二季度离线检查湛江网管维护中心合规结果

三、查信息合数不合量查数合率130230330440560660760870三、查信息合数不合量查数合率130230330440560660760870合数不合数查数合率4404401GDGZ-设备IP:统->Solaris1GDGZ-设备IP:统->Solarisftp等用权限最小化判断条件：查看#cat明：在个列表里边的用户名是不允ftp登#注。查间：2014-06-27#bms-prompt#tcp|grep-ilisten|grep"*.21\>"|wc-l`#bms-prompt#if([`uname-r|cut-d\.-f2`=8]);root@GDGZ-PB-DB002-WAP20>thenroot@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>FTPUSERS="/etc/ftpusers";root@GDGZ-PB-DB002-WAP20>elseroot@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>fi#bms-prompt#Check_ftpusers()root@GDGZ-PB-DB002-WAP20>{root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>foruserinadmbindaemongdmlistenlpnoaccessnobodynobody4nuucppostgresrootsmmspsvctagsysuucpwebservdroot@GDGZ-PB-DB002-WAP20>dogrep-w"${user}"$FTPUSERS>/dev/null2>&1;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>if[$?!=0];thenecho"User${user}notin/etc/root@GDGZ-PB-DB002-WAP20>elseCOUNT=`expr$COUNT+1`;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>fi;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>done;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>if[x"$COUNT"!="x17"];root@GDGZ-PB-DB002-WAP20>thenecho"FTPcheckresult:false";root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>elseroot@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>firoot@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>}{root@GDGZ-PB-WAP20>root@GDGZ-PB-DB002-WAP20>备原厂和管理共同确定。限制某些系统户不准ftp:ftpusers文件，增加#vi #Solaris#vi/etc/ftpd/ftpusers#Solaris10一行/bin/true;shell目加入/etc/shells文件，否限制ftp前目下活动ftpaccess，加入如下一行restricted-uid*(限制所有)，设置ftp目的存取权限，可/etc/ no overwriteno noanonymouscat明：在个列表里边的用户名是不允ftp的用户加#注。grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>if[$chk_result2-ge5];用户ftp登并且/etc/ftpd/2GDGZ-grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP20>root@GDGZ-PB-DB002-WAP20>if[$chk_result2-ge5];用户ftp登并且/etc/ftpd/2GDGZ-设备IP:统->Solaris判断条件：能够示出查间：2014-06-27#bms-prompt#ls-l/var/adm|greppacct#bms-prompt#echo"result="`ls-l/var/adm|greppacct|wc-l`result=备原厂和管理共同确定。通设置日志文件可以每个用户的每一条命令行，它，需要行/usr/lib/acct目usr/lib/acct/accton/var/adm/lastcomm[user/usr/lib/acct目3GDGZ-设备IP:统->Solarisndd-set/dev/ipndd-setip6_send_redirects0查间：2014-06-27#bms-prompt#echo#bms-prompt#echo#bms-prompt#echo#bms-prompt#echoget/dev/ipip_forwarding`ipip_strict_dst_multihoming`#bms-prompt#echodev/ipip_forward_directed_broadcasts`#bms-prompt#echo备原厂和管理共同确定。参数整，或在命令行中输ndd-setip_send_redirects0#defaultisndd-set/dev/ip设置in.routed建文件/usr/sbin/in.routed以#!chmod07554设备IP:统->Redhat4设备IP:统->RedhatFTP配置-binsysadmlpuucpnuucplistennobody用户不能通FTP登，查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotgrep-i"listen"|grep":21\>"|wc-l`;#bms-prompt#function>>>if[-f/etc/vsftpd.conf>>>elif[-f/etc/vsftpd/vsftpd.conf>>>>vsftpd.confisnotexist,scriptsexitnow";>return>>echo"------- >cat$FTPCONF|grep-v>grepuserlist_file|cut-d=-f2`;>echo"------- >grep-v"^#";>grep-i"userlist_enable=YES"|wc-l`;>grep-i"userlist_deny=NO"|wc-l`;>if[$userlist_enable=1-a=1>>if[`grep-v"^#"$FTPUSER|egrep$|^nobody4$"|wc-l`=0>thenecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisrecommended.FTPcheckresult:true.";备原厂和管理共同确定。能通ftp登的用户#cat pam_listfile.soitem=usersense=denyfile=/etc/#vi用户均不允通ftp登：rootdaemonbinsysadmlpnoaccessnobody4ftp此被激活后，VSFTPD将决定禁止是只允由登FTP服务器。YES，默值，禁止文件中的用户登，令的提示。NO，只允在文件中的用户登FTP服务补充操作明：/etc/ftpusers文件中存在如下不允FTP登的用户号：rootdaemonbinsysadmnoaccessnobody4>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTP>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTPcheckresult:false.";>>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTPcheckresult:false.";>>}#bms-prompt#function>{>if[-f/etc/pam.d/vsftpd>>ftpusers_pam=`grepfile/etc/pam.d/'{print$1}'`;>if[a${ftpusers_pam}!=a>>if[`grep-v"^#"$ftpusers_pam|egrep5设备IP:统->Redhat5设备IP:统->Redhat查名称：查口令策略pam_cracklib模块，配合安全要求，否低于合安全要要求，否低查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth#vi/etc/pam.d/system-auth可使用pampam_cracklibmodule实密复度，两者不能同使用。pam_cracklib主要参数明:tretry=Ndifok=N：新密必需与旧密不同的位数dcredit=N：N>=0密中最多有多少个数字；N0密中数数minclass=N：密成(大/minlen=N：新密最短长度pam_passwdqc:默值是mix=disabled。度，默值是max=40。passphrase:设置口令短中的最少个数，默值是passphrase=3，如果0禁用口令短。match:设置密串的常见程序，默值是match=4。similar:similar=permit允相似或similar=deny不允相似。的默长度。默值是random=42。设0禁止功enforce:设置束范，令字，但不禁止它使用；enforce=users将系统上的全体非根用户实行一限制；enforce=everyone户在内的全体用户实行一限non-unix:它告个模块不要>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>getpwnamretry:重的次数，默值是retry=3如配置密长度最小6位，至passworducredit=-1lcredit=-1ocredit=-1minclass=2passwordsufficientnulloktry_first_pass补充操作明：以下使用passwordrequiredpassphrase=3match=4similar=denyrandom=42enforce=everyoneretry=3passwordsufficientpam_unix.sonullokuse_authtokmd5shadow上述些其本就是：不接受任何种字符类的口令；令最小长度是12强制最小长度是8位；3种字6位；4最小长度是5位。所4种字符混合的密就是由“数字”，“小写字母”，“大写字母”，以及“其它字符”成（其它字符就是类似“！”、“_”种）。另外，上述些同强制任何口令长度不得超40位。6设备IP:统->Redhat6设备IP:统->Redhat屏幕定idle_delay设置间，如果均配置，符合安全要求，否低于安全要查间：2014-06-27#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/#bms-prompt#echo"mode="`gconftool-2-g/Novaluesetfor`/apps/gnome-screensaver/#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/备原厂和管理共同确定。设置启用空激活、屏幕#gconftool-2--direct\gconf.xml.mandatory\--typeboolidle_activation_enabledtrue#gconftool-2--directgconf.xml.mandatory\--typeboollock_enabledtrue#gconftool-2--directgconf.xml.mandatory\--typestringmodeblank-only#gconftool-2--directgconf.xml.mandatory\--typeintidle_delay15补充操作明：/apps/gnome-screensaver/目下7设备IP:统->Redhat7设备IP:统->RedhatFTP配置-限制FTP用户登后能；查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotgrep-i"listen"|grep":21\>"|wc-l`#bms-prompt#function>{>if[-f/etc/vsftpd.conf>then>elif[-f/etc/vsftpd/vsftpd.conf>>>cat$FTPCONF|egrep-v>if[`grep-v"^#"$FTPCONF|grep-i"chroot_local_user=YES"|wc-l`-eq1];>thenecho"vsftpdisrunning.$FTPCONFisrecommended.FTPcheckresult:true.";>elseecho"vsftpdisrunning.$FTPCONFisnotrecommended.FTPcheckresult:false.";>>unset>}#bms-prompt#function>{>>ftpd.conf|grep-v"^#"|grep-i"ChrootEveryone"|grep-i"yes"|wc-l`;>ftpd.conf|grep-v"^#"|grep-i"AllowUserFXP"|grep-i"no"|wc-l`;>pure-ftpd.conf|grep-v"^#"|grep-i"AllowAnonymousFXP"|grep-i"no"|wc-l`;>PUREFTPD_NO=$(expr+$AllowUserFXP>if[$PUREFTPD_NO-eq3>thenecho"pure-ftpdis备原厂和管理共同确定。1vi没有行，添加：重启网服务#rcxinetd2pure-确保以下行未被注掉（并且值以下值），如果没有 #/etc/init.d/pure-ftpdrestartetc/vsftpd.confyes、AllowUserFXPno、者FTP服务未启，以上任一条件足即可>elseecho"pure-ftpdisrunning.pure-ftpd.confis>elseecho"pure-ftpdisrunning.pure-ftpd.confisnotrecommended.FTPcheck>>unsetChrootEveryoneAllowUserFXP>}#bms-prompt#if[$FTPSTATUS=0>thenecho"FTPisnotrunning.FTPcheckresult:true.";>elseif([`ps-ef|grepvsftpd|grep-v"grep"|wc-l`-ne0]||[[`chkconfig--list|grepvsftp|grep-v"0:"|grep-won|wc-l`-ne0]]);>then>else>>-bash:[:toomanyarguments BrokenClientsCompatibilityno8设备IP:统->Redhat8设备IP:统->Redhat值小于等于6全要求，否低于安全查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth增加authrequiredpam_tally2.sodeny=6补充操作明：使配置生效需重启服务器。root户不在定范内。户被定后，可使用faillog-u<username>-r或reset解。>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>9设备IP:统->Redhat9设备IP:统->Redhat查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth2、建文件/etc/security/#vi/etc/pam.d/system-auth在passwordrequired1、行备份：#cp-p/etc/pam.d/system-auth2、建文件/etc/security/修改/etc/pam.d/system-auth,增加pam_unix.so的参数（如果passwordnulloktry_first_passuse_authtokremember=5passwordsufficientnullokuse_authtokmd5shadowremember=5补充操作明：/etc/pam.d/>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>设备IP:统->Redhat查名称：查口令策略设备IP:统->Redhat查名称：查口令策略pam_cracklib模块，配合安全要求，否低于合安全要要求，否低查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth#vi/etc/pam.d/system-auth可使用pampam_cracklibmodule实密复度，两者不能同使用。pam_cracklib主要参数明:tretry=Ndifok=N：新密必需与旧密不同的位数dcredit=N：N>=0密中最多有多少个数字；N0密中数数minclass=N：密成(大/minlen=N：新密最短长度pam_passwdqc:默值是mix=disabled。度，默值是max=40。passphrase:设置口令短中的最少个数，默值是passphrase=3，如果0禁用口令短。match:设置密串的常见程序，默值是match=4。similar:similar=permit允相似或similar=deny不允相似。的默长度。默值是random=42。设0禁止功enforce:设置束范，令字，但不禁止它使用；enforce=users将系统上的全体非根用户实行一限制；enforce=everyone户在内的全体用户实行一限non-unix:它告个模块不要>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>getpwnamretry:重的次数，默值是retry=3如配置密长度最小6位，至passworducredit=-1lcredit=-1ocredit=-1minclass=2passwordsufficientnulloktry_first_pass补充操作明：以下使用passwordrequiredpassphrase=3match=4similar=denyrandom=42enforce=everyoneretry=3passwordsufficientpam_unix.sonullokuse_authtokmd5shadow上述些其本就是：不接受任何种字符类的口令；令最小长度是12强制最小长度是8位；3种字6位；4最小长度是5位。所4种字符混合的密就是由“数字”，“小写字母”，“大写字母”，以及“其它字符”成（其它字符就是类似“！”、“_”种）。另外，上述些同强制任何口令长度不得超40位。设备IP:统->Redhat设备IP:统->Redhat查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth2、建文件/etc/security/#vi/etc/pam.d/system-auth在passwordrequired1、行备份：#cp-p/etc/pam.d/system-auth2、建文件/etc/security/修改/etc/pam.d/system-auth,增加pam_unix.so的参数（如果passwordnulloktry_first_passuse_authtokremember=5passwordsufficientnullokuse_authtokmd5shadowremember=5补充操作明：/etc/pam.d/>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>设备IP:统->Redhat设备IP:统->RedhatFTP配置-限制FTP用户登后能；查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotgrep-i"listen"|grep":21\>"|wc-l`#bms-prompt#function>{>if[-f/etc/vsftpd.conf>then>elif[-f/etc/vsftpd/vsftpd.conf>>>cat$FTPCONF|egrep-v>if[`grep-v"^#"$FTPCONF|grep-i"chroot_local_user=YES"|wc-l`-eq1];>thenecho"vsftpdisrunning.$FTPCONFisrecommended.FTPcheckresult:true.";>elseecho"vsftpdisrunning.$FTPCONFisnotrecommended.FTPcheckresult:false.";>>unset>}#bms-prompt#function>{>>ftpd.conf|grep-v"^#"|grep-i"ChrootEveryone"|grep-i"yes"|wc-l`;>ftpd.conf|grep-v"^#"|grep-i"AllowUserFXP"|grep-i"no"|wc-l`;>pure-ftpd.conf|grep-v"^#"|grep-i"AllowAnonymousFXP"|grep-i"no"|wc-l`;>PUREFTPD_NO=$(expr+$AllowUserFXP>if[$PUREFTPD_NO-eq3>thenecho"pure-ftpdis备原厂和管理共同确定。1vi没有行，添加：重启网服务#rcxinetd2pure-确保以下行未被注掉（并且值以下值），如果没有 #/etc/init.d/pure-ftpdrestartetc/vsftpd.confyes、AllowUserFXPno、者FTP服务未启，以上任一条件足即可>elseecho"pure-ftpdisrunning.pure-ftpd.confis>elseecho"pure-ftpdisrunning.pure-ftpd.confisnotrecommended.FTPcheck>>unsetChrootEveryoneAllowUserFXP>}#bms-prompt#if[$FTPSTATUS=0>thenecho"FTPisnotrunning.FTPcheckresult:true.";>elseif([`ps-ef|grepvsftpd|grep-v"grep"|wc-l`-ne0]||[[`chkconfig--list|grepvsftp|grep-v"0:"|grep-won|wc-l`-ne0]]);>then>else>>-bash:[:toomanyarguments BrokenClientsCompatibilityno设备IP:统->Redhat设备IP:统->RedhatFTP配置-binsysadmlpuucpnuucplistennobody用户不能通FTP登，查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotgrep-i"listen"|grep":21\>"|wc-l`;#bms-prompt#function>{>if[-f/etc/vsftpd.conf>>>elif[-f/etc/vsftpd/vsftpd.conf>>>>vsftpd.confisnotexist,scriptsexitnow";>return>>echo"------- >cat$FTPCONF|grep-v>grepuserlist_file|cut-d=-f2`;>echo"------- >grep-v"^#";>grep-i"userlist_enable=YES"|wc-l`;>grep-i"userlist_deny=NO"|wc-l`;>if[$userlist_enable=1-a=1>>if[`grep-v"^#"$FTPUSER|egrep$|^nobody4$"|wc-l`=0>thenecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisrecommended.FTPcheckresult:true.";备原厂和管理共同确定。能通ftp登的用户#cat pam_listfile.soitem=usersense=denyfile=/etc/#vi用户均不允通ftp登：rootdaemonbinsysadmlpnoaccessnobody4ftp此被激活后，VSFTPD将决定禁止是只允由登FTP服务器。YES，默值，禁止文件中的用户登，令的提示。NO，只允在文件中的用户登FTP服务补充操作明：/etc/ftpusers文件中存在如下不允FTP登的用户号：rootdaemonbinsysadmnoaccessnobody4>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTP>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTPcheckresult:false.";>>elseecho"FTPisrunning.FTPuserconfig$ftpusers_pamisnotisnotrecommended.FTPcheckresult:false.";>>}#bms-prompt#function>{>if[-f/etc/pam.d/vsftpd>>ftpusers_pam=`grepfile/etc/pam.d/'{print$1}'`;>if[a${ftpusers_pam}!=a>>if[`grep-v"^#"$ftpusers_pam|egrep设备IP:统->Redhat设备IP:统->Redhat屏幕定idle_delay设置间，如果均配置，符合安全要求，否低于安全要查间：2014-06-27#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/#bms-prompt#echo"mode="`gconftool-2-g/Novaluesetfor`/apps/gnome-screensaver/#bms-prompt#echoNovaluesetfor`/apps/gnome-screensaver/备原厂和管理共同确定。设置启用空激活、屏幕#gconftool-2--direct\gconf.xml.mandatory\--typeboolidle_activation_enabledtrue#gconftool-2--directgconf.xml.mandatory\--typeboollock_enabledtrue#gconftool-2--directgconf.xml.mandatory\--typestringmodeblank-only#gconftool-2--directgconf.xml.mandatory\--typeintidle_delay15补充操作明：/apps/gnome-screensaver/目下设备IP:统->Redhat设备IP:统->Redhat值小于等于6全要求，否低于安全查间：2014-06-27#bms-prompt#-bash:!/bin/bash:eventnotfound#bms-prompt#function>{>CREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"credit"|sed's/^.*credit=//g'|sed's/\s.*>DCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"dcredit"|sed's/^.*dcredit=//g'|sed's/>LCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"lcredit"|sed's/^.*lcredit=//g'|sed's/>UCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ucredit"|sed's/^.*ucredit=//g'|sed's/>OCREDIT=`cat$FILE|egrep-v"^#|^$"|grep-w"ocredit"|sed's/^.*ocredit=//g'|sed's/>MINCLASS=`cat$FILE|egrep-v"^#|^$"|grep-w"minclass"|sed's/^.*minclass=//g'|sed>MINLEN=`cat$FILE|egrep-v"^#|^$"|>COUNT1=`cat$FILE|grep-i"min=disabled,12,8,6,5"|grep-i"max=40"|grep-i"passphrase=3"|grep-i"match=4"|grep-i"similar=deny"|grep-i"retry=3"|wc-l`>>forNOin$CREDIT$LCREDIT$UCREDIT>>if([$NO-lt0>thenCOUNT2=`expr$COUNT2+>>>if([${MINCLASS:=0}-ge2]&&[{MINLEN:=0}-ge6>thenecho"check>elif([$COUNT2-ge2]&&[{MINLEN:=0}-ge6备原厂和管理共同确定。1#cp-p/etc/pam.d/system-auth增加authrequiredpam_tally2.sodeny=6补充操作明：使配置生效需重启服务器。root户不在定范内。户被定后，可使用faillog-u<username>-r或reset解。>thenecho"check>elif>thenecho"check>elif(["$COUNT1"=="1">thenecho"check>elseecho"check>>UCREDITOCREDITMINCLASSMINLENCOUNT1COUNT2>}#bms-prompt#if([-f/etc/redhat-release]&&[-f/etc/pam.d/system-auth]);>>>cat$FILE|sed'/^#/d'|sed>>elif([-f/etc/SuSE-release]&&[-f/etc/pam.d/common-password]&&[`cat/etc/pam.d/common-password|egrep-i"credit|min|max|passphrase|remember"|wc-l`-gt0]);>>GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solarisndd-set/dev/ipndd-setip6_send_redirects0查间：2014-06-27#bms-prompt#echo#bms-prompt#echo#bms-prompt#echo#bms-prompt#echoget/dev/ipip_forwarding`ipip_strict_dst_multihoming`#bms-prompt#echodev/ipip_forward_directed_broadcasts`#bms-prompt#echo备原厂和管理共同确定。参数整，或在命令行中输ndd-setip_send_redirects0#defaultisndd-set/dev/ip设置in.routed建文件/usr/sbin/in.routed以#!chmod0755GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solaris次登；定候后可登。查间：2014-06-27#bms-prompt#cat/etc/user_attr|sed'/^#/d'|sed'/^$/d'adm::::profiles=LogManagementlp::::profiles=PrinterManagementspmadmin::::type=normal;profiles=SPMUser#bms-prompt#cat/etc/security/policy.conf|sed'/^#/d'|sed'/^$/d'PROFS_GRANTED=BasicSolarisUserCRYPT_DEFAULT=#bms-prompt#cat/etc/default/login|sed'/^#/d'|sed'/^$/d'备原厂和管理共同确定。设置户登失前 的次：vi等于或者大于允的次数定号：vi数定，如下所示，将要修改的户行后面加vi/etc/user_attr定的户设置no。补充操作明：默值：5次被定。设定号定间10分钟（600viDISABLETIME=600。定间。root号也在定的限制范内，一旦root被定，就需要光引，因此配置要慎用。GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solarisftp等用权限最小化判断条件：查看#cat明：在个列表里边的用户名是不允ftp登#注。查间：2014-06-27#bms-prompt#tcp|grep-ilisten|grep"*.21\>"|wc-l`#bms-prompt#if([`uname-r|cut-d\.-f2`=8]);root@GDGZ-PB-DB002-WAP17>thenroot@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>FTPUSERS="/etc/ftpusers";root@GDGZ-PB-DB002-WAP17>elseroot@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>fi#bms-prompt#Check_ftpusers()root@GDGZ-PB-DB002-WAP17>{root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>foruserinadmbindaemongdmlistenlpnoaccessnobodynobody4nuucppostgresrootsmmspsvctagsysuucpwebservdroot@GDGZ-PB-DB002-WAP17>dogrep-w"${user}"$FTPUSERS>/dev/null2>&1;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>if[$?!=0];thenecho"User${user}notin/etc/root@GDGZ-PB-DB002-WAP17>elseCOUNT=`expr$COUNT+1`;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>fi;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>done;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>if[x"$COUNT"!="x17"];root@GDGZ-PB-DB002-WAP17>thenecho"FTPcheckresult:false";root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>elseroot@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>firoot@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>}{root@GDGZ-PB-WAP17>root@GDGZ-PB-DB002-WAP17>备原厂和管理共同确定。限制某些系统户不准ftp:ftpusers文件，增加#vi #Solaris#vi/etc/ftpd/ftpusers#Solaris10一行/bin/true;shell目加入/etc/shells文件，否限制ftp前目下活动ftpaccess，加入如下一行restricted-uid*(限制所有)，设置ftp目的存取权限，可/etc/ no overwriteno noanonymouscat明：在个列表里边的用户名是不允ftp的用户加#注。grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>if[$chk_result2-ge5];用户ftp登并且grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP17>root@GDGZ-PB-DB002-WAP17>if[$chk_result2-ge5];用户ftp登并且/etc/ftpd/GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solarisftp等用权限最小化判断条件：查看#cat明：在个列表里边的用户名是不允ftp登#注。查间：2014-06-27#bms-prompt#tcp|grep-ilisten|grep"*.21\>"|wc-l`#bms-prompt#if([`uname-r|cut-d\.-f2`=8]);root@GDGZ-PB-DB002-WAP21>thenroot@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>FTPUSERS="/etc/ftpusers";root@GDGZ-PB-DB002-WAP21>elseroot@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>fi#bms-prompt#Check_ftpusers()root@GDGZ-PB-DB002-WAP21>{root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>foruserinadmbindaemongdmlistenlpnoaccessnobodynobody4nuucppostgresrootsmmspsvctagsysuucpwebservdroot@GDGZ-PB-DB002-WAP21>dogrep-w"${user}"$FTPUSERS>/dev/null2>&1;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>if[$?!=0];thenecho"User${user}notin/etc/root@GDGZ-PB-DB002-WAP21>elseCOUNT=`expr$COUNT+1`;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>fi;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>done;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>if[x"$COUNT"!="x17"];root@GDGZ-PB-DB002-WAP21>thenecho"FTPcheckresult:false";root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>elseroot@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>firoot@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>}{root@GDGZ-PB-WAP21>root@GDGZ-PB-DB002-WAP21>备原厂和管理共同确定。限制某些系统户不准ftp:ftpusers文件，增加#vi #Solaris#vi/etc/ftpd/ftpusers#Solaris10一行/bin/true;shell目加入/etc/shells文件，否限制ftp前目下活动ftpaccess，加入如下一行restricted-uid*(限制所有)，设置ftp目的存取权限，可/etc/ no overwriteno noanonymouscat明：在个列表里边的用户名是不允ftp的用户加#注。grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>if[$chk_result2-ge5];用户ftp登并且/etc/ftpd/grep"anonymous"|grepno|wc-l`;root@GDGZ-PB-DB002-WAP21>root@GDGZ-PB-DB002-WAP21>if[$chk_result2-ge5];用户ftp登并且/etc/ftpd/GDGZ-设备IP:统->Solarisndd-set/dev/ipndd-setip6_send_redirects0查间：2014-06-27#bms-prompt#echo#bms-prompt#echo#bms-prompt#echo#bms-prompt#echoget/dev/ipip_forwarding`ipip_strict_dst_multihoming`#bms-prompt#echodev/ipip_forward_directed_broadcasts`#bms-prompt#echo备原厂和管理共同确定。参数整，或在命令行中输ndd-setip_send_redirects0#defaultisndd-set/dev/ip设置in.routed建文件/usr/sbin/in.routed以#!chmod0755GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solaris判断条件：示的配置动，不需要输入密；如果从光启动，需要密。查间：2014-06-27备原厂和管理共同确定。#/usr/sbin/eeprom(示当前usr/sbin/eepromsecurity-mode=command(可的有command,full,none)eepromsecurity-password命令openboot设置强壮口令得root口令或者有其他机会得root权限，就可以通设置安全模式none而挽救回来。如果设置了eepromsecurity-而又忘，会来很多麻，务command除了boot和go之外Full除了go命令之外的所有eeprom密系统入安全模式需要的，默是没有配置机器启动按stopA就可入安变量，防止种事情发生，设置此密。GDGZ-设备IP:统->SolarisGDGZ-设备IP:统->Solaris查间：2014-06-27#bms-prompt#ls-l-rwxr-x---1 2182Nov2007-rwxr-x---1 337Jan2008-rwxr-x---2 256Nov2006-rwxr-x---1 2483Nov2006-rwxr-x---1 343Jul2005-rwxr-x---1 625Nov2006-rwxr-x---1 397Nov2006-rwxr-x---2 1867No