" /etc/ssh/sshd_config
sed -i "s/#ClientAliveCountMax/ClientAliveCountMax/" /etc/ssh/sshd_config
sed -i 's/^ClientAliveInterval.*/ClientAliveInterval=60/g' /etc/ssh/sshd_config
sed -i 's/^ClientAliveCountMax.*/ClientAliveCountMax=15/g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config | egrep "(ClientAliveInterval|ClientAliveCountMax)"
systemctl restart ssh.service
#.3.失败登录超过5次则锁定10分钟
cp -p /etc/security/faillock.conf /bak.faillock.conf.`date +%Y%m%d%H%M%s`
sed -i "s/# deny/deny/" /etc/security/faillock.conf
sed -i "s/# fail_interval/fail_interval/" /etc/security/faillock.conf
sed -i "s/# unlock_time/unlock_time/" /etc/security/faillock.conf
sed -i 's/^deny.*/deny=5/g' /etc/security/faillock.conf
sed -i 's/^fail_interval.*/fail_interval=900/g' /etc/security/faillock.conf
sed -i 's/^unlock_time.*/unlock_time=600/g' /etc/security/faillock.conf
cat /etc/security/faillock.conf | egrep "(^deny|^fail_interval|^unlock_time)"
cp -p /etc/pam.d/common-auth /bak.common-auth.`date +%Y%m%d%H%M%s`
sed -i '/^auth.*pam_faillock.so.*/d' /etc/pam.d/common-auth
sed -i '1i auth required pam_faillock.so preauth silent audit deny=5 unlock_time=600' /etc/pam.d/common-auth
cat /etc/pam.d/common-auth | grep "^auth"
cp -p /etc/pam.d/common-account /bak.common-auth.`date +%Y%m%d%H%M%s`
sed -i '/^account.*pam_faillock.so.*/d' /etc/pam.d/common-account
echo "account required pam_faillock.so" >> /etc/pam.d/common-account
cat /etc/pam.d/common-account | grep "^account"
#.重启服务
systemctl restart ssh.service
2.恶意代码防范
- 2.1. [高风险] 应采用免受恶意代码攻击的技术措施或主动免疫可信验证机制及时识别入侵和病毒行为，并将其有效阻断
#.建议：安装诸如ClamAV之类的杀毒软件
#.参考：https://wiki.sqlfans.cn/infosec/vul-scan-clamav.html