Linux Security Tips

Question

3. Linux Security Tips
4. By Kapil Sharma
7. --------------------------------------------------------------------------------
10. In this article I will explain  how to make your Linux box secure by taking  basic security measures. This article will enable anybody to tighten the security of a redhat Linux box.
12. BIOS Security
13. Always set a password on BIOS to disallow booting from floppy by changing the BIOS settings. This  will block undesired people from trying to boot your Linux system with a special boot disk and will  protect you from people trying to change BIOS feature like allowing boot from floppy drive or  booting the server without password prompt.
15. LILO Security
16. Add the three parameters in "/etc/lilo.conf" file i.e. time-out, restricted and  password. These options will ask for password if boot time options (such as "linux single") are passed to the boot loader.
17. Step 1
18. Edit the lilo.conf file (vi /etc/lilo.conf) and add or change the three options :
19. boot=/dev/hda
20. map=/boot/map
21. install=/boot/boot.b
22. time-out=00   #change this line to 00
23. prompt
24. Default=linux
25. restricted   #add this line
26. password=<password>;   #add this line and put your password
27. image=/boot/vmlinuz-2.2.14-12
28. label=linux
29. initrd=/boot/initrd-2.2.14-12.img
30. root=/dev/hda6
31. read-only
33. Step 2
34. The "/etc/lilo.conf" file should be readable by only root because it contains unencrypted passwords.
35. [root@kapil /]# chmod 600 /etc/lilo.conf (will be no longer world readable).
37. Step 3
38. Update your configuration file "/etc/lilo.conf" for the change to take effect.
39. [Root@kapil /]# /sbin/lilo -v (to update the lilo.conf file).
41. Step 4
42. One more security measure you can take to secure the "/etc/lilo.conf" file is to set it immutable, using the chattr command.
43.      *  To set the file immutable simply, use the command:
44.              [root@kapil /]# chattr +i /etc/lilo.conf
45. This will prevent any changes (accidental or otherwise) to the "lilo.conf" file.
47. For more information about lilo security, read my article on LILO.
49.   
51. Disable all special accounts
52. You should  delete all default users and group accounts that you don't use on your system like lp, sync, shutdown, halt, news, uucp, operator, games, gopher etc
53. To delete a user account :
54. [root@kapil /]# userdel LP
56. To delete a group:
57. [root@kapil /]# groupdel LP
59. Choose a Right password
60. You should follow the following guidelines before choosing the right password.
62. The password Length: The minimum acceptable password length by default when you install your Linux system is 5.  This is not enough and must be 8.  To do this you have to edit the login.defs file (vi /etc/login.defs) and change the line that read:
64. PASS_MIN_LEN    5
65. To read:
66. PASS_MIN_LEN    8
67. The "login.defs" is the configuration file for the login program.
68. Enable shadow password support
69. You should enable the shadow password feature. You can use the "/usr/sbin/authconfig" utility to enable the shadow password feature on your system. If you want to convert the existing passwords and group on your system to shadow passwords and groups  then you can use the commands pwconv, grpconv respectively.
70.   
71. The root account
72. The "root" account is the most privileged account on a Unix system. When the administrator forgot to logout from the system root prompt before leaving the system then the system should automatically logout from the shell. To do that, you must set the special variable of  Linux named "TMOUT" to the time in seconds.
73. Edit your profile file "vi /etc/profile" and add the following line somewhere after the line that read
74. "HISTFILESIZE="
75. TMOUT=3600
76. The value we enter for the variable "TMOUT=" is in second and represent 1 hours (60 * 60 =
77. 3600 seconds). If you put this  line in your "/etc/profile" file, then the automatic logout after one hour of inactivity will apply for all users on the system. You can set this variable in user's individual ".bashrc " file to automatically logout them after a certain time.
78. After this parameter has been set on your system, you must logout and login again (as root) for  the change to take effect.
79. Disable all console-equivalent access for regular users
80. You should disable all console-equivalent access to programs like shutdown, reboot, and halt for regular users on your server.
81. To do this, run the following command:
82. [root@kapil /]# rm -f /etc/security/console.apps/<servicename>;
83. Where <servicename>; is the name of the program to which you wish to disable console-equivalent access.
85. Disable & uninstall all unused services
86. You should  disable and uninstall all services that you do not use so that you have one less thing to worry about. Look at your "/etc/inetd.conf" file and  disable what you do not need by commenting them out (by adding a # at the beginning of the line), and then sending your inetd process a SIGHUP command to update it to the current "inetd.conf" file.  To do this:
87. Step 1
88. Change the permissions on "/etc/inetd.conf" file to 600, so that only root can read or write to it.
89. [Root@kapil /]# chmod 600 /etc/inetd.conf
91. Step 2
92. ENSURE that the owner of the file "/etc/inetd.conf" is root.
94. Step 3
95. Edit the inetd.conf file (vi /etc/inetd.conf) and disable the services like:
96. ftp, telnet, shell, login, exec, talk, ntalk, imap, pop-2, pop-3, finger, auth, etc unless you plan to use it. If it's turned off it's much less of a risk.
98. Step 4
99. Send a HUP signal to your inetd process
100. [root@kapil /]# killall -HUP inetd
102. Step 5
103. Set "/etc/inetd.conf" file immutable,  using the chattr command so that nobody can modify that file
104.        *  To set the file immutable simply, execute the following command:
105.              [root@kapil /]# chattr +i /etc/inetd.conf
106. This will prevent any changes (accidental or otherwise) to the "inetd.conf" file. The only person that can set or clear this attribute is the super-user root.  To modify the inetd.conf file you will need to unset the immutable flag:
107. *  To unset the immutable simply, execute the following command:
108.              [root@kapil /]# chattr -i /etc/inetd.conf
110. TCP_WRAPPERS
111. By using TCP_WRAPPERS  you can make  your server  secure against outside intrusion . The best policy is to deny all hosts by putting "ALL: ALL@ALL, PARANOID" in the "/etc/hosts.deny" file and then explicitly list  trusted hosts who are allowed to your machine in the "/etc/hosts.allow" file. TCP_WRAPPERS is controlled from two files and the search stops at the first match.
112. /etc/hosts.allow
113. /etc/hosts.deny
115. Step 1
116. Edit the hosts.deny file (vi /etc/hosts.deny) and add the following lines:
117. # Deny access to everyone.
118. ALL: ALL@ALL, PARANOID
119. Which means all services, all locations is blocked, unless they are permitted access by entries in the allow file.
121. Step 2
122. Edit the hosts.allow file (vi /etc/hosts.allow) and add for example, the following line:
123. As an example:
124. ftp: 202.54.15.99 foo.com
125. For your client machine: 202.54.15.99 is the IP address and foo.com the host name of one of your client allowed using ftp.
127. Step 3
128. The tcpdchk program is the tcpd wrapper configuration checker. It examines your tcp wrapper  configuration and reports all potential and real problems it can find.
130. *  After your configuration is done, run the program tcpdchk.
131.              [Root@kapil /]# tcpdchk
133. Don't let system issue file to be displayed
134. You should not  display your  system issue file when people log in remotely . To do this,  you can
135. change the telnet option in your "/etc/inetd.conf".
136. To do this change the line in "/etc/inetd.conf":
139. telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
140. to look like:
141. telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd -h
142. Adding the "-h" flag on the end will cause the daemon to not display any system information and  just hit the user with a login: prompt.  I will recommend to use sshd instead.
144. Change the "/etc/host.conf" file
145. The  "/etc/host.conf" file specifies how names are resolved.
146. Edit the host.conf file (vi /etc/host.conf) and add the following lines:
147. # Lookup names via DNS first then fall back to /etc/hosts.
148. order bind,hosts
149. # We have machines with multiple IP addresses.
150. multi on
151. # Check for IP address spoofing.
152. nospoof on
154. The first option is to resolve the host name through DNS first and then hosts file.The multi option determines whether a host in the "/etc/hosts" file can have multiple IP addresses (multiple interface ethN).
155. The nospoof option indicates to take care of not permitting spoofing on this machine.
157. Immunize the "/etc/services" file
158. You must immunize the "/etc/services" file to prevent unauthorized deletion  or addition of services.
159.            *  To immunize the "/etc/services" file, use the command:
160.              [root@kapil /]# chattr +i /etc/services
162. Disallow root login from different consoles
163. The "/etc/securetty" file allows you to specify which TTY devices the "root" user is allowed to login . Edit the "/etc/securetty" file to disable any tty that you do not need by commenting them out (# at the beginning of the line).
164.   
165. Blocking anyone to su to root
166. The su (Substitute User) command allows you to become other existing users on the system.  If  you don't want anyone to su to root or restrict "su" command to certain users then add the following two lines to the top of your "su" configuration file in the "/etc/pam.d/" directory.
167. Step 1
168. Edit the su file (vi /etc/pam.d/su) and add the following two lines to the top of the file:
169. auth sufficient /lib/security/pam_rootok.so debug
170. auth required /lib/security/Pam_wheel.so group=wheel
172. Which means only members of the "wheel" group can su to root; it also includes  logging. You can add the users to the group wheel so that only those users will be allowed to su as root.
173.   
175. Shell logging
176. The bash shell stores up to 500 old commands in the "~/.bash_history" file (where "~/" is your home directory) to make it easy for you to repeat long commands. Each user that has an account on the system will have this file "Bash_history" in their home directory. The bash shell should store less number of commands and delete it on logout of the user.
177. Step 1
178. The HISTFILESIZE and HISTSIZE lines in the "/etc/profile" file determine the size of old commands the "Bash_history" file for all users on your system can hold.  I would  highly recommend setting the HISTFILESIZE and HISTSIZE in "/etc/profile" file to a low value such as 30.
179. Edit the profile file (vi /etc/profile) and change the lines to:
180. HISTFILESIZE=30
181. HISTSIZE=30
182. Which mean, the "Bash_history" file in each users home directory can store 20 old commands
183. and no more.
184. Step 2
185. The administrator should also add into the "/etc/skel/Bash_logout" file the
186. "rm -f  $HOME/Bash_history" line, so that each time a user logs out, its "Bash_history" file will be deleted.
187. Edit the Bash_logout file (vi /etc/skel/Bash_logout) and add the following line:
188. rm -f $HOME/Bash_history
190. Disable the Control-Alt-Delete keyboard shutdown command
191. To do this comment out the line (with a "#") listed below in your "/etc/inittab" file .
192. To do this, edit the inittab file (vi /etc/inittab) and change the line:
193. ca::ctrlaltdel:/sbin/shutdown -t3 -r now
194. To read:
195. #ca::ctrlaltdel:/sbin/shutdown -t3 -r now
196. Now, for the change to take effect type in the following at a prompt:
197. [root@kapil /]# /sbin/init q
199. Fix the permissions under "/etc/rc.d/init.d" directory for script files
200. Fix the permissions of the script files that are responsible for starting and stopping all your normal  processes that need to run at boot time.  To do this:
201. [root@kapil/]# chmod -R 700 /etc/rc.d/init.d/*
202. Which means only root is allowed to Read, Write, and Execute scripts files on this directory.
204. Hide your system information
205. By default, when you login to a Linux box, it tells you the Linux distribution name, version, kernel  version, and the name of the server. This is sufficient information for a crackers to get information about your server. You should just prompt users with a "Login:" prompt.
206. Step 1
207. To do this, Edit the "/etc/rc.d/rc.local" file and Place "#" in front of the following lines as shown:
209. # This will overwrite /etc/issue at every boot.  So, make any changes you
210. # want to make to /etc/issue here or you will lose them when you reboot.
211. #echo "" >; /etc/issue
212. #echo "$R" >;>; /etc/issue
213. #echo "Kernel $(uname -r) on $a $(uname -m)" >;>; /etc/issue
214. #
215. #cp -f /etc/issue /etc/issue.net
216. #echo >;>; /etc/issue
218. Step 2
219. Then, remove the following files: "issue.net" and "issue" under "/etc" directory:
220. [root@kapil /]# rm -f /etc/issue
221. [root@kapil /]# rm -f /etc/issue.net
223. Disable unused SUID/SGID programs
224. A regular user will be able to run a program as root if it is set to SUID root. A system administrator should minimize the use of these SUID/GUID programs and disable the programs which are not needed.
225. Step 1
226. *  To find all files with the `s' bits from root-owned programs, use the command:
227.           [root@kapil]# find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls &lg {} \;
229.      *  To disable the suid bits on selected programs above, type the following commands:
230.           [root@kapil /]# chmod a-s [program]
231.   
233. After following the above security guidelines, a system administrator can maintain a basic level of system security. Some of the above tasks are a continuous process. The system administrator has to continuously follow the above guidelines to keep system secure.
236. Written by: Kapil Sharma
237. Email: kapil@linux4biz.net
238. Website: http://www.linux4biz.net
239. [Kapil Sharma is a Linux and Internet security consultant. He has been working on various Linux/Unix systems and Internet Security for more than 2 years. He is maintaing a web site http://www.linux4biz.net for providing free as well as commercial support for web, Linux and Unix solutions.]

复制代码

from: http://www.linuxgazette.com/issue58/sharma.html

Answer 1

弱智用的什么LINUX

Answer 2

嗬嗬，你好，我用的是Redhat 7.3

Answer 3

老大，你又谦虚了不是？

这篇文章是回答坛子里的一个朋友的问题google到的，
不错的说，虽然有些我们都已经知道了，但是多看看没错的。

翻译？嗬，有时间就翻把。

Answer 4

好！我顶。很全面的，我看教材要看好几章才知道这些东西。

Answer 5

采纳好好先生的意见，翻了一下，真够呛，弟兄们多包涵啊。
===========================================

                           Linux 安全技巧

在这篇文章，我要解释怎样用基本的安全措施保护你的linux机器。这将能够让任何人都可以加强一台redhat linux机器的安全。

BIOS安全
更换bios设置，始终都在bios设置一个口令，不允许从软盘引导；这将阻止不受欢迎的人用特别的引导盘试图引导linux系统，并且保护你阻止那些试图更改bios选项的人或者没有口令提示引导服务器的人。

LILO安全
在"/etc/lilo.conf"文件里面加入三个参数，也就是，time-out，restricted 和 password。如果引导时的选项（比如"linux single"）被提供给引导载入工具时，这些选项将要求提供口令。
第1步
编辑lilo.conf 文件 (vi /etc/lilo.conf) 加入或者更换三个选项：
boot=/dev/hda
map=/boot/map
install=/boot/boot.b
time-out=00   #更换此处为00
prompt
Default=linux
restricted   #加入这一行
password=<password>;   #加入此行，写上你的密码
image=/boot/vmlinuz-2.2.14-12
label=linux
initrd=/boot/initrd-2.2.14-12.img
root=/dev/hda6
read-only

第2步
"/etc/lilo.conf"文件必须只对root可读，因为它包含有未被加密的口令。
[root@kapil /]# chmod 600 /etc/lilo.conf （world将不再可读）

第3步
更新你的配置文件"/etc/lilo.conf", 让更改生效。
[Root@kapil /]# /sbin/lilo -v （更新lilo.conf文件）

第4步
用chattr命令设置"/etc/lilo.conf"文件为不可更改，这是你可以做的更多的安全措施。
  * 简单的设置文件不可更改，用命令：
           [root@kapil /]# chattr +i /etc/lilo.conf
这将防止对"lilo.conf"文件的任何更改（意外的更改或者其他更改）。

有关于更多lilo安全的信息，看我LILO的文章。

取消所有特殊账户
你必须删除所有那些不能在你系统上使用的默认用户和组账户，就像lp，sync，shutdown，halt, news, uucp, operator, games, gopher 等等。
删除一个用户帐户：
[root@kapil /]# userdel LP

删除一个组：
[root@kapil /]# groupdel LP

选择一个合适的口令
在选择合适的口令之前，你必须按照如下指导。

口令长度：你安装的linux系统默认的最小可接受的口令长度是5，这不够，必须是8。要这样修改你必须编辑 login.defs 文件 （vi /etc/login.defs）读入并且更换这行：

　PASS_MIN_LEN    5
　读入：
　PASS_MIN_LEN    8
　"login.defs"是登录程序的配置文件。

启用阴影口令支持
你必须启用阴影口令选项。你能够用你系统里的"/usr/sbin/authconfig"程序来启用。如果你要把你系统里已经存在的口令和组转换成阴影口令和组，可以分别使用命令 pwconv，grpconv。

root账户
在一个Unix系统里，"root"账户是最有特权的账户。当管理员在离开系统前忘记从系统根提示符下注销，系统必须自动从shell注销。要那样做，你必须设置Linux变量叫做"TMOUT"为秒计的时间。
编辑你的配置文件"vi /etc/profile",在某个地方加入如下行，
"HISTFILESIZE="
TMOUT=3600
我们为变量"TMOUT="输入的这个值使用秒表示的、代表一个小时（60*60=3600秒）。如果你将此行加入你的 "/etc/profile" 文件，那么在一小时的非活动状态之后将要系统里的所有用户自动注销。你可以在用户私人的".bashrc"文件里面
设置这个变量，可以在一个确定的时间以后自动注销他们。
在这些参数已经被设置到你的系统以后，你必须注销，然后再登录（用root），已使更改生效。

禁止所有常规用户的 控制台-等价 访问
在你的服务器上必须为常规用户禁止所有控制台-等价的访问程序。
就像shutdown，reboot, 和halt。
要这样做，运行如下命令：
[root@kapil /]# rm -f /etc/security/console.apps/<servicename>;
<servicename>;是你希望禁止的控制台-等价程序的名字。

禁止并且卸载所有没有用的服务
你必须禁止别切卸载所有你不用的的服务，那样的话，你就能少担心一些。看看你的"/etc/inetd.conf"文件, 用注释的方法禁用（在一行的开始加个#），然后给inetd进程发送一个SIGHUP命令去更新到当前的"inetd.conf"文件。这样做：
第一步
把"/etc/inetd.conf"更改许可权限成600，那样的话，就只有root可以读和写。
[Root@kapil /]# chmod 600 /etc/inetd.conf

第二步
确保"/etc/inetd.conf"的所有者是root。

第三步
编辑inetd.conf文件（vi /etc/inetd.conf），并且禁止一些服务，就像：
ftp, telnet, shell, login, exec, talk, ntalk, imap, pop-2, pop-3, finger, auth等等，除非你打算用它。关闭这些服务就降低一些风险。

第四步
给你的inetd进程发送一个HUP信号
[root@kapil /]# killall -HUP inetd

第五步
设置"/etc/inetd.conf"文件为不可更改，使用 chattr 命令，这样的话，没人能修改那个文件。
    *简单的设置文件为不可更改，执行如下命令：
[root@kapil /]# chattr +i /etc/inetd.conf
这将防止对"inetd.conf"文件的任何更改（意外的更改或者其他更改）。只有超级用户root能设置或者清除这个文件属性。修改inetd.conf
    *简单的取消不可更改的设置，执行如下命令：
[root@kapil /]# chattr -i /etc/inetd.conf

TCP_WRAPPERS
依靠使用TCP_WRAPPERS，你能保护服务器防止外部入侵。最佳策略是拒绝所有主机，用"/etc/hosts.deny"文件里的"ALL: ALL@ALL, PARANOID"，然后明确列出"/etc/hosts.allow"文件里获准访问你机器的受信主机。TCP_WRAPPERS被两个文件控制，在第一个匹配的地方搜寻结束。
/etc/hosts.allow
/etc/hosts.deny

第1步
编辑 hosts.deny文件（vi /etc/hosts.deny），加入如下行：
# Deny access to everyone.
ALL: ALL@ALL, PARANOID
这意味着所有的服务、所有位置被阻塞，除非他们在allow文件里的引项被获准访问。

第2步
编辑hosts.allow文件（vi /etc/hosts.allow），加入比如下面的行：作为一个例子：
ftp: 202.54.15.99 foo.com
在你的客户机：202.54.15.99 是IP地址，foo.com是你的客户机上允许访问的ftp
主机名。

第3步
tcpdchk程序是 tcpd wrapper 配置检查器，他检查你的tcp wrapper配置，而且报告所有它能发现的潜在、实在的问题。

* 在你的配置做好以后，运行tcpdchk程序。
[Root@kapil /]# tcpdchk

不要让系统发布文件被显示
当有人远程登录，你不要显示系统的发布文件，这样做，你能在"/etc/inetd.conf"文件更改telnet选项。在"/etc/inetd.conf"作如下更改：
telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
看上去就像：
telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd -h
在最后加"-h"标志将导致精灵不显示任何系统信息，只给用户一个登录提示。我推荐你用sshd代替telnet。

更换"/etc/host.conf"文件
"/etc/host.conf"文件标示名字怎样被解析。
编辑 host.conf文件（vi /etc/hst.conf），并且加入如下行：
# 先通过DNS查找，然后后退到 /etc/hosts
order bind,hosts
#我们有多个IP地址的机器。
multi on
#检查IP地址欺骗。
nospoof on

第一个选项就是，首先用DNS解析主机名，然后用hosts文件解析。多选项决定无论一个主机在 "/etc/hosts"文件里能有多IP地址（多个接口ethN）。
nospoof选项在这台机器上标明照顾无许可的欺骗。

免疫"/etc/services"文件
你必须免疫 "/etc/services" 文件，防止未经授权的删除、增加服务。
    * 免疫 "/etc/services" 文件，使用命令：
    [root@kapil /]# chattr +i /etc/services

不允许root从不同的控制台登录
"/etc/securetty"文件允许你标示哪个TTY设备是"root"用户被允许登录的。注释掉他们以编辑"/etc/securetty"文件，禁止你不需要的tty。（在行的开头加#）

组织任何人su成root
su命令（Substitute User,替换用户）允许你变成系统里存在的其他用户。如果你不要任何人su到root或者限制"su"命令给某些用户，可以在你的"su"配置文件目录 "/etc/pam.d"的开头加入如下两行
第一步
编辑 su 文件 （vi /etc/pam.d/su），加入如下两行到文件的头部：
auth sufficient /lib/security/pam_rootok.so debug
auth required /lib/security/Pam_wheel.so group=wheel

这意味着只有 "wheel"组的成员才能 su 到 root；也包括登录。你可以加入用户到组wheel，那样的话，那些用户才能被允许su 到 root。

Shell登录
bash shell 在"~/.bash_history"文件里面存储500个旧的命令（"~/"是你的home目录）,用以简单的重复使用命令。每个在系统里有个账户的用户都有这个文件"Bash_history"在他们的home目录。bash shell存储小部分命令，并且在用户注销时删除它。
第1步
你系统的、在 "/etc/profile" 文件的、HISTFILESIZE和HISTSIZE行检查在"Bash_history"文件里面的所有用户旧命令的大小。我极度推荐设置"/etc/profile"文件里的HISTFILESIZE 和 HISTSIZE 为小一些的值，比如30。
编辑配置文件 （vi /etc/profile），更换如下的行：
HISTFILESIZE=30
HISTSIZE=30
这意味着，在每个用户的home目录里的"Bash_history"文件能存储20条旧的命令，不再多了。
第2步
管理员也必须把 "rm -f  $HOME/Bash_history" 加入 "/etc/skel/Bash_logout"  文件,那样的话，每当一个用户注销，他的"Bash_history"文件将被删除。
编辑Bash_logout文件（vi /etc/skel/Bash/logout），加入如下行：
rm -f $HOME/Bash_history

禁止Control-Alt-Deletc键盘关机命令
在你的"/etc/inittab"文件里面注释掉如下的行（用一个"#"）。
这样做，编辑inittab文件（vi /etc/inittab），更换：
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
读入：
#ca::ctrlaltdel:/sbin/shutdown -t3 -r now
现在，按照如下提示输入，让更改生效：
[root@kapil /]# /sbin/init q

为脚本文件整理"/etc/rc.d/init.d"下的权限
整理脚本文件的许可权限，可靠的开始和结束所有你需要在引导时运行的常态进程，这样做：
[root@kapil/]# chmod -R 700 /etc/rc.d/init.d/*
这意味着只有root可以被允许读，写，和执行目录里面的脚本文件。

隐藏你的系统信息
默认状态下，当你登录到linux机器时，他告诉你Linux分布商的名字，版本，核心版本和服务器名字。这对一个骇客来说从你的服务器得到这些信息足够了。以必须立刻用一个"Login:"提示符提示用户。
第一步
这样做，编辑"/etc/rc.d/rc.local"文件，放置"#"在如下行的前面。
# This will overwrite /etc/issue at every boot.  So, make any changes you
# want to make to /etc/issue here or you will lose them when you reboot.
#echo "" >; /etc/issue
#echo "$R" >;>; /etc/issue
#echo "Kernel $(uname -r) on $a $(uname -m)" >;>; /etc/issue
#
#cp -f /etc/issue /etc/issue.net
#echo >;>; /etc/issue

第二步
然后，删除如下文件：在"/etc/"目录下的"issue.net" 和 "issue"：
[root@kapil /]# rm -f /etc/issue
[root@kapil /]# rm -f /etc/issue.net

禁止未用的 SUID/SGID 程序
一个常规用户如果设置为SUID root，将能够作为root运行程序。一个系统管理员必须最小化使用这些 SUID/GUID程序, 而且禁止那些不需要的程序。
第1步
* 从root拥有的程序里发现所有有`s' 位的程序，用此命令：
[root@kapil]# find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \;

* 在被选中的程序上禁止suid 位，键入如下命令：
[root@kapil /]# chmod a-s [program]

跟着上面的安全指导之后，一个系统管理员能够维护一个基本的系统安全层次。有些上面的任务是一个连续的过程，系统管理员不得不持续的按照上面的指导方针保持系统的安全。

作者：Kapil Sharma
电子邮件: kapil@linux4biz.net
网址： http://www.linux4biz.net
[Kapil Sharma是一位Linux和因特网安全顾问。他在不同的Linux/Unix系统和因特网安全方面工作了两年多。他正在维护一个网站http://www.linux4biz.net,就像为网站作商业支持那样提供免费支持，Linux和Unix 解决方案。]

翻译：弱智
电子邮件：purge#ah163.com
这是匆忙翻译的，错误很多，自己都不忍再看。各位将就着看吧。谢谢。
loveunix.net
chinaunix.net/forum
20040308

Answer 6

泡普，pop~~

Answer 7

好呀，DING