Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. #!/bin/bash
  2. #
  3. # Script Hardening Slackware 13.1 verson 0.1 03-09-2011
  4. # By Thiago Laurito
  5. # http://slackdummies.blogspot.com
  6.  
  7. # Variaveis de ambiente
  8. POS="\033[100G"
  9. VERDE="\033[;32;1m"
  10. VERMELHO="\033[;31;1m"
  11. NORMAL="\033[00m"
  12. OK="echo -e $POS [ ${VERDE}OK${NORMAL}]"
  13. FAILED="echo -e $POS [ ${VERMELHO}FAILED${NORMAL} ]"
  14.  
  15. # Comenta CTRL-ALT-DELETE.
  16. INITTAB=/etc/inittab
  17.  
  18. if [ -e "$INITTAB" ];
  19. then
  20.     echo -n "Ctrlaltdel Inittab"
  21.     sed -i 's/ca::ctrlaltdel:/#ca::ctrlaltdel:/g' $INITTAB && $OK || $FAILED ;
  22.         echo "# Require the root pw when booting into single user mode" >> "$INITTAB" ;
  23.     echo "~~:S:wait:/sbin/sulogin" >> "$INITTAB"
  24. else
  25.     echo -n "Exiting error File Not Found" ; exit
  26. fi
  27.  
  28. # SSH Seguro.
  29.  
  30. SSHD=/etc/ssh/sshd_config
  31. if [ -e "$SSHD" ];
  32. then
  33.     echo -n "UsePrivilegeSeparation"
  34.     sed -i 's/#UsePrivilegeSeparation yes/UsePrivilegeSeparation no/g' "$SSHD" && $OK || $FAILED ;
  35.     echo -n "Protocol Version 2"
  36.     sed -i 's/#Protocol 2/Protocol 2/g' "$SSHD" && $OK || $FAILED ;
  37.     echo -n "StrictModes"
  38.     sed -i 's/#StrictModes no/StrictModes yes/g' "$SSHD" && $OK || $FAILED ;
  39.     echo -n "AllowTcpForwarding"
  40.     sed -i 's/#AllowTcpForwarding yes/AllowTcpForwarding no/g' "$SSHD" && $OK || $FAILED ;
  41.     echo -n "X11Forwarding"
  42.     sed -i 's/#X11Forwarding yes/X11Forwarding no/g' "$SSHD" && $OK || $FAILED ;
  43.     echo -n "IgnoreRhosts"
  44.     sed -i 's/#IgnoreRhosts no/IgnoreRhosts yes/g' "$SSHD"  && $OK || $FAILED ;
  45.         echo -n "HostbasedAuthentication"
  46.     sed -i 's/#HostbasedAuthentication yes/HostbasedAuthentication no/g' "$SSHD"  && $OK || $FAILED ;
  47.     echo -n "RhoststsRSAAuthentication"
  48.     sed -i 's/#RhostsRSAAuthentication yes/RhostsRSAAuthentication no/g' "$SSHD" && $OK || $FAILED ;
  49. else
  50.     echo -n "Exiting error File Not Found" ; exit
  51. fi
  52.  
  53. # Permissao Segura em /etc/shadow.
  54.  
  55. SHADOW=/etc/shadow
  56. if [ -e "$SHADOW" ];
  57. then
  58.     echo -n "Security Permission" "$SHADOW"
  59.     chmod 600 "$SHADOW" && $OK || $FAILED
  60. else
  61.     echo -n "Exiting error File Not Found" ; exit
  62. fi
  63.  
  64. # Acesso Root em apenas 2 TTY.
  65.  
  66. STTY=/etc/securetty
  67.  
  68. if [ -e "$STTY" ] ;
  69. then
  70.     echo -n "TTY Security"
  71.     sed -i 's/tty3/#tty3/g' "$STTY" && $OK || $FAILED ;
  72.     sed -i 's/tty4/#tty4/g' "$STTY" ;
  73.     sed -i 's/tty5/#tty5/g' "$STTY" ;  
  74.     sed -i 's/tty6/#tty6/g' "$STTY"
  75. else
  76.     echo -n "Exiting error File Not Found" ; exit
  77. fi
  78.  
  79. # Politicas de Login.
  80.  
  81. LOGIND=/etc/login.defs
  82.  
  83. if [ -e "$LOGIND" ];
  84. then
  85.     echo -n "Alter PASS_MIN_LEN "$LOGIND" "
  86.     sed -i 's/PASS_MIN_LEN  5/PASS_MIN_LEN  8/g' "$LOGIND" && $OK || $FAILED ;
  87.     echo -n "Passwords expire every 180 days"
  88.     perl -npe 's/PASS_MAX_DAYS\s+99999/PASS_MAX_DAYS 180/' -i "$LOGIND" && $OK || $FAILED ;
  89.     echo -n "Passwords may only be changed once a day"
  90.     perl -npe 's/PASS_MIN_DAYS\s+0/PASS_MIN_DAYS 1/g' -i "$LOGIND" && $OK || $FAILED
  91.  
  92. else
  93.     echo -n "Exiting error File Not Found" ; exit
  94. fi
  95.  
  96. # Desabilita Modulo USB-STORAGE e WIRELESS.
  97.  
  98. MBLACK=/etc/modprobe.d/blacklist.conf
  99. if [ -e "$MBLACK" ] ;
  100. then
  101.     echo -n "Disabling USB Mass Storage"
  102.     echo "blacklist usb-storage" >> "$MBLACK" && $OK || $FAILED ;
  103.     echo -n "Disabling Wireless Modules"
  104.     for i in $(find /lib/modules/`uname -r`/kernel/drivers/net/wireless -name "*.ko" -type f) ; do echo blacklist $i >> "$MBLACK" ; done && $OK || $FAILED
  105. else
  106.  
  107.     echo -n "Exiting error File Not Found" ; exit
  108. fi
  109.  
  110. # Tratamento de usuarios inativos apos login.
  111.  
  112. IDLEU=/etc/profile.d/usecurity.sh
  113. if [ -e "$IDLEU" ];
  114. then
  115.     echo
  116. else
  117.     echo -n "Create "$IDLEU" "
  118.     touch "$IDLEU" && $OK || $FAILED;
  119.     echo -n "Idle users will be removed after 15 minutes"
  120.     echo "readonly TMOUT=900" >> "$IDLEU" && $OK || $FAILED ;
  121.     echo "readonly HISTFILE" >> "$IDLEU" && $OK || $FAILED ;
  122.     chmod +x "$IDLEU"
  123. fi
  124.  
  125. # Restringindo cron e at apenas para root.
  126.  
  127. CRALLOW=/etc/cron.allow
  128. if [ -e "$CRALLOW" ];
  129. then
  130.     echo
  131. else
  132.     echo -n "Locking down Cron"
  133.     touch "$CRALLOW" && $OK || $FAILED ;
  134.     chmod 600 /etc/cron.allow
  135.     awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
  136. fi 
  137.  
  138. ATLLOW=/etc/at.allow
  139. if [ -e "$ATLLOW" ];
  140. then
  141.     echo
  142. else
  143.     echo -n "Locking down AT"
  144.     touch "$ATLLOW" && $OK || $FAILED ;
  145.     chmod 600 /etc/at.allow
  146.     awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny
  147. fi
  148.  
  149. # Parametros de Seguranca para o Kernel.
  150.  
  151. SYSCTL=/etc/sysctl.conf
  152. if [ -e "$SYSCTL" ] ;
  153. then
  154.      echo
  155. else
  156.     touch "$SYSCTL"
  157.     echo -n "Protect SYN Floods"
  158.     echo "net.ipv4.tcp_syncookies=1" >> "$SYSCTL" && $Ok || $FAILED ;
  159.  
  160.     echo -n "Block Broadcast Response"
  161.     echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> "$SYSCTL" && $OK || $FAILED ;
  162.  
  163.     echo -n "Enable protection for bad icmp error messages"
  164.     echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> "$SYSCTL" && $OK || $FAILED ;
  165.  
  166.     echo -n "Enable syncookies for SYN flood attack protection"
  167.     echo "net.ipv4.tcp_syncookies = 1" >> "$SYSCTL" && $OK || $FAILED ;
  168.  
  169.     echo -n "Log spoofed, source routed, and redirect packets"
  170.     echo "net.ipv4.conf.all.log_martians = 1" >> "$SYSCTL" && $OK || $FAILED ;
  171.     echo "net.ipv4.conf.default.log_martians = 1" >> "$SYSCTL" ;
  172.  
  173.     echo -n "Don't allow source routed packets"
  174.     echo "net.ipv4.conf.all.accept_source_route = 0" >> "$SYSCTL" && $OK || $FAILED ;
  175.     echo "net.ipv4.conf.default.accept_source_route = 0" >> "$SYSCTL";
  176.  
  177.     echo -n "Turn on reverse path filtering"
  178.     echo "net.ipv4.conf.all.rp_filter = 1" >> "$SYSCTL" && $OK || $FAILED ;
  179.     echo "net.ipv4.conf.default.rp_filter = 1" >> "$SYSCTL" ;
  180.  
  181.     echo -n "Don't allow outsiders to alter the routing tables"
  182.     echo "net.ipv4.conf.all.accept_redirects = 0" >> "$SYSCTL" && $OK || $FAILED;
  183.     echo "net.ipv4.conf.default.accept_redirects = 0" >> "$SYSCTL" ;
  184.     echo "net.ipv4.conf.all.secure_redirects = 0" >> "$SYSCTL" ;
  185.     echo "net.ipv4.conf.default.secure_redirects = 0" >> "$SYSCTL" ;
  186.  
  187.     echo -n "Don't pass traffic between networks or act as a router"
  188.     echo "net.ipv4.ip_forward = 0" >> "$SYSCTL" && $OK || $FAILED ;
  189.     echo "net.ipv4.conf.all.send_redirects = 0" >> "$SYSCTL" ;
  190.     echo "net.ipv4.conf.default.send_redirects = 0" >> "$SYSCTL" ;
  191.    
  192.     echo -n "Disable Core Dumps"
  193.     echo "fs.suid_dumpable = 0" >> "$SYSCTL" && $OK || $FAILED ;
  194.  
  195. fi
  196.  
  197. # Desabilitando relacao de confianca.
  198.  
  199. HEQUIV=/etc/hosts.equiv
  200. if [ -e "$HEQUIV" ];
  201. then
  202.     echo   
  203. else
  204.     echo >/etc/hosts.equiv ;
  205.     echo >/etc/.netrc ;
  206.     echo >/etc/r.hosts ;
  207.     /bin/chmod 400 /etc/hosts.equiv ;
  208.     /bin/chmod 400 /etc/.netrc ;
  209.     /bin/chmod 400 /etc/r.hosts ;
  210. fi
  211.  
  212. # Remove arquivos com SUID desnecessario.
  213. # /usr/bin/find / -type f \( -perm -004000 -o -perm -002000 \) -exec ls -lg {} \; 2>/dev/null
  214.  
  215. SPATH=/bin/chmod
  216. "$SPATH" -s /usr/bin/chsh
  217. "$SPATH" -s /usr/bin/gpasswd
  218. "$SPATH" -s /usr/bin/chfn
  219. "$SPATH" -s /usr/bin/wall
  220. "$SPATH" -s /usr/bin/screen
  221. "$SPATH" -s /usr/bin/rcp
  222. "$SPATH" -s /usr/bin/rsh
  223. "$SPATH" -s /sbin/mount.nfs
  224. "$SPATH" -s /sbin/umount.nfs
  225. "$SPATH" -s /bin/ping
  226. "$SPATH" -s /bin/ping6
  227. "$SPATH" -s /bin/umount
  228. "$SPATH" -s /bin/mount
  229.  
  230. # Restringir somente para root.
  231. for a in /var/log/*; do [ -f $a ] && chmod 600 $a; [ -d $a ] && chmod 700 $a; done
  232.  
  233. # Bloqueia o password de usuarios do sistema.
  234.  
  235. USERM=/usr/sbin/usermod
  236.  
  237. # Block system users passwords
  238. $USERM -L bin
  239. $USERM -L daemon
  240. $USERM -L adm
  241. $USERM -L lp
  242. $USERM -L mail
  243. $USERM -L news
  244. $USERM -L uucp
  245. $USERM -L operator
  246. $USERM -L games
  247. $USERM -L smmsp
  248. $USERM -L haldaemon