CentOS Linux release 7.6, CentOS Linux release 7.7 기준 초기 세팅
1, 호스트네임 설정 (영구적)
hostnamectl set-hostname dr_ivr1
ex) hostnamectl set-hostname 호스트네임
- centos 7에서는 하기넘땜에 계속 ntp 서버가 안올라옴..
systemctl stop chronyd
systemctl disable chronyd
vi /etc/selinux/config
SELINUX=disabled
3.
ntp
nt
ntp & libedit & ntpdate 설치
yum -y install ntp
peer 설정
vi /etc/ntp.conf
ntp.conf
server time.bora.net
server time.kornet.net
시작프로그램에 등록
systemctl enable ntpd.service
서비스 시작
systemctl restart ntpd.service
확인
ntpq -p
시간이 안맞을때 동기화
timedatectl set-ntp y
4.
systemctl stop firewalld
systemctl disable firewalld
systemctl status firewalld
5.
yum -y install telnet (설치)
systemctl stop rpcbind << 요거 확인 gw#1 에는 stop, disable 시킴 test중
systemctl disable rpcbind
- mysql root 비밀번호 설정
(https://opentutorials.org/module/1701/10229)
systemctl enable mariadb
systemctl restart mariadb
systemctl status mariadb
mysql -u root -p
use mysql
GRANT ALL PRIVILEGES ON . TO ‘root’@’127.0.0.1’ IDENTIFIED by ‘패스워드’;
GRANT ALL PRIVILEGES ON . TO ‘root’@’localhost’ IDENTIFIED by ‘패스워드’;
GRANT ALL PRIVILEGES ON . TO ‘root’@’%’ IDENTIFIED by ‘패스워드’;
FLUSH PRIVILEGES;
CREATE DATABASE 디비 DEFAULT CHARACTER SET UTF8;
CREATE USER ‘유저’@’%’ IDENTIFIED BY ‘패스워드’;
GRANT ALL PRIVILEGES ON 디비.* TO ‘유저’@’%’IDENTIFIED by ‘패스워드’;
GRANT ALL PRIVILEGES ON 디비.* TO ‘유저’@’localhost’ IDENTIFIED by ‘패스워드’;
GRANT ALL PRIVILEGES ON 디비.* TO ‘유저’@’127.0.0.1’IDENTIFIED by ‘패스워드’;
FLUSH PRIVILEGES;
계정생성
create user ‘유저’@localhost identified by ‘패스워드’;
FLUSH PRIVILEGES;
create user ‘유저’@’%’ identified by ‘패스워드’;
FLUSH PRIVILEGES;
특정사용자 db권한 구현
GRANT ALL privileges ON 디비.* TO 유저@locahost IDENTIFIED BY ‘패스워드’;
GRANT ALL privileges ON 디비.* TO 유저@’%’ IDENTIFIED BY ‘패스워드’;
update user set authentication_string=password(‘패스워드’) where user=’유저’;
FLUSH PRIVILEGES;
set password for ‘유저’@’localhost’= password(‘패스워드’);
FLUSH PRIVILEGES;
외부 mysql root접속 가능
GRANT ALL PRIVILEGES ON . TO ‘root’@’%’ IDENTIFIED by ‘패스워드’;
FLUSH PRIVILEGES;
root 외부접속 차단
DELETE FROM mysql.user WHERE Host=’local’ AND User=’유저’;
- 계정관리 > 1.1 root 계정 원격 접속 제한
vi /etc/ssh/sshd_config
PermitRootLogin yes -> PermitRootLogin no 변경
systemctl restart sshd.service
- 콘솔 임계치 설정
vi /etc/pam.d/system-auth (콘솔 ex) 스위치 )
<<<<<< <- 요 부위만 변경 및 추가
%PAM-1.0
This file is auto-generated.
User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
account lock
auth required pam_tally2.so onerr=fail deny=4 unlock_time=1800 <<<<<<
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_unix.so
account lock – no root
account required pam_tally2.so no_magic_root reset <<<<<<
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_cracklib.so restry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 <<<<<<
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
- 암호 사용기간 설정
vi /etc/login.defs
PASS_MAX_DAYS 90 #최대사용기간
PASS_MIN_DAYS 1 #최소 사용기간
PASS_MIN_LEN 10 #최소 길이
PASS_WARN_AGE 7 #만료 몇일전 알림
해당 내용은 새로 생성되는 유저에게 적용된다.
기존 유저는 chage -l username 통해 확인 및 변경 가능함
변경은
최대 사용기간
chage -M
최소 사용기간
chage -m
암호 만료 안내
chage -W
ex) gw#1 서버에는 pcard01, pcard02, service 계정이 있는데
위 설정은 pcard01, pcard02 만 설정 되어 있음
신규 계정을 생성하게되면 위 설정이 먹힘
Session Timeout 설정
/etc/profile
마지막줄에 삽입
export TMOUT=600
그외 따로 사용자계정 설정은
~/.bash_profile 에서 외 설정 가능
경고문구
vi /etc/issue.net
===========================================================================
Welcome
This is a private computer facility.
Access for any reason must be specifically authorized by the manager.
Unless you are so authorized, your continued access and any other use may
expose you criminaland or civil proceedings
삽입..
vi /etc/ssh/sshd_config
Banner /etc/issue.net
문구 추가 및 변경
systemctl restart sshd