LInux系统安全----系统引导和登录控制

开关机安全控制

1. 调整bios引导设置

1）将第一优先引导设备设为当前系统所在磁盘
2）禁止从其他设备引导系统，对应的项设为“disabled”
3）将bios的安全级别设为“setup”，并设置好管理密码，以防止未授权的修改

2. 禁止Ctrl+Alt+Del快捷键重启

将/usr/lib/systemd/system/ctrl-alt-del.target 里的内容全部注释掉

[root@localhost bin]# vim /usr/lib/systemd/system/ctrl-alt-del.target 

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

# [Unit]
# Description=Reboot
# Documentation=man:systemd.special(7)
# DefaultDependencies=no
# Requires=systemd-reboot.service
# After=systemd-reboot.service
# AllowIsolate=yes
# JobTimeoutSec=30min
# JobTimeoutAction=reboot-force

# [Install]
# Alias=ctrl-alt-del.target

3.限制更改GRUB引导参数

[root@localhost bin]# grub2-setpassword  //设置grub2的密码
Enter password: 
Confirm password: 

[root@localhost bin]# grub2-mkpasswd-pbkdf2  //加密grub2密码
输入口令：
Reenter password: 
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.1DB35D28CA5CC914BE07E5574CD970E64D2B6EB4C46955E8726C827554EECE49C0F17168841091338E1E9B3AB209BAACDF43F1D1E973AC404815D640298AA561.285EB6AAFAFC5E2F9033C6D70C417C9BA5C1EE71E46D551B6B6E54EF0DAC6C13F390D7F7B0A8F30C042F7686EEDCF604234046CC51094443D8CF72CB0CD527BF
[root@localhost bin]# 

终端及登陆控制

减少开放的tty终端个数

编辑/etc/securetty文件，注释掉tty

[root@localhost ~]# cat /etc/securetty | grep "#"
#tty3
#tty4
#tty5

禁止普通用户登录

创建/etc/nologin文件即可限制普通用户登录，删除文件即可恢复登录

[root@localhost ~]# touch /etc/nologin