CentOS服务器简单安全配置

在前面的文章中我们已经完成了WEB类服务器的相关安装和配置，经过前面的安装配置之后我们就可以把网站代码放在服务器上让其他用户访问了，从今天开始连续几篇文章菠菜园将为朋友们带来服务器的安全维护。

服务器放在公网上供用户访问的同时也面临着各种各样的危险。所以我们还应该为服务器配置一些安全的策略以保障其正常的运行。下面这个脚本来自阿里云分享，大家可以将其复制保存之后，放在服务器上执行。为了让大家放心，菠菜园不直接提供可执行文件了，仅将源码分享如下：

  1. #!/bin/bash
  2. #########################################
  3.     #Function:    linux drop port
  4.     #Usage:       bash linux_drop_port.sh
  5.     #Author:      Customer Service Department
  6.     #Company:     Alibaba Cloud Computing
  7.     #Version:     2.0
  8. #########################################
  10.     check_os_release()
  11.     {
  12.      while true
  13.       do
  14.        os_release=$(grep "Red Hat Enterprise Linux Server release"/etc/issue 2>/dev/null)
  15.        os_release_2=$(grep "Red Hat Enterprise Linux Server release"/etc/redhat-release 2>/dev/null)
  16.        if [ "$os_release" ] && [ "$os_release_2" ]
  17.        then
  18.          if echo "$os_release"|grep "release 5" >/dev/null2>&1
  19.          then
  20.            os_release=redhat5
  21.            echo "$os_release"
  22.          elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  23.          then
  24.            os_release=redhat6
  25.            echo "$os_release"
  26.          else
  27.            os_release=""
  28.            echo "$os_release"
  29.          fi
  30.          break
  31.        fi
  32.        os_release=$(grep "Aliyun Linux release" /etc/issue2>/dev/null)
  33.        os_release_2=$(grep "Aliyun Linux release" /etc/aliyun-release2>/dev/null)
  34.        if [ "$os_release" ] && [ "$os_release_2" ]
  35.        then
  36.          if echo "$os_release"|grep "release 5" >/dev/null2>&1
  37.          then
  38.            os_release=aliyun5
  39.            echo "$os_release"
  40.          elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  41.          then
  42.            os_release=aliyun6
  43.            echo "$os_release"
  44.          else
  45.            os_release=""
  46.            echo "$os_release"
  47.          fi
  48.          break
  49.        fi
  50.        os_release=$(grep "CentOS release" /etc/issue 2>/dev/null)
  51.        os_release_2=$(grep "CentOS release" /etc/*release2>/dev/null)
  52.        if [ "$os_release" ] && [ "$os_release_2" ]
  53.        then
  54.          if echo "$os_release"|grep "release 5" >/dev/null2>&1
  55.          then
  56.            os_release=centos5
  57.             echo "$os_release"
  58.          elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  59.          then
  60.            os_release=centos6
  61.            echo "$os_release"
  62.          else
  63.            os_release=""
  64.            echo "$os_release"
  65.          fi
  66.          break
  67.        fi
  68.        os_release=$(grep -i "ubuntu" /etc/issue 2>/dev/null)
  69.        os_release_2=$(grep -i "ubuntu" /etc/lsb-release2>/dev/null)
  70.        if [ "$os_release" ] && [ "$os_release_2" ]
  71.        then
  72.          if echo "$os_release"|grep "Ubuntu 10" >/dev/null2>&1
  73.          then
  74.             os_release=ubuntu10
  75.            echo "$os_release"
  76.          elif echo "$os_release"|grep "Ubuntu 12.04">/dev/null 2>&1
  77.          then
  78.            os_release=ubuntu1204
  79.            echo "$os_release"
  80.          elif echo "$os_release"|grep "Ubuntu 12.10">/dev/null 2>&1
  81.           then
  82.            os_release=ubuntu1210
  83.            echo "$os_release"
  84.          else
  85.            os_release=""
  86.            echo "$os_release"
  87.          fi
  88.          break
  89.        fi
  90.        os_release=$(grep -i "debian" /etc/issue 2>/dev/null)
  91.        os_release_2=$(grep -i "debian" /proc/version 2>/dev/null)
  92.        if [ "$os_release" ] && [ "$os_release_2" ]
  93.        then
  94.          if echo "$os_release"|grep "Linux 6" >/dev/null2>&1
  95.          then
  96.            os_release=debian6
  97.            echo "$os_release"
  98.          else
  99.             os_release=""
  100.            echo "$os_release"
  101.          fi
  102.          break
  103.        fi
  104.        os_release=$(grep "openSUSE" /etc/issue 2>/dev/null)
  105.        os_release_2=$(grep "openSUSE" /etc/*release 2>/dev/null)
  106.        if [ "$os_release" ] && [ "$os_release_2" ]
  107.        then
  108.           if echo "$os_release"|grep"13.1" >/dev/null 2>&1
  109.          then
  110.            os_release=opensuse131
  111.            echo "$os_release"
  112.          else
  113.            os_release=""
  114.            echo "$os_release"
  115.          fi
  116.          break
  117.        fi
  118.        break
  119.        done
  120.     }
  122.     exit_script()
  123.     {
  124.      echo -e "\033[1;40;31mInstall $1 error,will exit.\n\033[0m"
  125.       rm-f $LOCKfile
  126.      exit 1
  127.     }
  129.     config_iptables()
  130.     {
  131.      iptables -I OUTPUT 1 -p tcp -m multiport --dport21,22,23,25,53,80,135,139,443,445 -j DROP
  132.      iptables -I OUTPUT 2 -p tcp -m multiport --dport 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186-j DROP
  133.      iptables -I OUTPUT 3 -p udp -j DROP
  134.      iptables -nvL
  135.     }
  137.     ubuntu_config_ufw()
  138.     {
  139.       ufwdeny out proto tcp to any port 21,22,23,25,53,80,135,139,443,445
  140.       ufwdeny out proto tcp to any port 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186
  141.       ufwdeny out proto udp to any
  142.       ufwstatus
  143.     }
  145.     ####################Start###################
  146.     #check lock file ,one time only let thescript run one time
  147.     LOCKfile=/tmp/.$(basename $0)
  148.     if [ -f "$LOCKfile" ]
  149.     then
  150.      echo -e "\033[1;40;31mThe script is already exist,please next timeto run this script.\n\033[0m"
  151.      exit
  152.     else
  153.      echo -e "\033[40;32mStep 1.No lock file,begin to create lock fileand continue.\n\033[40;37m"
  154.      touch $LOCKfile
  155.     fi
  156.     #check user
  157.     if [ $(id -u) != "0" ]
  158.     then
  159.      echo -e "\033[1;40;31mError: You must be root to run this script,please use root to execute this script.\n\033[0m"
  160.       rm-f $LOCKfile
  161.      exit 1
  162.     fi
  163.     echo -e "\033[40;32mStep 2.Begen tocheck the OS issue.\n\033[40;37m"
  164.     os_release=$(check_os_release)
  165.     if [ "X$os_release" =="X" ]
  166.     then
  167.      echo -e "\033[1;40;31mThe OS does not identify,So this script isnot executede.\n\033[0m"
  168.       rm-f $LOCKfile
  169.      exit 0
  170.     else
  171.      echo -e "\033[40;32mThis OS is $os_release.\n\033[40;37m"
  172.     fi
  174.     echo -e "\033[40;32mStep 3.Begen toconfig firewall.\n\033[40;37m"
  175.     case "$os_release" in
  176.     redhat5|centos5|redhat6|centos6|aliyun5|aliyun6)
  177.      service iptables start
  178.      config_iptables
  179.       ;;
  180.     debian6)
  181.      config_iptables
  182.       ;;
  183.     ubuntu10|ubuntu1204|ubuntu1210)
  184.       ufwenable <<EOF
  185.     y
  186.     EOF
  187.      ubuntu_config_ufw
  188.       ;;
  189.     opensuse131)
  190.      config_iptables
  191.       ;;
  192.     esac
  193.     echo -e "\033[40;32mConfig firewallsuccess,this script now exit!\n\033[40;37m"
  194.     rm -f $LOCKfile

二、设置访问限制策略：

  1. /sbin/iptables -P INPUT ACCEPT
  2. /sbin/iptables -F
  3. /sbin/iptables -X
  4. /sbin/iptables -Z
  6.  /sbin/iptables -A INPUT -i lo -j ACCEPT
  7.  /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
  8.  /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  9. /sbin/iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
  10.  /sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
  11. /sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
  12. /sbin/iptables -P INPUT DROP
  13. service iptables save

在设置访问限制策略的时候一定要注意web访问需要的80端口，SSH连接需要用到的22端口，FTP用到的21端口都要保留，当然也可以更改，不过更改之后一定要注意访问问题，不然远程桌面无法访问的话只能联系机房了。iptable详细设置步骤参考

经过以上设置之后，CentOS的简单安全配置就可以了。下一篇菠菜园将通过实例教大家如何修改SSH远程端口以防止黑客简单猜测破解。

 

  • 版权声明： 本文源自 菠菜园， 于8年前，由整理发表，共 6644字。
  • 原文链接：点此查看原文
你想把广告放到这里吗？

发表评论

您必须 登录 才能发表留言！