LINUX安全加固手册

LINUX安全加固手册

目 录

LINUX安全加固手册 .......................................................................................................................................................................... 1

1概述 ..................................................................................................................................................................................................... 2

2 安装 .................................................................................................................................................................................................... 2

3 用户帐号安全Password and account security .................................................................................................................................. 3

3.1 密码安全策略 ......................................................................................................................................................................... 3

3.2 检查密码是否安全 ................................................................................................................................................................. 4

3.3 Password Shadowing ............................................................................................................................................................... 4

3.4 管理密码 ................................................................................................................................................................................. 4

3.5 其它 ......................................................................................................................................................................................... 5

4 网络服务安全(Network Service Security) ........................................................................................................................................ 7

4.1服务过滤Filtering ................................................................................................................................................................... 8

4.2 /etc/ ................................................................................................................................................................... 10

4.3 R 服务 ............................................................................................................................................................................. 11

4.4 Tcp_wrapper ..................................................................................................................................................................... 12

4.5 /etc/ 文件 ....................................................................................................................................................... 13

4.6 /etc/services ............................................................................................................................................................................ 14

4.7 /etc/aliases ........................................................................................................................................................................ 15

4.8 NFS ........................................................................................................................................................................................ 15

4.9 Trivial ftp (tftp) ................................................................................................................................................................ 17

4.10 Sendmail ............................................................................................................................................................................... 17

4.11 finger .................................................................................................................................................................................... 19

4.12 UUCP ............................................................................................................................................................................... 19

4.13 World Wide Web (WWW) – httpd ................................................................................................................................... 20

4.14 FTP安全问题 .................................................................................................................................................................. 21

5 系统设置安全(System Setting Security) ..................................................................................................................................... 23

5.1限制控制台的使用 ................................................................................................................................................................ 23

5.2系统关闭Ping ....................................................................................................................................................................... 24

5.3关闭或更改系统信息 ............................................................................................................................................................ 24

5.4 /etc/securetty文件 ................................................................................................................................................................. 25

5.5 /etc/文件 ................................................................................................................................................................. 26

5.6禁止IP源路径路由 .............................................................................................................................................................. 27

5.7资源限制 ................................................................................................................................................................................ 27

5.8 LILO安全 .............................................................................................................................................................................. 28

5.9 Control-Alt-Delete 键盘关机命令 ....................................................................................................................................... 30

5.10日志系统安全 ...................................................................................................................................................................... 31

5.11修正脚本文件在“/etc/rc.d/init.d”目录下的权限 ................................................................................................................ 31

6 文件系统安全(File System Security) .......................................................................................................................................... 31

6.1文件权限 ................................................................................................................................................................................ 31

6.2控制mount上的文件系统 .................................................................................................................................................... 33

6.3备份与恢复 ............................................................................................................................................................................ 33

7 其它 .............................................................................................................................................................................................. 34

7.1使用防火墙 ............................................................................................................................................................................ 34

7.2使用第三方安全工具 ............................................................................................................................................................ 34

1概述

近几年来Internet变得更加不安全了。网络的通信量日益加大，越来越多的重要交易正在

通过网络完成，与此同时数据被损坏、截取和修改的风险也在增加。

只要有值得偷窃的东西就会有想办法窃取它的人。Internet的今天比过去任何时候都更真

实地体现出这一点，基于Linux的系统也不能摆脱这个“普遍规律”而独善其身。因此，优秀

的系统应当拥有完善的安全措施，应当足够坚固、能够抵抗来自Internet的侵袭，这正是Linux

之所以流行并且成为Internet骨干力量的主要原因。但是，如果你不适当地运用Linux的安全

工具，它们反而会埋下隐患。配置拙劣的安全系统会产生许多问题，本文将为你解释必须掌握

的Linux安全知识。 本文讲述了如何通过基本的安全措施，使Linux系统变得可靠。

2 安装

使系统处于单独（或隔离）的网络中。以防止未受保护的系统连接到其它网络或互联网中

受到可能的攻击

安装完成后将下面软件卸载

pump apmd lsapnptools redhat-logos

mt-st kernel-pcmcia-cs Setserial redhat-relese

LINUX安全加固手册 第 2 页 共 34 页