CentOS安全防护实例

(1) 借助iptables的recent模块限制IP连接数

可以限制瞬间连接数过大的恶意IP（比如web应用防护，但不适用于LVS+Keepalived集群环境）
防护指令如下

# 允许一个客户端60秒内可以发起20个对web服务器的连接
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name web --set
# iptables默认将日志输出到/var/log/messages
iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j LOG --log-prefix 'HTTP attack: '
iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j DROP

效率的产生是因为netfilter在网络应用的低层级上就实现了封堵，调用资源少。这如同硬件防火墙在转发面就实现封堵，而不会上升到控制面。

(2) 防SSH暴力破解

使用工具DenyHosts，原理为：
python2写成，分析/var/log/secure日志文件，当发现同一IP在进行多次SSH登陆尝试时，就会将IP记录到tcpwrappers配置文件/etc/hosts.deny中。

• 环境确认

ldd /sbin/sshd | grep libwrap 
回显
libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f2844d53000)
说明你所使用的sshd支持TCP Wrappers。
python -V 查看版本是不是2.x.x
可以用如下命令统计一下可疑IPv4地址的数量
cat /var/log/secure | grep -o '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' | uniq -c
可以结合iptables再限制：
#每分钟对ssh的新连接只允许两个，已建立的连接不限制
iptables -P INPUT DROP
iptables -A INPUT -m state –state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp –dport 22 -m limit –limit 2/minute –limit-burst 2 -m state –state NEW -j ACCEPT

• 安装
  方式一：

# Debian/Ubuntu
$ sudo apt-get install denyhosts
 
# RedHat/CentOS
$ yum update
$ yum install denyhosts
或者
$ wget http://ftp.tu-chemnitz.de/pub/linux/dag/redhat/el7/en/x86_64/rpmforge/RPMS/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
$ rpm -Uvh rpmforge-release*rpm
$ yum install denyhosts
$ systemctl status denyhosts
或者
$ service denyhosts status
$ chkconfig denyhosts on
 
# Archlinux
$ yaourt denyhosts
 
# Gentoo
$ emerge -av denyhosts

//白名单配置
$ vim /etc/hosts.allow
 
//添加你的IP到白名单
$ sshd: Your_IP
 
//黑名单配置
$ vim /etc/hosts.deny
 
//如果要禁止所有连接，那就
$ sshd: ALL **
 
//查看denyhosts收集到的恶意ip
$ cat /etc/hosts.deny

denyhosts配置详解
配置文件/etc/denyhosts.conf
或者
/etc/denyhosts/denyhosts.cfg
具体可以使用如下命令查看：
rpm -ql denyhosts

PURGE_DENY: removed HOSTS_DENY entries that are older than this time  
            when DenyHosts is invoked with the --purge flag

      format is: i[dhwmy]

      Where 'i' is an integer (eg. 7) 
            'm' = minutes
            'h' = hours
            'd' = days
            'w' = weeks
            'y' = years

# yum install denyhosts -y
# cp denyhosts.cfg denyhosts.cfg.bak
# vim denyhosts.cfg

############ THESE SETTINGS ARE REQUIRED ############
SECURE_LOG = /var/log/secure    #sshd的登陆日志文件  
HOSTS_DENY = /etc/hosts.deny   #将需要阻止的IP写入到hosts.deny,所以这个工具只支持调用TCP Wrapper的协议  
PURGE_DENY = 1h   #过多久后清除已阻止的IP,即阻断恶意IP的时长（1小时）  
BLOCK_SERVICE  = sshd   #作用的服务名  
DENY_THRESHOLD_INVALID = 1   #允许无效用户（不在/etc/passwd中）登录失败的次数  
DENY_THRESHOLD_VALID = 5   #允许普通有效用户登录失败的次数  
DENY_THRESHOLD_ROOT = 3    #允许root登录失败的次数  
DENY_THRESHOLD_RESTRICTED = 1    #设定 deny host 写入到该文件夹  
WORK_DIR = /var/lib/denyhosts    #将deny的host或ip记录到work_dir中  
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES  
HOSTNAME_LOOKUP=NO    #是否做域名反解  
LOCK_FILE = /var/lock/subsys/denyhosts    #将DenyHost启动的pid记录到LOCK_FILE中，已确保服务正确启动，防止同时启动多个服务

############ THESE SETTINGS ARE OPTIONAL ############
ADMIN_EMAIL = wawa@163.com   #设置管理员邮件地址  
SMTP_HOST = localhost  
SMTP_PORT = 25  
SMTP_FROM = DenyHosts <nobody@localhost>  
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]  
AGE_RESET_VALID=5d  
AGE_RESET_ROOT=25d  
AGE_RESET_RESTRICTED=25d  
AGE_RESET_INVALID=10d

######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE  ##########
DAEMON_LOG = /var/log/denyhosts   #denyhost服务日志文件

DAEMON_SLEEP = 30s  
DAEMON_PURGE = 1h      #该项与PURGE_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间

方式二：

cd /usr/local/src
tar zxvf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
程序脚本自动安装到/usr/share/denyhosts
库文件安装到/usr/lib/python2.3/site-packages/DenyHosts
denyhosts.py 自动安装到/usr/bin

设置启动脚本
cd /usr/share/denyhosts
cp daemon-control-dist daemon-control
chown root daemon-control
chmod 700 daemon-control
grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg
echo "/usr/share/denyhosts/daemon-control start" >> /etc/rc.local
cd ln -s /usr/share/denyhosts/daemon-control denyhosts
chkconfig --add denyhosts
chkconfig --level 35 denyhosts on
service denyhosts start

注意CentOS7的开启

/etc/rc.local -> rc.d/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.

touch /var/lock/subsys/local

/usr/share/denyhosts/daemon-control start

在登陆过程中如果出现如下信息，表示/etc/hosts.deny已经生效：

Permission denied (publickey,gssapi-with-mic,password)
或者
ssh_exchange_identification: read: Connection reset

查看/etc/hosts.deny，发现有

sshd: 192.168.30.1

(3) 作为应用程序执行者的用户

一定要将其Shell设定为 nologin

(4) 查看登陆记录

命令：last
涉及的log文件 /var/log/wtmp
chmod 640 /var/log/wtmp

(5) 不定期检查硬件损害情况

grep error /var/log/messages

(6) 使用chkrootkit检查rootkit

chkrootkit -n| grep 'INFECTED'

或者使用脚本加入cron

# cat chkrootkit.sh
#!/bin/bash
PATH=/usr/bin:/bin

TMPLOG=`mktemp`

# Run the chkrootkit
/usr/bin/chkrootkit > $TMPLOG

# Output the log
cat $TMPLOG | logger -t chkrootkit

# bindshe of SMTPSllHow to do some wrongs
if [ ! -z "$(grep 465 $TMPLOG)" ] && 
   [ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
   sed -i '/465/d' $TMPLOG
   fi

# If the rootkit have been found,mail root
[ ! -z "$(grep INFECTED $TMPLOG)" ] && 
grep INFECTED $TMPLOG | mail -s "chkrootkit report in `hostname`" root

官网 http://www.chkrootkit.org/

(7) 开源IPS

官网 https://www.snort.org/