CentOS/RHEL安全配置脚本

Shell Code

#! /bin/bash

# 
# Name:     lintool
# Auther:   Jon Lau
# Version:  V1.1.6 (2019/02/14)
# Usage:    chmod +x lintool
#           ./lintool
# Update:   1. Add function for print file infomation
# 

Yum(){
    echo -e "\033[01;32mYum Setting...\033[0m"
    echo -e "\033[33mDelete repo files...\033[0m"
    rm -rfv /etc/yum.repos.d/*
    echo -e "\033[33mCreate repo file...\033[0m"
    case $1 in
        el6)
            echo [os] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=os >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/os/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [extras] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=extras >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/extras/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [updates] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=updates >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/centos/6.10/updates/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [epel] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=epel >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/epel/6/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo [zabbix] >> /etc/yum.repos.d/CentOS-6.10.repo
            echo name=zabbix >> /etc/yum.repos.d/CentOS-6.10.repo
            echo baseurl=http://10.172.115.106/zabbix/4.0/rhel/6/ >> /etc/yum.repos.d/CentOS-6.10.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-6.10.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-6.10.repo
            ;;
        el7)
            echo [os] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=os >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/os/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [updates] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=updates >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/updates/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [extras] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=extras >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/centos/7.5.1804/extras/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [epel] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=epel >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/epel/7/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo >> /etc/yum.repos.d/CentOS-7.5.repo
            echo [zabbix] >> /etc/yum.repos.d/CentOS-7.5.repo
            echo name=zabbix >> /etc/yum.repos.d/CentOS-7.5.repo
            echo baseurl=http://10.172.115.106/zabbix/4.0/rhel/7/ >> /etc/yum.repos.d/CentOS-7.5.repo
            echo enable=1 >> /etc/yum.repos.d/CentOS-7.5.repo
            echo gpgcheck=0 >> /etc/yum.repos.d/CentOS-7.5.repo
            ;;
        *)
            ;;
    esac
    echo -e "\033[33mUpdate repolist...\033[0m"
    yum clean all && yum repolist all
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mYum repolist failed!\033[0m"
        return [-1]
    fi
}

InstallPackage(){
    echo -e "\033[01;32mInstall Packages...\033[0m"
    echo -e "\033[33mInstall vim...\033[0m"
    yum install -y vim-enhanced
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall vim failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mInstall bash-completion...\033[0m"
    yum install -y bash-completion
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall bash-completion failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mInstall openssh-clients...\033[0m"
    yum install -y openssh-clients
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall openssh-clients failed!\033[0m"
        return [-1]
    fi
}

DisableService(){
    echo -e "\033[01;32mDisable Services...\033[0m"
    case $1 in
        el6)
            echo -e "\033[33mDisable iptables...\033[0m"
            service iptables stop && chkconfig iptables off
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable iptables failed!\033[0m"
                return [-1]
            fi

            echo -e "\033[33mDisable postfix...\033[0m"
            service postfix stop && chkconfig postfix off
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable postfix failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            echo -e "\033[33mDisable firewalld postfix and NetworkManager...\033[0m"
            systemctl stop firewalld postfix NetworkManager && systemctl disable firewalld postfix NetworkManager
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mDisable firewalld postfix or NetworkManager failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

Ntp(){
    echo -e "\033[01;32mNtp Setting...\033[0m"
    echo -e "\033[33mInstall ntp...\033[0m"
    yum install -y ntp
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall ntp failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mEdit ntp profile ntp.conf...\033[0m"
    N=$(grep -E "^server 10.172.113.163$" /etc/ntp.conf | wc -l)
    if [[ ${N} -eq 0 ]]; then
        sed -i 's/^server/# server/g' /etc/ntp.conf
        echo "server 10.172.113.163" >> /etc/ntp.conf
        echo "server 10.173.173.163" >> /etc/ntp.conf
    fi
    case $1 in
        el6)
            echo -e "\033[33mStart ntpd...\033[0m"
            service ntpd start && chkconfig ntpd on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart ntpd failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            echo -e "\033[33mStart ntpd...\033[0m"
            systemctl start ntpd && systemctl enable ntpd
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart ntpd failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

DisableCtrlAltDelete(){
    echo -e "\033[01;32mDisable Ctrl-Alt-Delete...\033[0m"
    case $1 in
        el6)
            sed -i 's/^start/# start/g' /etc/init/control-alt-delete.conf
            sed -i 's/^exec/# exec/g' /etc/init/control-alt-delete.conf
            ;;
        el7)
            if [[ -f /usr/lib/systemd/system/ctrl-alt-del.target ]]; then
                mv -v /usr/lib/systemd/system/ctrl-alt-del.target{,.bak}
            fi
            ;;
        *)
            ;;
    esac
}

InitMod(){
    echo -e "\033[01;32mInit Mod Setting...\033[0m"
    echo -e "\033[33mSet multi-user default...\033[0m"
    case $1 in
        el6)
            sed -i 's/id:5/id:3/g' /etc/inittab
            ;;
        el7)
            systemctl set-default multi-user.target
            ;;
        *)
            ;;
    esac
}

EditProfile(){
    echo -e "\033[01;32mProfile Setting...\033[0m"
    N=$(grep -E "^TMOUT=600$" /etc/profile | wc -l)
    if [[ ${N} -eq 0 ]]; then
        echo >> /etc/profile
        echo -e "\033[33mSet time-out...\033[0m"
        echo "TMOUT=600" >> /etc/profile
        echo -e "\033[33mSet cmd history size...\033[0m"
        echo "HISTSIZE=3000" >> /etc/profile
        echo -e "\033[33mSet cmd history format...\033[0m"
        echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S `whoami`: "' >> /etc/profile
        source /etc/profile
    fi
}

Log(){
    echo -e "\033[01;32mLogrotate Setting...\033[0m"
    echo -e "\033[33mSet rotate weeks...\033[0m"
    sed -i 's/rotate 4/rotate 52/g' /etc/logrotate.conf
}

DisableRoot(){
    echo -e "\033[01;32mDisable Root Login...\033[0m"
    echo -e "\033[33mAdd user natalia and set password...\033[0m"
    N=$(grep -E "natalia" /etc/passwd | wc -l)
    if [[ ${N} -eq 0 ]]; then
        useradd -s /bin/bash -m natalia
    fi
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mAdd user natalia failed!\033[0m"
        return [-1]
    fi
    echo dpbg123. | passwd --stdin natalia
    echo -e "\033[33mDisable root login...\033[0m"
    N=$(grep -E "^PermitRootLogin no$" /etc/ssh/sshd_config | wc -l)
    if [[ ${N} -eq 0 ]]; then
        echo >> /etc/ssh/sshd_config
        echo "PermitRootLogin no" >> /etc/ssh/sshd_config
    fi
    echo -e "\033[33mRestart sshd service...\033[0m"
    case $1 in
        el6)
            service sshd restart && chkconfig sshd on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mRestart sshd failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            systemctl restart sshd && systemctl enable sshd
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mRestart sshd failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

DisableSELinux(){
    echo -e "\033[01;32mDisable SELinux...\033[0m"
    sed -i 's/^SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    setenforce 0
}

ZabbixAgent(){
    echo -e "\033[01;32mZabbix Agent Setting...\033[0m"
    echo -ne "\033[01;33mPlease enter the Zabbix Server IP: \033[0m"
    read ZBXIP
    echo -e "\033[33mInstall zabbix-agent...\033[0m"
    yum install -y zabbix-agent
    if [[ $? -ne 0 ]]; then
        echo -e "\033[01;31mInstall zabbix-agent failed!\033[0m"
        return [-1]
    fi
    echo -e "\033[33mSome settings on zabbix_agentd.conf...\033[0m"
    sed -i "s/LogFileSize=0/LogFileSize=1/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^Server=127.0.0.1/Server=${ZBXIP}/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^ServerActive=127.0.0.1/ServerActive=${ZBXIP}/g" /etc/zabbix/zabbix_agentd.conf
    sed -i "s/^Hostname=Zabbix server/Hostname=${HOSTNAME}/g" /etc/zabbix/zabbix_agentd.conf
    echo -e "\033[33mStart zabbix-agent service...\033[0m"
    case $1 in
        el6)
            service zabbix-agent start && chkconfig zabbix-agent on
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart zabbix-agent failed!\033[0m"
                return [-1]
            fi
            ;;
        el7)
            systemctl start zabbix-agent && systemctl enable zabbix-agent
            if [[ $? -ne 0 ]]; then
                echo -e "\033[01;31mStart zabbix-agent failed!\033[0m"
                return [-1]
            fi
            ;;
        *)
            ;;
    esac
}

PrintInfo(){
    NAME='lintool'
    AUTHER='Jon Lau'
    VER='V1.1.6 (2019/02/14)'
    echo -e "\033[33mName:     ${NAME}\033[0m"
    echo -e "\033[33mAuther:   ${AUTHER}\033[0m"
    echo -e "\033[33mVersion:  ${VER}\033[0m"
    echo -e "\033[33mUsage:    chmod +x lintool\033[0m"
    echo -e "\033[33m          ./lintool\033[0m"
}

DoFunc(){
    COLS=$(stty size | awk '{print $2}')
    NN=$(echo -n $1 | wc -c)
    NS=$((${COLS} - ${NN} - 9))
    NF=$((${COLS} - ${NN} - 8))
    $1 $2 2> /dev/null
    if [[ $? -eq 0 ]]; then
        echo -n "$1"
        for i in $(seq 1 ${NS}); do
            echo -n " "
        done
        echo -e "[\033[00;32mSuccess\033[0m]"
    else
        echo -n "$1"
        for i in $(seq 1 ${NF}); do
            echo -n " "
        done
        echo -e "[\033[00;31mFaild\033[0m]"
    fi
}

SettingAll(){
    if [[ -f /root/.SETTINGALL ]]; then
        echo -e "\033[01;31mHas been execed, do nothing!\033[0m"
    else
        touch /root/.SETTINGALL
        DoFunc Yum $1
        DoFunc InstallPackage $1
        DoFunc DisableService $1
        DoFunc Ntp $1
        DoFunc DisableCtrlAltDelete $1
        DoFunc InitMod $1
        DoFunc EditProfile $1
        DoFunc Log $1
        DoFunc DisableRoot $1
        DoFunc DisableSELinux $1
        DoFunc ZabbixAgent $1
    fi
}

Print_Menu(){
    COLS=$(stty size | awk '{print $2}')
    N=$(( (${COLS} - 42) / 2 ))
    echo
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m -------------- Linux Menu -------------- \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      v) Print Version                    \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      q) Quit                             \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      0) Setting All                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      1) Yum Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      2) Install Packages                 \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      3) Disable Services                 \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      4) Ntp Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      5) Disable Ctrl-Alt-Delete          \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      6) Init Mod                         \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      7) Profile Setting                  \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      8) Log Setting                      \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m      9) Disable Root                     \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m     10) Disable SELinux                  \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m     11) Zabbix Agent                     \033[0m"
    for i in $(seq 1 ${N}); do echo -n " "; done; echo -e "\033[37;41m ---------------------------------------- \033[0m"
    echo; for i in $(seq 1 ${N}); do echo -n " "; done; echo -ne "\033[33mEnter your choice: \033[0m"
}

Menu(){
    while [ 1 -eq 1 ]; do
        RELEASE=$(uname -r | awk -F '.' '{i=NF-1; print $i}')
        Print_Menu
        read key
        case $key in
            0)
                SettingAll ${RELEASE}
                ;;
            1)
                DoFunc Yum ${RELEASE}
                ;;
            2)
                DoFunc InstallPackage ${RELEASE}
                ;;
            3)
                DoFunc DisableService ${RELEASE}
                ;;
            4)
                DoFunc Ntp ${RELEASE}
                ;;
            5)
                DoFunc DisableCtrlAltDelete ${RELEASE}
                ;;
            6)
                DoFunc InitMod ${RELEASE}
                ;;
            7)
                DoFunc EditProfile ${RELEASE}
                ;;
            8)
                DoFunc Log ${RELEASE}
                ;;
            9)
                DoFunc DisableRoot ${RELEASE}
                ;;
            10)
                DoFunc DisableSELinux ${RELEASE}
                ;;
            11)
                DoFunc ZabbixAgent ${RELEASE}
                ;;
            v | V)
                DoFunc PrintInfo ${RELEASE}
                ;;
            q | Q)
                break
                ;;
            *)
                echo -e "\033[31m[!] Please enter [0-11]\033[0m"
                ;;
        esac
    done
}

Menu
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 213,047评论 6赞 492
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 90,807评论 3赞 386
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 158,501评论 0赞 348
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 56,839评论 1赞 285
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 65,951评论 6赞 386
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 50,117评论 1赞 291
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 39,188评论 3赞 412
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 37,929评论 0赞 268
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 44,372评论 1赞 303
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 36,679评论 2赞 327
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 38,837评论 1赞 341
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 34,536评论 4赞 335
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 40,168评论 3赞 317
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 30,886评论 0赞 21
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 32,129评论 1赞 267
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 46,665评论 2赞 362
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 43,739评论 2赞 351