Linux安全配置
1. 介绍
笔者发现每次登陆云服务器时都提示如下信息
There were xxx failed login attempts since the last successful login.
这让我非常诧异, 明显网络上有人尝试远程登陆云服务器.
2. 检测
首先我们可以使用nmap工具来检测服务器开发了哪些端口
注意在另一个Linux主机上运行, 这里设定云服务IP地址为A.A.A.A
# nmap A.A.A.A Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-02 15:24 CST Nmap scan report for A.A.A.A Host is up (0.013s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 445/tcp filtered microsoft-ds 3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 5.58 seconds
然后我们在云服务上查看本机监听了哪些端口
注意在云服务器运行
# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 6349/mysqld
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 7067/redis-server 1
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/rpcbind
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 479/sshd
tcp6 0 0 :::22 :::* LISTEN 479/sshd
3. 服务
端口之所以开放是由于服务器上运行了某些服务；下面的命令可以查看系统运行了哪些服务
# systemctl list-units --type=service UNIT LOAD ACTIVE SUB DESCRIPTION acpid.service loaded active running ACPI Event Daemon ... mariadb.service loaded active running MariaDB database server ● postfix.service loaded failed failed Postfix Mail Transport Agent redis.service loaded active running Redis persistent key-value database rpcbind.service loaded active running RPC bind service serial-getty@ttyS0.service loaded active running Serial Getty on ttyS0 sshd.service loaded active running OpenSSH server daemon tuned.service loaded active running Dynamic System Tuning Daemon LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 40 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'.
下面的命令可以关闭nfs服务和postfix服务
/* 关闭NFS服务 */ # systemctl disable rpcbind.service # systemctl stop rpcbind.service Warning: Stopping rpcbind.service, but it can still be activated by: rpcbind.socket
# systemctl disable rpcbind.socket # systemctl stop rpcbind.socket /* 关闭Postfix服务 */ # systemctl disable postfix.service # systemctl stop postfix.service
对于redis只允许本地访问, 不存在安全问题;
对于mysql(mariadb)其实也只是本地访问, 但是却开放了外网访问权限, 故而进行如下配置
# vi /etc/my.cnf [mysqld] ... bind-address=127.0.0.1 # systemctl restart mariadb
4. 防火墙
完成了上面的步骤之后, 排除了系统主动引起的安全问题, 而且操作起来比较繁琐
Linux比较常用的方法是采用防火墙, 也就是iptables(CentOS 7中称为firewalld)
Firewalld 提供了支持网络/防火墙区域(zone)定义网络链接以及接口安全等级的动态防火墙管理工具
它支持IPv4、IPv6防火墙设置以及以太网桥接, 并且拥有运行时配置和永久配置选项
它也支持允许服务或者应用程序直接添加防火墙规则的接口
firewall有预定义常见的服务, 以XML文件的方式存放在/usr/lib/firewalld/services/目录下
可以通过firewall-cmd命令方便地进行配置
下面的命令开放SSH服务然后启动Firewall
# systemctl start firewalld.service # systemctl enable firewalld.service # firewall-cmd --permanent --zone=public --add-service=ssh # firewall-cmd --reload
/* 检查设置是否生效 */
# iptables -L -n | grep 22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW
其他常用命令如下:
/* 暂时开放服务 */ # firewall-cmd --add-service=AAA /* 永久关闭服务 */ # firewall-cmd --remove-service=AAA --permanent /* 查询某个服务的状态 */ # firewall-cmd --query-service AAA yes(no) /* 临时开放某个Port */ # firewall-cmd --add-port=9527/tcp /* 检查防火墙状态 */ # firewall-cmd --state running(not running) /* 获取默认zone的设置 */ # firewall-cmd --list-all public (default, active) interfaces: em1 sources: services: dhcpv6-client http https samba ssh vnc-server ports: masquerade: no forward-ports: icmp-blocks: rich rules: /* 获取所有支持的服务,即/usr/lib/firewalld/services/中预配置的服务 */ # firewall-cmd --get-service RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind rsyncd samba samba-client smtp ssh telnet tftp tftp-client transmission-client vdsm vnc-server wbem-https
这里我们自定义服务ZZZ, 假设该服务需要开放TCP端口543和9999
在/usr/lib/firewalld/services/目录下新建文件zzz.XML, 其内容如下
# cat zzz.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>ZZZ</short> <description>Zzz is an ... service.</description> <port protocol="tcp" port="543"/> <port protocol="tcp" port="9999"/> </service>
然后启动该服务
# firewall-cmd --reload success # firewall-cmd --permanent --zone=public --add-service=zzz success # firewall-cmd --reload success # firewall-cmd --query-service=mosquitto yes # firewall-cmd --list-all public (default, active) interfaces: em1 sources: services: dhcpv6-client http https mosquitto samba ssh vnc-server ports: masquerade: no forward-ports: icmp-blocks: rich rules:
5. SSH配置
这里着重讨论一下SSH的安全问题, 之所以那么多的人尝试入侵别人的主机SSH服务, 关键在于SSH服务提供了最大的权限.
比如说本人的云服务器主机只有root用户, 一旦暴力登陆成功将可完全控制主机.
通常有如下方法
- 禁止root登陆, 只允许普通用户登陆
- 禁止密码登陆, 使用密钥登陆
- 改变SSH默认端口号
- 使用fail2ban软件
这里讨论一下修改SSH默认端口号的办法
/* 修改防火墙ssh配置文件 */ # vi /usr/lib/firewalld/services/ssh.xml <port protocol="tcp" port="22"/> ---> <port protocol="tcp" port="2222"/> /* 重启防火墙 */ # firewall-cmd --reload success # iptables -L -n | grep 2222 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 ctstate NEW
/* 修改ssh配置文件 */
# vi /etc/ssh/sshd_config
#Port 22
--->
Port 2222
/* 重启SSH服务 */ # systemctl restart sshd # netstat -tunlp | grep ssh tcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN 14608/sshd tcp6 0 0 :::2222 :::* LISTEN 14608/sshd
6. 十字节病毒
下面介绍一些处理十字节病毒的命令
/* 查看和删除启动项 */ # chkconfig --list | grep 3:on # chkconfig --del aanrvkddxb /* 查看和查找木马文件 */ # ls -al /tmp/rufgdrxggs -rwxr-xr-x 1 root root 625817 Nov 30 10:39 /tmp/rufgdrxggs # find / -size 625817c 2>/dev/null /usr/bin/xhtxqgdfyg /usr/bin/tfplppsppv /tmp/rufgdrxggs /* 查看进程 */ # pstree # lsof | grep 'eaxrgexwwx'
Linux开源杀毒软件: ClamAV
参考:
<为MariaDB配置远程访问权限>
<CentOS 7中firewall-cmd命令>
<用活firewalld防火墙中的zone>
<快速自检电脑是否被黑客入侵过(Linux版)>
<linux上使用netstat查看当前服务和监听端口>
<Linux Firewall (firewalld, firewall-cmd, firewall-config)>
<Red Hat Enterprise Linux-Security Guide-Using Firewalls>
