1. monitoring 만들기

더보기
#!/bin/bash

uname_all=$(uname --all)
cpu_pro=$(grep "physical id" /proc/cpuinfo | uniq | wc -l)
vcpu_pro=$(grep "^processor" /proc/cpuinfo | wc -l)
memory_use=$(free --mega | grep Mem | awk '{printf("%i/%iMB (%.2f%%)\n", $3, $2, $3/$2*100)}')
disk_usd=$(df --total --human-readable | grep "total" | awk '{printf("%s/%s (%s)\n", $3, $4, $5)}')
cpu_load=$(top -bn1 | grep "%Cpu" | awk '{printf("%.1f%%\n", (100.0-$8)%100)}')
last_boot=$(who --boot | awk '{printf("%s %s", $3, $4)}')
lvm_use=$(if [ $(lsblk | grep "lvm" | wc -l) -eq 0 ]; then echo "no"; else echo "yes"; fi)
tcp_con=$(ss -s | grep "TCP:" | tr ',' ' ' | awk '{printf("%s ESTABLISHED\n", $4)}')
user_log=$(who --count | grep "users" | tr '=' ' ' | awk '{print $3}')
ip=$(hostname -I)
mac_ip=$(ip a | grep $ip -B 3 | awk '$1 == "link/ether" {print $2}' | head -n 1)
sudo_work=$(sudo find /var/log/sudo/*/*/* -type d | wc -l)
#sudo_work=$(journalctl _COMM=sudo | grep COMMAND | wc -l)

wall "	#Architecure: $uname_all
	#CPU physical : $cpu_pro
	#vCPU : $vcpu_pro
	#Memory Usage: $memory_use
	#Disk Usage: $disk_usd
	#CPU load: $cpu_load
	#Last boot: $last_boot
	#LVM use: $lvm_use
	#Connection TCP : $tcp_con
	#User log: $user_log
	#Network: IP $ip($mac_ip)
	#Sudo : $sudo_work cmd"

 2. 자동 출력 

 - crontab -e 

 - 추가

 -- */10 * * * * /bin/monitoring.sh

끝!

 

블로그 이미지

Or71nH

,

 

 

1. 보안 설치하기 libpam-pwquailty 

 - $ apt-get install libpam-pwquality 

 - 수정하기

 -- $ vi /etc/login.defs

 -- PASS_MAX_DAYS  30

 -- PASS_MIN_DAYS  2

 -- PASS_WARN_AGE  7

 - 현재 패스워드 정책 수정 

 -- $ chage -M 30 -m 2 -W 7 kyoulee

 -- $ chage -M 30 -m 2 -W 7 root

 - 패스워드 설정

 -- $ vi /etc/security/pwquallty.conf

 -- 수정

더보기
# Configuration for systemwide password quality limits
# Defaults:
#
# Number of characters in the new password that must not be present in the
# old password.
difok = 7
#
# Minimum acceptable size for the new password (plus one if
# credits are not disabled which is the default). (See pam_cracklib manual.)
# Cannot be set to lower value than 6.
minlen = 10
#
# The maximum credit for having digits in the new password. If less than 0
# it is the minimum number of digits in the new password.
dcredit = -1
#
# The maximum credit for having uppercase characters in the new password.
# If less than 0 it is the minimum number of uppercase characters in the new
# password.
ucredit = -1
#
# The maximum credit for having lowercase characters in the new password.
# If less than 0 it is the minimum number of lowercase characters in the new
# password.
# lcredit = 0
#
# The maximum credit for having other characters in the new password.
# If less than 0 it is the minimum number of other characters in the new
# password.
# ocredit = 0
#
# The minimum number of required classes of characters for the new
# password (digits, uppercase, lowercase, others).
# minclass = 0
#
# The maximum number of allowed consecutive same characters in the new password.
# The check is disabled if the value is 0.
maxrepeat = 3
#
# The maximum number of allowed consecutive characters of the same class in the
# new password.
# The check is disabled if the value is 0.
# maxclassrepeat = 0
#
# Whether to check for the words from the passwd entry GECOS string of the user.
# The check is enabled if the value is not 0.
gecoscheck = 1
#
# Whether to check for the words from the cracklib dictionary.
# The check is enabled if the value is not 0.
# dictcheck = 1
#
# Whether to check if it contains the user name in some form.
# The check is enabled if the value is not 0.
usercheck = 1
#
# Length of substrings from the username to check for in the password
# The check is enabled if the value is greater than 0 and usercheck is enabled.
# usersubstr = 0
#
# Whether the check is enforced by the PAM module and possibly other
# applications.
# The new password is rejected if it fails the check and the value is not 0.
# enforcing = 1
#
# Path to the cracklib dictionaries. Default is to use the cracklib default.
# dictpath =
#
# Prompt user at most N times before returning with error. The default is 1.
# retry = 3
#
# Enforces pwquality checks on the root user password.
# Enabled if the option is present.
enforce_for_root
#
# Skip testing the password quality for users that are not present in the
# /etc/passwd file.
# Enabled if the option is present.
# local_users_only

 - 패스워드 바꾸기

  -- $passwd kyoulee

  -- 비번~

 

- 수도 옵션주기 

 -- apt-get install sudo

 - sudo adduser kyoulee sudo

 - sudo groupadd user42

- sudo adduser kyoulee sudo

블로그 이미지

Or71nH

,

 

1. 앱 아머 만들기

 - 설치

 - $ apt install apparmor apparmor-profiles apparmor-utils

 - 확인

 - $ aa-status

2. ssh 확인

 - ssh 확인

 - $ systemctl status ssh.service

 - 설치 필요하면 (거의 안해도될꺼임)

 -- $ apt-get install openssh-server

 -- $ systemctl start sshd.service

 - 포트 수정

 - $ vi /etc/ssh/sshd_config 

 -- 수정

 -- port 4242

 -- PermitRootLogin no  

 -- systemctl restart sshd

3. 포트 열어주기

 - apt install ufw

- ufw enable

- ufw default deny incoming

- ufw default allow outgoing

- ufw status verbose (확인)

- ufw allow ssh

- ufw allow 4242

- ufw status

- ufw delete (22port 지우기)

 - 아이피 확인

 - $ hostname -I

 - virtualbox 끄기

 - 이젠 동영상 따라해라

 - 포트 설정해주고 연결해주고 만들고 등등...

4. terminar 로 접속

 - 새 터미널

 - $ ssh kyoulee@192.168.56.1 -p 4242

 - 안될때 !! knowhost 삭제해주기  ~/.ssh/ 안에 어딘가 있음 찾다보면 나옴 

5. tty 바꾸는법 

 - mac : fn + command + f1~f6

 

블로그 이미지

Or71nH

,

 

 

말보단 영상이다

일단 준비해야할 것들 부터

 

 

1. virtualbox 설치

 - 맥 검색에 msc 를 친다

 - virtualbox를 설치한다

2. 파티션 만든다

Partition [33079636882]

  - boot 500M [524288000]

     -- boot code size (2048 * 512) [1048576]

  - LVMGroup [32554300416]

     -- System Partition (6142 * 512) [3144704]

     -- root (10G) [10737418240]

     -- swap (2.3G) [2469606195.2]  512 -> 2469606400  2048 -> 2469607424

     -- home (5G) [5368709120]

     -- var (3G) [3221225472] 

     -- srv(3G) [3221225472] 

     -- tmp (3G) [3221225472] 

     -- var-log (4G) [4294967296] 

     -- crypt size (2048 * 512 * 16) [16777216]

딱 맞아 떨어질것이다~swap은 해결 방법을 아직 모르겟음

정말 파티션에 대하여 알고싶다하는분은 [https://m.blog.naver.com/ginger2009/221986902590] 추천

3. Debian

 - virtualbox 실행할 Debian을 다운한다 (https://www.debian.org/download)

 - 그걸로 실행해준다

블로그 이미지

Or71nH

,

1. bool  flag 옵션

always_query_group_plugin  
always_set_home  
authenticate  
closeform_override  
compress_io  
exec_background  
env_editor  
env_reset  
fast_glob  
fqdn  
ignore_audit_errors  
ignore_dot  
ignore_iolog_errors  
ignore_local_sudoers  
ignore_unknown_defaults  
insults  
log_host  
log_input  
log_output  
log_year  
long_otp_prompt  
mail_all_cmnds  
mail_always  
mail_badpass  
mail_no_host  
mail_no_perms  
mail_no_user  
match_group_by_gid  
netgroup_tuple  
noexec  
pam_session  
pam_setcred  
passprompt_override  
path_info  
preserve_groups  
pwfeedback  
requiretty  
root_sudo  
rootpw  
runaspw  
set_home  
set_logname  
set_utmp  
setenv  
shell_noargs  
stay_setuid  
sudoedit_checkdir  
sudoedit_follow  
targetpw  
tty_tickets  
umask_override  
use_loginclass  
use_netgroups  
use_pty  
user_command_timeouts  
utmp_runas  
visiblepw  

2. intgers 옵션

closefrom  
command_timeout  
maxseq  
passwd_tries  
syslog_maxlen  

3. intgers 또는 boolean context 사용가능한 옵션

loglinelen  
passwd_timeout  
timestamp_timeout  
umask  

4. Strings 문자열 옵션

badpass_message  
editor  
iolog_dir  
iolog_file  
iolog_flush  
iolog_group  
iolog_mode  
iolog_user  
lecture_status_dir  
limitprivs  
mailsub  
noexec_file  
pam_login_service  
pam_service  
passprompt  
privs  
role  
runas_default  
sudoers_locale  
timestrampdir  
timestampowner  
type  

5. string 혹은 boolean context 가되는 옵션

env_file  
exempt_group  
fdexec  
group_plugin  
lecture  
lecture_file  
listpw  
logfile  
mailerflags  
mailerpath  
mailfrom  
mailto  
restricted_env_file  
secure_path  
syslog  
syslog_badpri  
syslog_goodpri  
verifypw  

6.lsts 또는 boolean context 인 옵션

env_check  
env_delete  
env_keep  

 아 언제다 하냐

블로그 이미지

Or71nH

,