---
# System prepended metadata

title: Untitled

---

==CentOS登入帳密==
	root / Xsw@#edC2345
	user / Xsw@#edC2345

==su, sudo練習==
visudo
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
user    ALL=(ALL)       /bin/systemctl *

==停用firewalld，改用iptables==
systemctl stop firewalld.service
systemctl disable firewalld.service
yum install iptables-services
systemctl start iptables.service
systemctl enable iptables.service

==安裝EPEL==
yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

==/etc/fail2ban/jail.d/sshd.conf==
[sshd]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
maxretry = 10
	
==Windows以Key Pair登入SSH==
[/etc/ssh/sshd_config] 
	PubkeyAuthentication yes

==密碼複雜度==
[/etc/pam.d/system-auth]
	password    requisite     pam_cracklib.so retry=3 minlen=12 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
	password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4

==設定帳號鎖定時間(錯3次，鎖15分鐘)==
[ssh登入]/etc/pam.d/password-auth-ac，加入以下設定：
	auth	required      pam_tally2.so deny=3 unlock_time=900
	account  	required      pam_tally2.so
[本機(console)登入]/etc/pam.d/system-auth ，加入以下設定：
	auth	required     pam_tally2.so deny=3 unlock_time=900
	account     	required      pam_tally2.so

==設定帳號閒罝自動登出(例如30分鐘)==
[bash]在/etc/bashrc加入以下內容
	TMOUT=1800
	readonly TMOUT
	export TMOUT
[csh]在/etc/cshrc加入以下內容
	set -r autologout = 1800


==/etc/ntp.conf==
server tock.stdtime.gov.tw
server watch.stdtime.gov.tw
server time.stdtime.gov.tw
server clock.stdtime.gov.tw
server tick.stdtime.gov.tw

==禁止使用USB儲存裝置==
mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko.xz /root/ usb-storage.ko.xz.bak
modprobe -r usb-storage
lsmod | grep usb-storage
[/etc/modprobe.d/blacklist.conf]
	blacklist usb-storage
[/etc/modprobe.d/usb-storage.conf]
	install usb-storage /bin/true

==iptables recent module範例==
iptables  -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables  -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update  --seconds 60 --hitcount 11 -j LOG --log-prefix "Possible DDoS Attack"
iptables  -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update  --seconds 60 --hitcount 11 -j DROP
iptables  -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

==knock server下載網址==
(先安裝wget： yum install wget)
wget http://li.nux.ro/download/nux/dextop/el7/x86_64/knock-server-0.7-2.el7.nux.x86_64.rpm
yum install knock-server-0.7-2.el7.nux.x86_64.rpm

==knock client下載網址==
【windows版】http://www.zeroflux.org/proj/knock/files/knock-win32.zip
【Linux版】
http://li.nux.ro/download/nux/dextop/el7/x86_64/knock-0.7-2.el7.nux.x86_64.rpm



==/etc/knockd.conf==
[options]
        UseSyslog
        LogFile   = /var/log/knockd.log
        Interface = ens33

[openSSH]
        sequence      = 2222:udp,3333:tcp,4444:udp
        seq_timeout   = 15
        tcpflags      = syn
        start_command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport ssh -j ACCEPT
        cmd_timeout   = 10
        stop_command  = /sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPT

[closeSSH]
        sequence      = 4444:udp,3333:tcp,2222:udp
        seq_timeout   = 15
        tcpflags      = syn
        command       = /sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPT

==課後問卷==
https://docs.google.com/forms/d/1hcLAflgjvEG0-LmiIbFIFLwCkQDrE7ezh3yvMCbiT9g/edit