리눅스 설치후 초기 보안법

다음 파일에는 불필요한 계정과 그룹, 파일퍼미션 변경에 관한 스크립트이다.
특정 명령어에 대해서는 wheel 그룹에 속한 사용자만 사용하도록 변경한다.
스크립트는 구동하기 전에 wheel 그룹에 사용자를 추가하는 것을 잊지 말자.

http://www.rootda.org/dist/sh.tar.gz

스크립트의 내용은 다음과 같다.


#!/bin/bash

chgrp wheel /usr/bin/finger
chgrp wheel /usr/bin/nslookup
chgrp wheel /usr/bin/gcc
chgrp wheel /usr/bin/suidperl
chgrp wheel /usr/bin/whereis
chgrp wheel /usr/bin/cc
chgrp wheel /usr/bin/c++
chgrp wheel /usr/bin/make
chgrp wheel /usr/bin/pstree
chgrp wheel /usr/bin/rlog
chgrp wheel /usr/bin/rlogin
chgrp wheel /usr/bin/which
chgrp wheel /usr/bin/who
chgrp wheel /usr/bin/w
chgrp wheel /bin/mail
chgrp wheel /usr/sbin/sendmail
chgrp wheel /usr/lib/sendmail
chgrp wheel /usr/bin/top
chgrp wheel /usr/bin/free
chgrp wheel /usr/bin/last
chgrp wheel /usr/bin/wget
chgrp wheel /etc/hosts
chgrp wheel /etc/hosts.deny
chgrp wheel /etc/hosts.allow
chgrp wheel /etc/named.conf
chgrp wheel /bin/df
chgrp wheel /bin/grep
chgrp wheel /bin/egrep
chgrp wheel /bin/ping
chgrp wheel /bin/netstat
chgrp wheel /usr/bin/ftp
chgrp wheel /usr/bin/ncftp
chgrp wheel /usr/bin/suidperl
chgrp wheel /usr/bin/whereis
chgrp wheel /usr/bin/rz
chgrp wheel /usr/bin/sz
chgrp wheel /bin/ps
chgrp wheel /bin/dmesg
chgrp wheel /usr/bin/finger
chgrp wheel /usr/bin/last
chmod 750 /usr/bin/finger
chmod 750 /usr/bin/nslookup
chmod 750 /usr/bin/gcc
chmod 750 /usr/bin/suidperl
chmod 750 /usr/bin/whereis
chmod 750 /usr/bin/cc
chmod 750 /usr/bin/c++
chmod 750 /usr/bin/make
chmod 750 /usr/bin/pstree
chmod 750 /usr/bin/rlog
chmod 750 /usr/bin/rlogin
chmod 750 /usr/bin/which
chmod 750 /usr/bin/who
chmod 750 /usr/bin/w
chmod 750 /bin/mail
chmod 750 /usr/sbin/sendmail
chmod 750 /usr/lib/sendmail
chmod 750 /usr/bin/top
chmod 750 /usr/bin/free
chmod 750 /usr/bin/last
chmod 750 /usr/bin/wget
chmod 750 /etc/hosts
chmod 750 /bin/ps
chmod 750 /etc/hosts.deny
chmod 750 /etc/hosts.allow
chmod 640 /etc/named.conf
chmod 750 /bin/df
chmod 750 /bin/grep
chmod 750 /bin/egrep
chmod 750 /bin/ping
chmod 750 /bin/netstat
chmod 750 /usr/bin/ftp
chmod 750 /usr/bin/ncftp
chmod 750 /usr/bin/suidperl
chmod 750 /usr/bin/whereis
chmod 750 /usr/bin/rz
chmod 750 /usr/bin/sz
chmod 700 /etc/exports
chmod 700 /etc/fstab
chmod 700 /usr/bin/chage
chmod 700 /usr/bin/wall
chmod 755 /usr/bin/man
chmod 700 /usr/bin/chfn
chmod 700 /usr/bin/write
chmod 700 /usr/sbin/usernetctl
chmod 700 /bin/mount
chmod 700 /bin/umonut
chmod 700 /sbin/netreport
chmod 750 /bin/ps
chmod 750 /bin/netstat
chmod 750 /bin/dmesg
chmod 750 /bin/df
chmod 750 /usr/bin/who
chmod 750 /usr/bin/finger
chmod 750 /usr/bin/last
chmod 750 /usr/bin/top
chmod 750 /usr/bin/w
userdel adm
userdel lp
userdel shutdown
userdel halt
userdel news
userdel uucp
userdel operator
userdel game
userdel gopher
userdel ftp
userdel rpm
userdel postgres
userdel sync
groupdel adm
groupdel lp
groupdel games
groupdel gopher
groupdel ftp
groupdel dip
groupdel rpm
groupdel postgres
groupdel news
groupdel uucp
groupdel games
groupdel dip
groupdel pppusers
groupdel slipusers
chattr +i /etc/fstab