VPS安全配置

防止CC攻击：使用开源的ddos-defender工具来实现通过netstat定时采集针对80,443,8080的连接数，单个IP连接数达到100以上，可以认为是CC攻击. 将被会主机拒绝1小时。

防主机密码破解：使用DenyHOsts工具进行针对了SSH登录日志进行扫描，普通用户登录失败3次以上，将被主机拒绝连接5分钟，root用户登录2次失败主机将拒绝连接5分钟。

 

防止端口扫描: 一旦有用户使用扫描器扫描节点的IP地址时，该用户的IP将立即被会系统加入到阻止的IP列表中，防止再次扫描。

 

#!/bin/bash -x
#used for vps
#DDoS-Defender-v2.1.0.tar.gz:  for cc ddos
#DenyHosts-2.6.tar.gz:
#portsentry-1.2.tar.gz: for portsentry
#rkhunter-1.4.0.tar.gz: for chkrookit
#lynis-1.3.0.tar.gz: for chkrookit

SRC=/usr/local/src
cd $SRC
#install msmtp client
# if your want support TLS/SSL,install openssl-devel
# yum install -y openssl-devel  //
wget http://nchc.dl.sourceforge.net/project/msmtp/msmtp/1.4.28/msmtp-1.4.28.tar.bz2
tar xjf msmtp-1.4.28.tar.bz2
cd msmtp-1.4.28
./configure --prefix=/usr/local/msmtp && make && make install
cd /usr/local/msmtp/
mkdir etc
echo 'account gmailhost smtp.gmail.com
from [email protected]
auth on
tls on
tls_starttls on
tls_force_sslv3 on
tls_trust_file /usr/local/msmtp/etc/gmail.crt
user [email protected]
password ********
port 587
syslog off
logfile /tmp/msmtp.log
account default: gmail'  >  /usr/local/msmtp/etc/msmtprc
wget -O /usr/local/msmtp/etc/gmail.crt http://www.geotrust.com/resources/extended-validation-ssl/certs/Equifax%20Secure%20Certificate%20Authority.crt
ln -s /usr/local/msmtp/bin/msmtp /usr/bin/
 echo "set sendmail=/usr/bin/msmtp" >> /etc/mail.rc

#install DenyHOsts
cd $SRC
wget http://nchc.dl.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz
tar -xzf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
cp /usr/share/denyhosts/daemon-control-dist /usr/share/denyhosts/daemon-control
cp /usr/share/denyhosts/denyhosts.cfg-dist /usr/share/denyhosts/denyhosts.cfg
chown root /usr/share/denyhosts/daemon-control
ln -s  /usr/share/denyhosts/daemon-control  /etc/init.d/denyhost
chkconfig --add denyhost
chkconfig --level  345 denyhost on

#configure file
ln -s /usr/share/denyhosts/denyhosts.cfg  /etc/
sed -i 's/PURGE_DENY\ =/PURGE_DENY\ = 5m/g' /etc/denyhosts.cfg
sed -i 's/DENY_THRESHOLD_INVALID\ = 5/DENY_THRESHOLD_INVALID\ = 1/g' /etc/denyhosts.cfg
sed -i 's/DENY_THRESHOLD_VALID\ = 10/DENY_THRESHOLD_VALID\ = 5/g' /etc/denyhosts.cfg
sed -i 's/DENY_THRESHOLD_ROOT\ = 1/DENY_THRESHOLD_ROOT\ = 3/g'  /etc/denyhosts.cfg
sed -i 's/HOSTNAME_LOOKUP=YES/HOSTNAME_LOOKUP=NO/g' /etc/denyhosts.cfg
sed -i 's/ADMIN_EMAIL\ =/ADMIN_EMAIL\ = [email protected]/g'  /etc/denyhosts.cfg
cd ..

#install lynis
cd $SRC
wget http://www.rootkit.nl/files/lynis-1.3.0.tar.gz
tar -xzf  lynis-1.3.0.tar.gz
mv lynis-1.3.0 /usr/local/lynis
cd ..

#install rkhunter-1.4.0.tar.g
cd $SRC
wget http://jaist.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz
tar -xzf rkhunter-1.4.0.tar.gz
cd rkhunter-1.4.0
./installer.sh --install

#configure file
sed -i 's/DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"/DISABLE_TESTS="suspscan deleted_files"/' /etc/rkhunter.conf
sed -i 's/ALLOW_SSH_ROOT_USER=no/ALLOW_SSH_ROOT_USER=without-password/' /etc/rkhunter.conf
sed -i 's/#ATTRWHITELIST=\/bin\/ps/ATTRWHITELIST=\/bin\/ps/' /etc/rkhunter.conf
sed -i 's/#WRITEWHITELIST=\/bin\/ps/WRITEWHITELIST=\/bin\/ps/' /etc/rkhunter.conf
sed -i 's/#SCRIPTWHITELIST=\/sbin\/ifup/SCRIPTWHITELIST=\/sbin\/ifup/' /etc/rkhunter.conf
sed -i 's/#SCRIPTWHITELIST=\/sbin\/ifdown/SCRIPTWHITELIST=\/sbin\/ifdown/' /etc/rkhunter.conf
sed -i 's/#SCRIPTWHITELIST=\/usr\/bin\/groups/SCRIPTWHITELIST=\/usr\/bin\/groups/' /etc/rkhunter.conf
sed -i 's/#ALLOWHIDDENDIR=\/dev\/.udev/ALLOWHIDDENDIR=\/dev\/.udev/' /etc/rkhunter.conf
sed -i 's/#ALLOWHIDDENDIR=\/dev\/.udevdb/ALLOWHIDDENDIR=\/dev\/.udevdb/' /etc/rkhunter.conf
sed -i 's/#ALLOWHIDDENFILE=\/usr\/sbin\/.sshd.hmac/ALLOWHIDDENFILE=\/usr\/sbin\/.sshd.hmac/' /etc/rkhunter.conf
sed -i 's/#ALLOWHIDDENFILE=\/usr\/bin\/.ssh.hmac/ALLOWHIDDENFILE=\/usr\/bin\/.ssh.hmac/' /etc/rkhunter.conf
sed -i 's/#ALLOWHIDDENFILE=\/usr\/bin\/.fipscheck.hmac/ALLOWHIDDENFILE=\/usr\/bin\/.fipscheck.hmac/' /etc/rkhunter.conf
echo 'ALLOWHIDDENDIR=/dev/ida' >> /etc/rkhunter.conf
sed -i 's/#SCRIPTWHITELIST=\/sbin\/ifdown/SCRIPTWHITELIST=\/sbin\/ifdown/' /etc/rkhunter.conf
sed -i 's/#SCRIPTWHITELIST=\/usr\/bin\/groups/SCRIPTWHITELIST=\/usr\/bin\/groups/' /etc/rkhunter.conf
echo 'SCRIPTWHITELIST=/usr/bin/ldd' >> /etc/rkhunter.conf
echo 'SCRIPTWHITELIST=/usr/bin/whatis' >> /etc/rkhunter.conf
echo 'SCRIPTWHITELIST=/usr/bin/GET'  >> /etc/rkhunter.conf
echo 'SCRIPTWHITELIST=/sbin/ifup'  >> /etc/rkhunter.conf
echo 'SCRIPTWHITELIST=/sbin/ifdown'  >> /etc/rkhunter.conf
cd ..

#install zeppoo
#cd $SRC
#wget http://cdnetworks-kr-2.dl.sourceforge.net/project/zeppoo/zeppoo-0.0.4/zeppoo-0.0.4.tar.gz/zeppoo-0.0.4.tar.gz

#install
wget http://pkgs.repoforge.org/chkrootkit/chkrootkit-0.49-1.el5.rf.x86_64.rpm
rpm -ivh chkrootkit-0.49-1.el5.rf.x86_64.rpm

#install portsentry
cd $SRC
wget http://flexbox.sourceforge.net/centos/5/x86_64/portsentry-1.2-1.el5.x86_64.rpm
rpm -ivh portsentry-1.2-1.el5.x86_64.rpm

sed -i 's/RESOLVE_HOST\ = "1"/RESOLVE_HOST\ = "0"/g'  /etc/portsentry/portsentry.conf
echo 'KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"' >>  /etc/portsentry/portsentry.conf
echo 'KILL_HOSTS_DENY="ALL: $TARGET$" ' >>   /etc/portsentry/portsentry.conf


#install logcheck
# //rpm -ivh logcheck-1.3.13-6.el5.noarch.rpm --nodeps