CentOS安全防护实例

(1) 借助iptables的recent模块限制IP连接数

可以限制瞬间连接数过大的恶意IP（比如web应用防护，但不适用于LVS+Keepalived集群环境）

防护指令如下

# 允许一个客户端60秒内可以发起20个对web服务器的连接

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name web --set

# iptables默认将日志输出到/var/log/messages

iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j LOG --log-prefix 'HTTP attack: '

iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j DROP

效率的产生是因为netfilter在网络应用的低层级上就实现了封堵，调用资源少。这如同硬件防火墙在转发面就实现封堵，而不会上升到控制面。

(2) 防SSH暴力破解

使用工具DenyHosts，原理为：

python2写成，分析/var/log/secure日志文件，当发现同一IP在进行多次SSH登陆尝试时，就会将IP记录到tcpwrappers配置文件/etc/hosts.deny中。

环境确认

ldd /sbin/sshd | grep libwrap

回显

libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f2844d53000)

说明你所使用的sshd支持TCP Wrappers。

python -V 查看版本是不是2.x.x

可以用如下命令统计一下可疑IPv4地址的数量

cat /var/log/secure | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | uniq -c

可以结合iptables再限制：

#每分钟对ssh的新连接只允许两个，已建立的连接不限制

iptables -P INPUT DROP

iptables -A INPUT -m state –state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp –dport 22 -m limit –limit 2/minute –limit-burst 2 -m state –state NEW -j ACCEPT

安装

方式一：

# Debian/Ubuntu

$ sudo apt-get install denyhosts

# RedHat/CentOS

$ yum update

$ yum install denyhosts

或者

$ wget http://ftp.tu-chemnitz.de/pub/linux/dag/redhat/el7/en/x86_64/rpmforge/RPMS/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm

$ rpm -Uvh rpmforge-release*rpm

$ yum install denyhosts

$ systemctl status denyhosts

或者

$ service denyhosts status

$ chkconfig denyhosts on

# Archlinux

$ yaourt denyhosts

# Gentoo

$ emerge -av denyhosts

//白名单配置

$ vim /etc/hosts.allow

//添加你的IP到白名单

$ sshd: Your_IP

//黑名单配置

$ vim /etc/hosts.deny

//如果要禁止所有连接，那就

$ sshd: ALL **

//查看denyhosts收集到的恶意ip

$ cat /etc/hosts.deny

denyhosts配置详解

配置文件/etc/denyhosts.conf

或者

/etc/denyhosts/denyhosts.cfg

具体可以使用如下命令查看：

rpm -ql denyhosts

PURGE_DENY: removed HOSTS_DENY entries that are older than this time

            when DenyHosts is invoked with the --purge flag

      format is: i[dhwmy]

      Where 'i' is an integer (eg. 7)

            'm' = minutes

            'h' = hours

            'd' = days

            'w' = weeks

            'y' = years

# yum install denyhosts -y

# cp denyhosts.cfg denyhosts.cfg.bak

# vim denyhosts.cfg

############ THESE SETTINGS ARE REQUIRED ############

SECURE_LOG = /var/log/secure    #sshd的登陆日志文件

HOSTS_DENY = /etc/hosts.deny   #将需要阻止的IP写入到hosts.deny,所以这个工具只支持调用TCP Wrapper的协议

PURGE_DENY = 1h   #过多久后清除已阻止的IP,即阻断恶意IP的时长（1小时）

BLOCK_SERVICE  = sshd   #作用的服务名

DENY_THRESHOLD_INVALID = 1   #允许无效用户（不在/etc/passwd中）登录失败的次数

DENY_THRESHOLD_VALID = 5   #允许普通有效用户登录失败的次数

DENY_THRESHOLD_ROOT = 3    #允许root登录失败的次数

DENY_THRESHOLD_RESTRICTED = 1    #设定 deny host 写入到该文件夹

WORK_DIR = /var/lib/denyhosts    #将deny的host或ip记录到work_dir中

SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES

HOSTNAME_LOOKUP=NO    #是否做域名反解

LOCK_FILE = /var/lock/subsys/denyhosts    #将DenyHost启动的pid记录到LOCK_FILE中，已确保服务正确启动，防止同时启动多个服务

############ THESE SETTINGS ARE OPTIONAL ############

ADMIN_EMAIL = wawa@163.com   #设置管理员邮件地址

SMTP_HOST = localhost

SMTP_PORT = 25

SMTP_FROM = DenyHosts <nobody@localhost>

SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]

AGE_RESET_VALID=5d

AGE_RESET_ROOT=25d

AGE_RESET_RESTRICTED=25d

AGE_RESET_INVALID=10d

######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE  ##########

DAEMON_LOG = /var/log/denyhosts   #denyhost服务日志文件

DAEMON_SLEEP = 30s

DAEMON_PURGE = 1h      #该项与PURGE_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间

方式二：

cd /usr/local/src

tar zxvf DenyHosts-2.6.tar.gz

cd DenyHosts-2.6

python setup.py install

程序脚本自动安装到/usr/share/denyhosts

库文件安装到/usr/lib/python2.3/site-packages/DenyHosts

denyhosts.py 自动安装到/usr/bin

设置启动脚本

cd /usr/share/denyhosts

cp daemon-control-dist daemon-control

chown root daemon-control

chmod 700 daemon-control

grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg

echo "/usr/share/denyhosts/daemon-control start" >> /etc/rc.local

cd ln -s /usr/share/denyhosts/daemon-control denyhosts

chkconfig --add denyhosts

chkconfig --level 35 denyhosts on

service denyhosts start

注意CentOS7的开启

/etc/rc.local -> rc.d/rc.local

#!/bin/bash

# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES

#

# It is highly advisable to create own systemd services or udev rules

# to run scripts during boot instead of using this file.

#

# In contrast to previous versions due to parallel execution during boot

# this script will NOT be run after all other services.

#

# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure

# that this script will be executed during boot.

touch /var/lock/subsys/local

/usr/share/denyhosts/daemon-control start

在登陆过程中如果出现如下信息，表示/etc/hosts.deny已经生效：

Permission denied (publickey,gssapi-with-mic,password)

或者

ssh_exchange_identification: read: Connection reset

查看/etc/hosts.deny，发现有

sshd: 192.168.30.1

(3) 作为应用程序执行者的用户

一定要将其Shell设定为 nologin

(4) 查看登陆记录

命令：last

涉及的log文件 /var/log/wtmp

chmod 640 /var/log/wtmp

(5) 不定期检查硬件损害情况

grep error /var/log/messages

(6) 使用chkrootkit检查rootkit

chkrootkit -n| grep 'INFECTED'

或者使用脚本加入cron

# cat chkrootkit.sh

#!/bin/bash

PATH=/usr/bin:/bin

TMPLOG=`mktemp`

# Run the chkrootkit

/usr/bin/chkrootkit > $TMPLOG

# Output the log

cat $TMPLOG | logger -t chkrootkit

# bindshe of SMTPSllHow to do some wrongs

if [ ! -z "$(grep 465 $TMPLOG)" ] && \

   [ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then

   sed -i '/465/d' $TMPLOG

   fi

# If the rootkit have been found,mail root

[ ! -z "$(grep INFECTED $TMPLOG)" ] && \

grep INFECTED $TMPLOG | mail -s "chkrootkit report in `hostname`" root

官网 http://www.chkrootkit.org/

(7) 开源IPS

官网 https://www.snort.org/

巴特西