windows加固脚本_Linux主机自动加固脚本

对于 Windows 主机加固，可以使用以下脚本：

# 关闭不必要的服务
sc stop wuauserv
sc config wuauserv start=disabled
sc stop RemoteRegistry
sc config RemoteRegistry start=disabled
sc stop SSDPSRV
sc config SSDPSRV start=disabled

# 禁用不必要的端口
netsh advfirewall firewall add rule name="Block Port 135" dir=in action=block protocol=TCP localport=135
netsh advfirewall firewall add rule name="Block Port 137" dir=in action=block protocol=UDP localport=137
netsh advfirewall firewall add rule name="Block Port 138" dir=in action=block protocol=UDP localport=138
netsh advfirewall firewall add rule name="Block Port 139" dir=in action=block protocol=TCP localport=139
netsh advfirewall firewall add rule name="Block Port 445" dir=in action=block protocol=TCP localport=445

# 修改本地策略
secedit /export /cfg C:\secpol.cfg
(Get-Content C:\secpol.cfg).replace("PasswordComplexity = 1", "PasswordComplexity = 0") | Set-Content C:\secpol.cfg
secedit /configure /db %windir%\security\local.sdb /cfg C:\secpol.cfg /areas SECURITYPOLICY

# 禁止自动运行
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAutoplayfornonVolume" /t REG_DWORD /d "1" /f

# 禁用 SMBv1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" SMB1 -Type DWORD -Value 0 -Force

对于 Linux 主机加固，可以使用以下脚本：

# 更新系统
yum update -y

# 禁用不必要的服务
systemctl stop xinetd
systemctl disable xinetd
systemctl stop avahi-daemon.socket avahi-daemon.service
systemctl disable avahi-daemon.socket avahi-daemon.service
systemctl stop cups.socket cups.service
systemctl disable cups.socket cups.service

# 设置防火墙
firewall-cmd --zone=public --add-port=22/tcp --permanent
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload

# 修改SSH设置，禁用root登录
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
systemctl restart sshd

# 安装 SELinux
yum install selinux-policy selinux-policy-targeted -y

以上脚本仅供参考，具体根据实际情况进行修改和调整。