hardening
installsforks
How to install hardening?
chaterm/terminal-skills/hardening
$npx -y skills add chaterm/terminal-skills --skill hardening系统加固
SKILL.md
| 1 | # 系统加固 |
| 2 | |
| 3 | ## 概述 |
| 4 | 系统加固、基线配置、CIS 标准技能。 |
| 5 | |
| 6 | ## SSH 加固 |
| 7 | |
| 8 | ### 配置优化 |
| 9 | ```bash |
| 10 | # /etc/ssh/sshd_config |
| 11 | # 禁用 root 登录 |
| 12 | PermitRootLogin no |
| 13 | |
| 14 | # 禁用密码认证 |
| 15 | PasswordAuthentication no |
| 16 | PubkeyAuthentication yes |
| 17 | |
| 18 | # 限制用户 |
| 19 | AllowUsers admin deploy |
| 20 | AllowGroups sshusers |
| 21 | |
| 22 | # 修改端口 |
| 23 | Port 2222 |
| 24 | |
| 25 | # 超时设置 |
| 26 | ClientAliveInterval 300 |
| 27 | ClientAliveCountMax 2 |
| 28 | |
| 29 | # 禁用空密码 |
| 30 | PermitEmptyPasswords no |
| 31 | |
| 32 | # 协议版本 |
| 33 | Protocol 2 |
| 34 | |
| 35 | # 日志级别 |
| 36 | LogLevel VERBOSE |
| 37 | ``` |
| 38 | |
| 39 | ### 应用配置 |
| 40 | ```bash |
| 41 | # 检查配置 |
| 42 | sshd -t |
| 43 | |
| 44 | # 重启服务 |
| 45 | systemctl restart sshd |
| 46 | ``` |
| 47 | |
| 48 | ## 内核参数加固 |
| 49 | |
| 50 | ### sysctl 配置 |
| 51 | ```bash |
| 52 | # /etc/sysctl.d/99-security.conf |
| 53 | |
| 54 | # 禁用 IP 转发 |
| 55 | net.ipv4.ip_forward = 0 |
| 56 | |
| 57 | # 禁用 ICMP 重定向 |
| 58 | net.ipv4.conf.all.accept_redirects = 0 |
| 59 | net.ipv4.conf.default.accept_redirects = 0 |
| 60 | net.ipv4.conf.all.send_redirects = 0 |
| 61 | |
| 62 | # 启用 SYN Cookie |
| 63 | net.ipv4.tcp_syncookies = 1 |
| 64 | |
| 65 | # 忽略 ICMP 广播 |
| 66 | net.ipv4.icmp_echo_ignore_broadcasts = 1 |
| 67 | |
| 68 | # 禁用源路由 |
| 69 | net.ipv4.conf.all.accept_source_route = 0 |
| 70 | |
| 71 | # 启用反向路径过滤 |
| 72 | net.ipv4.conf.all.rp_filter = 1 |
| 73 | net.ipv4.conf.default.rp_filter = 1 |
| 74 | |
| 75 | # 记录可疑包 |
| 76 | net.ipv4.conf.all.log_martians = 1 |
| 77 | |
| 78 | # 禁用 IPv6（如不需要） |
| 79 | net.ipv6.conf.all.disable_ipv6 = 1 |
| 80 | ``` |
| 81 | |
| 82 | ### 应用配置 |
| 83 | ```bash |
| 84 | sysctl -p /etc/sysctl.d/99-security.conf |
| 85 | ``` |
| 86 | |
| 87 | ## 用户安全 |
| 88 | |
| 89 | ### 密码策略 |
| 90 | ```bash |
| 91 | # /etc/login.defs |
| 92 | PASS_MAX_DAYS 90 |
| 93 | PASS_MIN_DAYS 7 |
| 94 | PASS_MIN_LEN 12 |
| 95 | PASS_WARN_AGE 14 |
| 96 | |
| 97 | # /etc/security/pwquality.conf |
| 98 | minlen = 12 |
| 99 | dcredit = -1 |
| 100 | ucredit = -1 |
| 101 | ocredit = -1 |
| 102 | lcredit = -1 |
| 103 | ``` |
| 104 | |
| 105 | ### 账户锁定 |
| 106 | ```bash |
| 107 | # /etc/pam.d/common-auth (Debian) |
| 108 | auth required pam_tally2.so deny=5 unlock_time=900 |
| 109 | |
| 110 | # /etc/pam.d/system-auth (RHEL) |
| 111 | auth required pam_faillock.so preauth deny=5 unlock_time=900 |
| 112 | auth required pam_faillock.so authfail deny=5 unlock_time=900 |
| 113 | ``` |
| 114 | |
| 115 | ### 清理无用账户 |
| 116 | ```bash |
| 117 | # 锁定账户 |
| 118 | usermod -L username |
| 119 | passwd -l username |
| 120 | |
| 121 | # 禁用 shell |
| 122 | usermod -s /sbin/nologin username |
| 123 | |
| 124 | # 查找无密码账户 |
| 125 | awk -F: '($2 == "") {print $1}' /etc/shadow |
| 126 | ``` |
| 127 | |
| 128 | ## 文件权限 |
| 129 | |
| 130 | ### 关键文件 |
| 131 | ```bash |
| 132 | # 设置权限 |
| 133 | chmod 600 /etc/shadow |
| 134 | chmod 644 /etc/passwd |
| 135 | chmod 600 /etc/gshadow |
| 136 | chmod 644 /etc/group |
| 137 | chmod 700 /root |
| 138 | chmod 600 /boot/grub/grub.cfg |
| 139 | |
| 140 | # 设置属性 |
| 141 | chattr +i /etc/passwd |
| 142 | chattr +i /etc/shadow |
| 143 | ``` |
| 144 | |
| 145 | ### 查找问题文件 |
| 146 | ```bash |
| 147 | # 查找 SUID/SGID 文件 |
| 148 | find / -perm /4000 -type f 2>/dev/null |
| 149 | find / -perm /2000 -type f 2>/dev/null |
| 150 | |
| 151 | # 查找无主文件 |
| 152 | find / -nouser -o -nogroup 2>/dev/null |
| 153 | |
| 154 | # 查找全局可写文件 |
| 155 | find / -perm -002 -type f 2>/dev/null |
| 156 | ``` |
| 157 | |
| 158 | ## 服务加固 |
| 159 | |
| 160 | ### 禁用不必要服务 |
| 161 | ```bash |
| 162 | # 查看服务 |
| 163 | systemctl list-unit-files --type=service |
| 164 | |
| 165 | # 禁用服务 |
| 166 | systemctl disable telnet |
| 167 | systemctl disable rsh |
| 168 | systemctl disable rlogin |
| 169 | systemctl disable vsftpd |
| 170 | |
| 171 | # 停止服务 |
| 172 | systemctl stop telnet |
| 173 | ``` |
| 174 | |
| 175 | ### 限制 cron |
| 176 | ```bash |
| 177 | # 只允许特定用户 |
| 178 | echo "root" > /etc/cron.allow |
| 179 | chmod 600 /etc/cron.allow |
| 180 | rm -f /etc/cron.deny |
| 181 | ``` |
| 182 | |
| 183 | ## 常见场景 |
| 184 | |
| 185 | ### 场景 1：快速加固脚本 |
| 186 | ```bash |
| 187 | #!/bin/bash |
| 188 | echo "=== 系统加固 ===" |
| 189 | |
| 190 | # SSH 加固 |
| 191 | sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config |
| 192 | sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config |
| 193 | |
| 194 | # 内核参数 |
| 195 | cat >> /etc/sysctl.d/99-security.conf << EOF |
| 196 | net.ipv4.tcp_syncookies = 1 |
| 197 | net.ipv4.conf.all.accept_redirects = 0 |
| 198 | net.ipv4.conf.all.rp_filter = 1 |
| 199 | EOF |
| 200 | sysctl -p /etc/sysctl.d/99-security.conf |
| 201 | |
| 202 | # 文件权限 |
| 203 | chmod 600 /etc/shadow |
| 204 | chmod 644 /etc/passwd |
| 205 | |
| 206 | echo "加固完成" |
| 207 | ``` |
| 208 | |
| 209 | ### 场景 2：CIS 基线检查 |
| 210 | ```bash |
| 211 | #!/bin/bash |
| 212 | echo "=== CIS 基线检查 ===" |
| 213 | |
| 214 | # 检查 SSH 配置 |
| 215 | echo "SSH PermitRootLogin:" |
| 216 | grep "^PermitRootLogin" /etc/ssh/sshd_config |
| 217 | |
| 218 | # 检查密码策略 |
| 219 | echo "密码最大有效期:" |
| 220 | grep "^PASS_MAX_DAYS" /etc/login.defs |
| 221 | |
| 222 | # 检查内核参数 |
| 223 | echo "TCP SYN Cookie:" |
| 224 | sysctl net.ipv4.tcp_syncookies |
| 225 | ``` |
| 226 | |
| 227 | ## 加固检查清单 |
| 228 | |
| 229 | | 项目 | 检查内容 | |
| 230 | |------|----------| |
| 231 | | SSH | 禁用 root、密钥认证 | |
| 232 | | 密码 | 复杂度、有效期 | |
| 233 | | 内核 | sysctl 安全参数 | |
| 234 | | 服务 | 禁用不必要服务 | |
| 235 | | 权限 | 关键文件权限 | |
| 236 | | 日志 | 审计日志启用 | |
| 237 | |
| 238 | ## 故障排查 |
| 239 | |
| 240 | ```bash |
| 241 | # SSH 无法登录 |
| 242 | journalctl -u sshd -f |
| 243 | tail -f /var/log/auth.log |
| 244 | |
| 245 | # 检查 PAM 配置 |
| 246 | cat /etc/pam.d/sshd |
| 247 | |
| 248 | # 检查 SELinux |
| 249 | getenforce |
| 250 | ausearch -m avc -ts recent |
| 251 | ``` |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
