Linux学习总结（72）——Linux系统安全加固

#!/bin/bash
 
#设置密码复杂度
if [ -z "`cat /etc/pam.d/system-auth | grep -v "^#" | grep "pam_cracklib.so"`" ];then
  sed -i '/password    required      pam_deny.so/a\password    required      pam_cracklib.so  try_first_pass minlen=8 ucredit=-1   lcredit=-1   ocredit=-1 dcredit=-1 retry=3 difok=5' /etc/pam.d/system-auth
fi
#密码输入失败3次，锁定5分钟
sed -i 's#auth        required      pam_env.so#auth        required      pam_env.so\nauth       required       pam_tally.so  onerr=fail deny=3 unlock_time=300\nauth           required     /lib/security/$ISA/pam_tally.so onerr=fail deny=3 unlock_time=300#' /etc/pam.d/system-auth
 
#修改默认访问权限
sed -i '/UMASK/s/077/027/' /etc/login.defs
 
#设置重要文件目录权限
chmod 644 /etc/passwd 
chmod 600 /etc/xinetd.conf
chmod 600 /etc/inetd.conf 
chmod 644 /etc/group 
chmod 000 /etc/shadow 
chmod 644 /etc/services 
chmod 600 /etc/security