linux配置基线

#!/bin/bash

# 设置强密码策略
echo "password requisite pam_cracklib.so retry=3 minlen=8 difok=3" >> /etc/pam.d/common-password
echo "password required pam_unix.so sha512" >> /etc/pam.d/common-password

# 禁用不必要的默认用户
usermod -L root
usermod -s /sbin/nologin guest

# 关闭不必要的服务
systemctl disable telnet
systemctl disable ftp

# 配置防火墙规则
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -j DROP
service iptables save

# 设置文件系统权限
chmod 700 /etc/shadow
chown root:root /etc/shadow

# 配置静态IP地址
cat <<EOF > /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 8.8.8.8 8.8.4.4
EOF

# 重启网络服务
systemctl restart networking