Amathiphu okuphepha kuzinhlelo ze-GNU / Linux

Yebo, bengikulungiselela lokhu okuthunyelwe ibhulogi yami isikhathi esithile bangiphakamisela yona ku- DesdeLinux, futhi ngenxa yokushoda kwesikhathi, ubengakwazi noma ethanda. Uma ngivila ngandlela thile 😀. Kepha manje batelekile, njengoba sisho eCuba ...

0- Gcina amasistimu ethu evuselelwa ngezibuyekezo zakamuva zokuphepha.

0.1- Uhlu Olubalulekile Lwe-imeyiliUmeluleki Wezokuphepha weSlackware, Umeluleki wezokuphepha we-Debian, kimi]

1- Zero ukufinyelela ngokomzimba kumaseva ngabasebenzi abangagunyaziwe.

1.1- Sebenzisa iphasiwedi ku- I-BIOS amaseva ethu

1.2- Ayikho ibhuthi ngeCD / DVD

1.3- Iphasiwedi ku-GRUB / Lilo

2- Inqubomgomo yephasiwedi enhle, izinhlamvu zamagama nezinye.

2.1- Ukuguga kwamaphasiwedi [Ukuguga kwephasiwedi] ngomyalo we “chage”, kanye nenombolo yezinsuku phakathi kokushintshwa kwephasiwedi nosuku lokugcina lokushintsha.

2.2- Gwema ukusebenzisa amaphasiwedi wangaphambilini:

ku /etc/pam.d/common-password

password sufficient pam_unix.so use_auth ok md5 shadow remember 10

Ngakho-ke ushintsha iphasiwedi futhi ikukhumbuza amaphasiwedi wokugcina ayi-10 umsebenzisi abenawo.

3- Inqubomgomo yokuphatha / yokuhlukanisa kahle yenethiwekhi yethu [ama-routers, switch, vlans] kanye ne-firewall, kanye nemithetho yokuhlunga INPUT, OUTPUT, FORWARD [NAT, SNAT, DNAT]

4- Nika amandla ukusetshenziswa kwamagobolondo [/ etc / shells]. Abasebenzisi akudingeki bangene ohlelweni bathola / bin / false noma / bin / nologin.

5- Vimba abasebenzisi lapho ukungena ngemvume kwehluleka [i-faillog], kanye nokulawula i-akhawunti yomsebenzisi wesistimu.

ipasswd -l pepe -> vimba iposi lomsebenzisi ipasswd -v pepe -> vulela iposi lomsebenzisi

6- Nika amandla ukusetshenziswa kwe- "Sudo", UNGALOKOTHI ungene ngemvume njengezimpande nge-ssh, "NEVER". Eqinisweni kufanele uhlele ukumiswa kwe-ssh ukufeza le nhloso. Sebenzisa izinkinobho zomphakathi / eziyimfihlo kumaseva wakho ngeSudo.

7- Sebenzisa ezinhlelweni zethu “Isimiso selungelo elincane".

8- Bheka izinsizakalo zethu ngezikhathi ezithile [netstat -lptun], zeseva ngayinye yethu. Faka amathuluzi wokuqapha angasisiza kulo msebenzi [Nagios, Cacti, Munin, Monit, Ntop, Zabbix].

9- Faka ama-IDS, Snort / AcidBase, Snotby, Barnyard, OSSEC.

10- UNmap ungumngani wakho, yisebenzise ukuhlola ama-subnet / subnet akho.

11- Imikhuba emihle yokuphepha ku-OpenSSH, i-Apache2, i-Nginx, i-MySQL, i-PostgreSQL, i-Postfix, i-squid, i-Samba, i-LDAP [leyo esetshenziswa kakhulu] kanye nenye insizakalo oyidingayo kunethiwekhi yakho.

12- Bethela konke ukuxhumana ngenkathi kungenzeka ezinhlelweni zethu, i-SSL, i-gnuTLS, i-StarTTLS, ukugaya, njll. Futhi uma uphatha imininingwane ebucayi, bhala ngemfihlo i-hard drive yakho !!!

13- Vuselela amaseva ethu eposi ngemithetho yakamuva yezokuphepha, yokuvinjelwa kanye neye-antispam.

14- Ukungena ngemvume komsebenzi ezinhlelweni zethu nge-logwatch kanye nokuhlolwa kokuhlola.

15- Ulwazi nokusetshenziswa kwamathuluzi anjenge top, sar, vmstat, free, phakathi kwabanye.

sar -> umbiko womsebenzi wohlelo vmstat -> izinqubo, inkumbulo, isistimu, i / o, umsebenzi we-cpu, njll iostat -> cpu i / o isimo mpstat -> isimo se-multiprocessor nokusetshenziswa pmap -> ukusetshenziswa kwememori ngezinqubo zamahhala -> iptraf memory -> Ithrafikhi ngesikhathi sangempela se-ethstatus yethu yenethiwekhi -> i-ethernet yezibalo ezisekelwa kukhonsoli eqapha i-etherape -> inethiwekhi yokuqhafaza yenethiwekhi ss -> isimo sesokhethi [i-tcp socket info, udp, amasokhethi aluhlaza, amasokhethi eDCCP] tcpdump -> Ukuhlaziywa okuningiliziwe kwe-traffic vnstat -> Ukuqapha ithrafikhi yenethiwekhi ye-interface ekhethiwe mtr -> ithuluzi lokuxilonga nokuhlaziywa kokugcwala kakhulu kumanethiwekhi ethtool -> izibalo mayelana namakhadi enethiwekhi

Okwamanje kuphelele. Ngiyazi ukuthi kukhona iziphakamiso zokuphepha eziyinkulungwane neyodwa kulolu hlobo lwendawo, kepha lezi yizo ezingithinte kakhulu, noma ukuthi kwesinye isikhathi kuye kwadingeka ngisebenzise / ngivivinye umzimba endaweni engiyiphethe .

Ukwanga futhi ngethemba lokuthi kuzokusebenzela 😀