Bastille 및 PSAD로 CentOS 서버 보안

이 기사에서는 psad, Bastille 및 기타 조정을 사용하여 CentOS 서버를 보호하는 방법을 보여줍니다. psad는 포트 스캔 및 기타 의심스러운 트래픽을 감지하는 데 도움이 되는 도구이며 Bastille 강화 프로그램은 운영 체제를 잠그고 시스템을 사전에 구성하여 보안을 강화하고 손상 가능성을 줄입니다.

시스템 관리를 위한 추가 계정 생성

"adduser"명령은 계정을 생성합니다.

adduser service

"passwd"명령은 "service"계정의 암호를 설정합니다.

passwd service

다운로드를 위한 디렉토리 생성.

RPM 및 기타 파일을 다운로드할 디렉토리가 생성됩니다.

mkdir /downloads
cd /downloads

PSAD 설치

psad는 Linux 시스템에서 실행되고 포트 스캔 및 기타 의심스러운 트래픽을 감지하기 위해 로그 메시지를 분석Netfilter하는 3개의 경량 시스템 데몬(2개의 기본 데몬과 1개의 도우미 데몬) 모음입니다. 자세한 내용은 here 에서 찾을 수 있습니다.

wget http://www.cipherdyne.com/psad/download/psad-2.4.6.tar.gz
tar xfz psad-2.4.6.tar.gz
cd psad-2.4.6
./install.pl

바스티유 설치

Bastille Hardening 프로그램은 운영 체제를 "잠금"하여 시스템을 사전에 구성하여 보안을 강화하고 손상 가능성을 줄입니다. Bastille은 또한 시스템의 현재 강화 상태를 평가하여 작동하는 각 보안 설정을 세부적으로 보고할 수 있습니다. 자세한 내용은 here 에서 찾을 수 있습니다.

wget https://downloads.sourceforge.net/project/bastille-linux/bastille-linux/3.2.1/Bastille-3.2.1-0.1.noarch.rpm

rpm -ivh Bastille-3.2.1-0.1.noarch.rpm 

달리는 바스티유

그러면 대화형 프롬프트가 시작됩니다.

/usr/sbin/bastille -c

대화형 프롬프트 응답

이 설정은 Perfect Setup 설치를 위한 권장 사항입니다. 다른 소프트웨어나 패키지가 설치된 경우 변경해야 할 특정 값이 있을 수 있습니다.

accept

<ENTER>

Would you like to set more restrictive permissions on the administration utilities? -> YES

<ENTER>

Would you like to disable SUID status for mount/umount? -> YES
Would you like to disable SUID status for ping? -> YES
Would you like to disable SUID status for at? -> YES
Would you like to disable the r-tools? -> YES
Would you like to disable SUID status for usernetctl? -> YES
Would you like to disable SUID status for traceroute? -> YES
Should Bastille disable clear-text r-protocols that use IP-based authentication? -> YES
Would you like to enforce password aging? -> YES
Do you want to set the default umask? -> YES 
What umask would you like to set for users on the system? -> 007
Should we disallow root login on tty's 1-6? -> NO
Should Bastille ask you for extraneous accounts to delete? -> NO
Would you like to password-protect the GRUB prompt? -> NO
Would you like to disable CTRL-ALT-DELETE rebooting? -> YES
Would you like to password protect single-user mode? -> NO
Would you like to set a default-deny on TCP Wrappers and xinetd? -> NO
Would you like to display "Authorized Use" messages at log-in time? -> YES
Who is responsible for granting authorization to use this machine? -> YOUR COMPANY NAME
Would you like to put limits on system resource usage? -> YES

<ENTER>

Should we restrict console access to a small group of user accounts? -> YES
Which accounts should be able to login at console? -> root
Would you like to set up process accounting? -> NO

<ENTER>

Would you like to disable acpid and/or apmd? -> YES
Would you like to disable PCMCIA services? -> YES
Would you like to disable GPM? -> YES
Would you like to deactivate the HP OfficeJet (hpoj) script on this machine? -> YES
Would you like to deactivate the ISDN script on this machine? -> YES
Would you like to deactivate kudzu's run at boot? -> YES
Do you want to stop sendmail from running in daemon mode? -> YES
Would you like to deactivate named, at least for now? -> NO
Would you like to deactivate the Apache web server? -> NO
Would you like to bind the Web server to listen only to the localhost? -> NO
Would you like to bind the web server to a particular interface? -> NO

<ENTER>

Would you like to deactivate the following of symbolic links? -> YES
Would you like to disable printing? -> YES
Would you like to install TMPDIR/TMP scripts? -> NO
Would you like to run the packet filtering script? -> YES

<ENTER>

Do you need the advanced networking options? -> NO
DNS Servers: [0.0.0.0/0] -> **LEAVE DEFAULT**
Public interfaces: -> eth+
TCP services to audit: -> telnet ftp imap pop3 finger sunrpc exec login linuxconf ssh
UDP services to audit: -> 31337
ICMP services to audit: -> **BLANK**
TCP service names or port numbers to allow on public interfaces: -> 21 22 25 53 80 110 111 143 443 631 953 993 995 3306
UDP service names or port numbers to allow on public interfaces: -> **BLANK**
Force passive mode? -> YES
TCP services to block: -> 2049 2065:2090 6000:6020 7100
UDP services to block: -> 2049 6770
ICMP allowed types: -> destination-unreachable echo-reply time-exceeded
Enable source address verification? -> YES
Reject method: -> DENY
Interfaces for DHCP queries: -> **BLANK**
NTP servers to query: -> **BLANK**
ICMP types to disallow outbound: -> destination-unreachable time-exceeded
Should Bastille run the firewall and enable it at boot time? -> YES
Would you like to setup psad? -> YES
psad check interval: -> 15
Port range scan threshold: -> 1
Enable scan persistence? -> NO
Scan timeout: -> 3600
Show all scan signatures? -> NO
Danger Levels: -> 5 50 1000 5000 10000
Email addresses: -> [email protected]
Email alert danger level: -> 1
Alert on all new packets? -> YES
Enable automatic blocking of scanning IPs? -> NO
Should Bastille enable psad at boot time? -> YES
Are you finished answering the questions, i.e. may we make the changes? -> YES

<TAB>

SSH 구성 편집

SSH 보안을 위한 추가 단계가 필요합니다. 다음 설정은 다음을 수행합니다.

SSHv2가 사용되는지 확인

루트 사용자가 SSH를 통해 직접 로그온할 수 없음

비밀번호가 없는 계정은 로그인할 수 없습니다.

로그인 배너가 표시됩니다.

vi /etc/ssh/sshd_config

다음 행을 편집하고 주석을 제거하십시오. 저장하고 종료하는 것을 잊지 마십시오.

#Protocol 2,1 -> Protocol 2
#PermitRootLogin yes -> PermitRootLogin no
#PermitEmptyPasswords no -> PermitEmptyPasswords no
#Banner /some/path -> Banner /etc/issue

시스템 재부팅

최종 확인을 위해 시스템을 재부팅하십시오. 모든 것이 올바르게 시작되는지 확인하십시오.

reboot