1. #! /bin/bash
    2. read -p  "设置密码最多可多少天不修改：" A
    3. read -p  "设置密码修改之间最小的天数：" B
    4. read -p  "设置密码最短的长度：" C
    5. read -p  "设置密码失效前多少天通知用户：" D
    6. sed -i '/^PASS_MAX_DAYS/c\PASS_MAX_DAYS   '$A'' /etc/login.defs
    7. sed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS   '$B'' /etc/login.defs
    8. sed -i '/^PASS_MIN_LEN/c\PASS_MIN_LEN     '$C'' /etc/login.defs
    9. sed -i '/^PASS_WARN_AGE/c\PASS_WARN_AGE    '$D'' /etc/login.defs
    11. echo "已对密码进行加固，新用户不得和旧密码相同，且新密码必须同时包含数字、小写字母，大写字母！！"
    12. sed -i '/pam_pwquality.so/c\password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=  difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-auth
    14. echo "已对密码进行加固，如果输入错误密码超过3次，则锁定账户！！"
    15. n=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "|wc -l`
    16. if [ $n -eq 0 ];then
    17. sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=3 unlock_time=150 even_deny_root root_unlock_time300' /etc/pam.d/sshd
    18. fi
    20. echo  "已设置禁止root用户远程登录！！"
    21. sed -i '/PermitRootLogin/c\PermitRootLogin no'  /etc/ssh/sshd_config
    23. read -p "设置历史命令保存条数：" E
    24. read -p "设置账户自动注销时间：" F
    25. sed -i '/^HISTSIZE/c\HISTSIZE='$E'' /etc/profile
    26. sed -i '/^HISTSIZE/a\TMOUT='$F'' /etc/profile
    28. echo "已设置只允许wheel组的用户可以使用su命令切换到root用户！"
    29. sed -i '/pam_wheel.so use_uid/c\auth            required        pam_wheel.so use_uid ' /etc/pam.d/su
    30. n=`cat /etc/login.defs | grep SU_WHEEL_ONLY | wc -l`
    31. if [ $n -eq 0 ];then
    32. echo SU_WHEEL_ONLY yes >> /etc/login.defs
    33. fi
    35. echo "即将对系统中的账户进行检查...."
    36. echo "系统中有登录权限的用户有："
    37. awk -F: '($7=="/bin/bash"){print $1}' /etc/passwd
    38. echo "********************************************"
    39. echo "系统中UID=0的用户有："
    40. awk -F: '($3=="0"){print $1}' /etc/passwd
    41. echo "********************************************"
    42. N=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
    43. echo "系统中空密码用户有：$N"
    44. if [ $N -eq 0 ];then
    45.  echo "恭喜你，系统中无空密码用户！！"
    46.  echo "********************************************"
    47. else
    48.  i=1
    49.  while [ $N -gt 0 ]
    50.  do
    51.     None=`awk -F: '($2==""){print $1}' /etc/shadow|awk 'NR=='$i'{print}'`
    52.     echo "------------------------"
    53.     echo $None
    54.     echo "必须为空用户设置密码！！"
    55.     passwd $None
    56.     let N--
    57.  done
    58.  M=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
    59.  if [ $M -eq 0 ];then
    60.   echo "恭喜，系统中已经没有空密码用户了！"
    61.  else
    62. echo "系统中还存在空密码用户：$M"
    63.  fi
    64. fi
    66. echo "即将对系统中重要文件进行锁定，锁定后将无法添加删除用户和组"
    67. read -p "警告：此脚本运行后将无法添加删除用户和组！！确定输入Y，取消输入N；Y/N：" i
    68. case $i in
    69.       [Y,y])
    70.             chattr +i /etc/passwd
    71.             chattr +i /etc/shadow
    72.             chattr +i /etc/group
    73.             chattr +i /etc/gshadow
    74.             echo "锁定成功！"
    75. ;;
    76.       [N,n])
    77.             chattr -i /etc/passwd
    78.             chattr -i /etc/shadow
    79.             chattr -i /etc/group
    80.             chattr -i /etc/gshadow
    81.             echo "取消锁定成功！！"
    82. ;;
    83.        *)
    84.             echo "请输入Y/y or  N/n"
    85. esac