Detect whether secure socket layer encryption is used to transmit information to avoid eavesdropping on sensitive information
Test type: Whether to use encrypted remote administration ssh
Risk level: Medium risk
Risk detail: Remote administration of ssh without secure socket encryption
Solution:
1. Add or modify Protocol 2 in [/etc/ssh/sshd_config] file
2. Then run the command systemctl restart sshd to restart the process
Tips: This scheme can enhance the protection of SSH communication and avoid sensitive data leakage.
Check if the command-line interface timeout is set
Test type: Check if the command-line interface timeout is set
Risk level: Medium risk
Risk detail: No command line timeout is configured for exit
Solution:
1. Add tmout=300 in the file [/etc/profile], and the waiting time is not more than 600 seconds
2. Execute source /etc/profile to make the configuration work
Tips: This solution will make the server command line over a certain period of time does not operate automatically shut down, can strengthen the security of the server.
User FTP access security configuration checks
Test type: User FTP access security configuration
Risk level: Medium risk
Risk detail: Currently pure-ftpd is not configured with security access. Modify/add the value of Umask to 177:077 in the [pure-ftpd.conf] file
Solution:
1. In [/www/server/pure-ftpd/etc/pure-ftpd.conf] change the value of Umask to 177:077 in the config file
Tips: This scheme can enhance the protection of FTP server and reduce the risk of server intrusion.
Check important files for suid and sgid permissions
Test type: Check for files with suid and sgid permissions
Risk level: Medium risk
Risk detail: The following files have sid privilege, chmod u-s or g-s remove sid bits: “/usr/bin/chage、/usr/bin/gpasswd、/usr/bin/wall、/usr/bin/chfn、/usr/bin/chsh、/usr/bin/newgrp、/usr/bin/write、/usr/sbin/usernetctl、/bin/mount、/bin/umount、/sbin/netreport”
Solution:
1. Use the chmod u-s/g-s [filename] command to change the permissions of the file
Tips: This scheme removes the special permissions of important files, which can prevent intruders from using these files for privilege escalation.
chmod g-s /usr/bin/chage chmod u-s /usr/bin/gpasswd chmod u-s /usr/bin/chfn chmod u-s /usr/bin/chsh chmod u-s /usr/bin/newgrp chmod u-s /bin/mount chmod u-s /bin/umount
bootloader Configuring permission checks
Test type: bootloader Configuring permissions
Risk level: Medium risk
Risk detail: The following critical file or directory permissions are incorrect:/boot/grub2/grub.cfg Current permissions: 644 : root Security permissions: 600 : root
Solution:
1. Configure secure permissions for grub according to the file suggested by the risk description
2. If grub2, then: chmod 600 /boot/grub2/grub.cfg、chown root /boot/grub2/grub.cfg
3. If grub, then: chmod 600 /boot/grub/grub.cfg、chown root /boot/grub/grub.cfg
Tips: This scheme can strengthen the server grub interface protection, further prevent external intrusion server.
Check if an empty password user exists
Test type: Check if an empty password user exists
Risk level: High risk
Risk detail: Found an empty password user【】
Solution:
1. Log in to server as root, set password for empty password user
2. If you do not know the user’s purpose, you can execute the command [passwd -l (username)] to temporarily block the user.Unlock user command [passwd-fu (username)]
Tips: detects the existence of blank password users, may be hackers reserved backdoor users, if not business needs to suggest setting a password.
sudo awk -F":" '($2 == "") {print $1 ": has no password."}' /etc/shadow
Critical file permission checks
Test type: Critical file permission checks
Risk level: High risk
Risk detail: The following critical files or directories have permission errors:
/etc/shadow Current permissions: 000 : root Suggested changes to: 400 : root
/etc/security Current permissions: 755 : root Suggested changes to: 600 : root
/etc/ssh/sshd_config Current permissions: 600 : root Suggested changes to: 644 : root
/etc/gshadow Current permissions: 000 : root Suggested changes to: 400 : root
/etc/shadow Current permissions: 000 : root Suggested changes to: 400 : root
/etc/gshadow Current permissions: 000 : root Suggested changes to: 400 : root
Solution:
1、On the [File] page, set the correct permissions and owner for the specified directory or file
Detect whether to limit password reuse times
Test type: Check password reuse limit
Risk level: Medium risk
Risk detail: Unlimited password reuse
Solution:
1、Configuration file backup: cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
2、Add or modify remember=5 after [password sufficient] in [/etc/pam.d/system-auth] file
SSH idle timeout detection
Test type: SSH idle timeout detection
Risk level: Medium risk
Risk detail: The current SSH idle timeout time is: 0, it is recommended to set it to 600-900
Solution:
1、Set [ClientAliveInterval] in the [/etc/ssh/sshd_config] file to be between 600 and 900
2、Tip: The recommended SSH idle timeout time is: 600-900
Check whether the current panel port is safe
Test type: Panel port
Risk level: Medium risk
Risk detail: The panel port is the default port (7800), which may cause unnecessary security risks
Solution:
1. Please modify the default panel port on the [Settings] page
2. Note: Servers with [Security Group] should release the new port in the [Security Group] in advance to prevent the new port cannot be opened
SSH password complexity check
Test type: SSH password complexity check
Risk level: Medium risk
Risk detail: 【/etc/security/pwquality.conf】set the minclass setting to 3 or 4 in the file
Solution:
1、【/etc/security/pwquality.conf】 Set password complexity to require 3 or 4 types of characters, such as lowercase letters, uppercase letters, numbers, and special characters. like：
2、minclass=3
/etc/bashrc User default permission check
Test type: [/etc/bashrc] User default permission check
Risk level: Medium risk
Risk detail: umask is not set to 027
Solution:
1、[/etc/bashrc] The umask set in the file is 002, and it is recommended to set it to 027
2、Solution: Modify the /etc/bashrc file permission to 027
Panel login alarm
Test type: Panel login alarm
Risk level: Medium risk
Risk detail: Please enable it in [Settings] – [Notification]
Solution:
1、Enable it in [Settings] – [Notification]
[/etc/csh.cshrc] User default permission check
Test type: [/etc/csh.cshrc] User default permission check
Risk level: Medium risk
Risk detail: umask not set to 027
Solution:
1、[/etc/csh.cshrc] The umask set in the file is 002, which does not meet the requirements. It is recommended to set it to 027
2、The operation is as follows: Modify umask to 027
Check the minimum interval between SSH password changes
Test type: Check the minimum interval between SSH password changes
Risk level: Medium risk
Risk detail: 【/etc/login.defs】In the file, PASS_MIN_DAYS is greater than or equal to 7
Solution:
1、[/etc/login.defs] PASS_MIN_DAYS should be set to be greater than or equal to 7
2、PASS_MIN_DAYS 7 needs to execute the command at the same time to set the expiration time of the root password. The command is as follows: chage –mindays 7 root
Check SSH password expiration time
Test type: Check SSH password expiration time
Risk level: Medium risk
Risk detail: 【/etc/login.defs】Set PASS_MAX_DAYS to between 90-180 in the file
Solution:
1、[/etc/login.defs] Use a non-password login key pair. Please ignore this, and set the PASS_MAX_DAYS parameter to between 90-180 in /etc/login.defs
2、PASS_MAX_DAYS 90 You need to execute the command to set the root password expiration time at the same time. The command is as follows: chage –maxdays 90 root
The panel is not monitoring
Test type: The panel is not monitoring
Risk level: Low risk
Risk detail: Open it in [Monitor] – [System Monitor]
Solution:
1、Open it in [Monitor] – [System Monitor]
Check the website to prevent cross-site
Test type: Website anti-cross-site detection
Risk level: Low risk
Risk detail: The following websites are not enabled for cross-site prevention: …
Solution:
1. On the [WebSite] page, [Settings]-[Site Directory], turn on the [Anti-cross-site attack (open_basedir)] function
PHP version leaked
Test type: PHP version leaked
Risk level: High risk
Risk detail: Risk-free
Suggest:
1. Set [expose_php] in the [php.ini] file and configure it to Off
2. Tips: Set [expose_php] in the [php.ini] file and configure it to Off
Tips: This solution can prevent the disclosure of sensitive information on the website and reduce the possibility of server intrusion.
