记录正在发生的一切

1
bash <(curl -sL kejilion.sh)

1
#!/bin/bash
2
set -e
3

4
echo "📦 系统更新..."
5
if command -v apt >/dev/null; then
6
    apt update && apt upgrade -y
7
elif command -v yum >/dev/null; then
8
    yum update -y
9
elif command -v dnf >/dev/null; then
10
    dnf upgrade -y
11
else
12
    echo "❌ 不支持的包管理器"
13
    exit 1
14
fi
15

16
echo "🔐 移除 suid/sgid（保留 mount/umount）"
17
chmod u-s /usr/bin/gpasswd 2>/dev/null || true
18
chmod u-s /usr/bin/chfn    2>/dev/null || true
19
chmod u-s /usr/bin/chsh    2>/dev/null || true
20
chmod u-s /usr/bin/newgrp  2>/dev/null || true
21
chmod g-s /usr/bin/chage   2>/dev/null || true
22

23
echo "🕒 SSH 登录超时配置"
24
sshd_config=$(find /etc/ssh -name 'sshd_config' 2>/dev/null | head -n 1)
25
if [ -f "$sshd_config" ]; then
26
    sed -i '/^#\?LoginGraceTime/c\LoginGraceTime 60' "$sshd_config"
27
fi
28

29
echo "🕓 SSH 空闲超时配置"
30
if [ -f "$sshd_config" ]; then
31
    sed -i '/^#\?ClientAliveInterval/c\ClientAliveInterval 600' "$sshd_config"
32
fi
33

34
echo "📛 禁用 Ping"
35
sysctl -w net.ipv4.icmp_echo_ignore_all=1
36
grep -q "icmp_echo_ignore_all" /etc/sysctl.conf || echo "net.ipv4.icmp_echo_ignore_all = 1" >> /etc/sysctl.conf
37

38
echo "🔒 修复 grub 权限"
39
for grubfile in /boot/grub2/grub.cfg /boot/grub/grub.cfg; do
40
    if [ -f "$grubfile" ]; then
41
        chmod 600 "$grubfile"
42
        chown root:root "$grubfile"
43
    fi
44
done
45

46
echo "💾 限制核心转储"
47
sysctl -w fs.suid_dumpable=0
48
grep -q "fs.suid_dumpable" /etc/sysctl.conf || echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf
49

50
echo "🔑 设置最小密码修改间隔"
51
if [ -f /etc/login.defs ]; then
52
    sed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS   7' /etc/login.defs
53
fi
54
if command -v chage >/dev/null; then
55
    chage --mindays 7 root || true
56
fi
57

58
echo "🔐 强制使用 SSH Protocol 2"
59
if [ -f "$sshd_config" ]; then
60
    sed -i '/^#\?Protocol/c\Protocol 2' "$sshd_config"
61
fi
62

63
echo "⚠️ 移除 cloud-init sudo NOPASSWD 权限"
64
[ -f /etc/sudoers.d/90-cloud-init-users ] && sed -i 's/NOPASSWD.*//' /etc/sudoers.d/90-cloud-init-users
65

66
echo "⏱️ 命令行超时退出设置"
67
grep -q "TMOUT=" /etc/profile || echo "TMOUT=300" >> /etc/profile
68

69
echo "🧹 设置 ls 命令别名（保留 rm 原样）"
70
grep -q "alias ls=" ~/.bashrc || echo "alias ls='ls -alh --color=auto'" >> ~/.bashrc
71

72
echo "📡 启用 TCP SYN cookie 防护"
73
sysctl -w net.ipv4.tcp_syncookies=1
74
grep -q "tcp_syncookies" /etc/sysctl.conf || echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
75

76
echo "👮 限制 su 切换为 root，仅允许 wheel 组用户"
77
if ! grep -q "pam_wheel.so" /etc/pam.d/su 2>/dev/null; then
78
    echo "auth required pam_wheel.so" >> /etc/pam.d/su
79
fi
80
groupadd wheel 2>/dev/null || true
81
gpasswd -a root wheel 2>/dev/null || true
82

83
echo "✅ 所有安全修复已完成，建议手动执行：systemctl restart sshd"