#!

/bin/sh

echo " "

echo " "
echo "Aseguramiento"
echo " "
echo "Servidores Linux"
echo " "

#Cambiar permisos de archivos “.profile”

chmod 444 /etc/profile

chmod 444 /etc/csh.login
chmod 444 /etc/bashrc
chmod 444 /etc/csh.cshrc

#Mascara de creación de archivos

echo "umask 027" >> /etc/profile

sed -i 's/022/027/g' /etc/csh.cshrc
sed -i 's/022/027/g' /etc/csh.login
sed -i 's/022/027/g' /etc/bashrc

#TIMEOUT de sesión

echo "TMOUT=300" >> /etc/profile

echo "TMOUT=300" >> /etc/bashrc
echo "set autologout=5" >> /etc/csh.login
echo "set autologout=5" >> /etc/csh.cshrc

#Traps

echo "trap 1 2 3" >> /etc/profile

#Acceso usuario root

sed -i 's/# PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
/etc/init.d/sshd stop
/etc/init.d/sshd start

#Adición de files de logging

touch /var/log/faillog
chown root:root /var/log/faillog
chmod 600 /var/log/faillog

touch /var/log/btmp
chown root:root /var/log/btmp
chmod 600 /var/log/btmp

#Bloqueo de intentos de usuario

sed -i "7a auth required /lib/security/pam_tally.so onerr=fail

no_magic_root" /etc/pam.d/system-auth
sed -i "12a account required /lib/security/pam_tally.so deny=5
no_magic_root reset peruser" /etc/pam.d/system-auth

#Registro del uso del su en el sistema

echo "SULOG_FILE /var/log/sulog" >> /etc/login.defs
echo "SYSLOG_SG_ENAB yes" >> /etc/login.defs
echo "SYSLOG_SU_ENAB yes" >> /etc/login.defs
echo "auth.info /var/log/sulog" >>
/etc/syslog.conf
echo "user.notice
/var/adm/syslog/Audit.log" >> /etc/syslog.conf
/etc/init.d/syslog stop
/etc/init.d/syslog start

#Usuarios permitidos bajo crontab

touch /etc/cron.allow
touch /etc/at.allow

chown root:root /etc/crontab

chmod 400 /etc/crontab
chown -R root:root /var/spool/cron
chmod -R go-rwx /var/spool/cron
chown root:root cron*

#Permisos en archivos de log

chmod 600 /var/log/*

#Archivos críticos del sistema

chmod 444 /etc/services
chmod 444 /etc/issue
chmod 444 /etc/passwd
chmod 444 /etc/hosts.allow
chmod 444 /etc/hosts.deny
chmod 444 /etc/cron.allow
chmod 444 /etc/at.allow

chmod 400 .profile*

chmod 400 .cshrc*
chmod 400 .tcshrc*
chmod 400 .login*
chmod 400 .bash*

#Registro histórico de logines fallidos en el sistema

sed -i 's/rotate 4/rotate 12/g' /etc/logrotate.conf

#NFS

chkconfig --level 0123456 nfs off

chkconfig --level 0123456 nfslock off
chkconfig --level 0123456 autofs off

#Comandos Remotos

find / -name .rhosts –o –name .shosts –exec rm -i {} \;

rm /etc/hosts.equiv
#Deshabilitar NIS

rpm -e ypbind yp-tools

chkconfig --level 2345 ypbind off

chkconfig --level 2345 ypserv off
chkconfig --level 23453 yppasswdd off

#Deshabilitar sendmail

/etc/init.d/sendmail stop
chkconfig --list sendmail
chkconfig --level 0123456 sendmail off

#FTP

awk -F”:” '{ print $1 }' /etc/passwd >/etc/vsftpd.ftpusers

awk -F”:” '{ print $1 }' /etc/passwd >/etc/vsftpd.users_list
chmod 444

#Profile
echo "#" >> /etc/profile
echo "#" >> /etc/profile
echo "if echo $SHELL | grep -q ksh;then" >> /etc/profile
echo "HISTFILE=$HOME/.sh_history" >> /etc/profile
echo "HISTSIZE=1000" >> /etc/profile
echo "TTY=`who am i -R`" >> /etc/profile
echo "export HISTFILE HISTSIZE TTY" >> /etc/profile
echo "function dlog" >> /etc/profile
echo "{" >> /etc/profile
echo " typeset -i stat=$?" >> /etc/profile
echo " typeset x" >> /etc/profile
echo " x=$(fc -ln -0)" >> /etc/profile
echo " logger -p user.notice -t "ksh $LOGNAME $$" $TTY Status $stat PWD
$PWD \'${x# }\'" >> /etc/profile
echo "}" >> /etc/profile
echo "trap dlog DEBUG" >> /etc/profile
echo "fi" >> /etc/profile

#Archivos con Sticky bit

echo " "
echo "Archivos con sticky bit"
echo " "
find / -perm -4000 -type f -exec ls -l {} \;
echo " "
echo "Grupos con sticky bit"
echo " "
find / -perm -2000 -type f -exec ls -l {} \;
echo " "