[OS취약점] RHEL 8.x / 주요정보통신기반시설

<계정관리>
U-01 root 계정 원격 접속 제한
/etc/ssh/sshd_config
#PermitRootLogin yes -> PermitRootLogin no

U-02 패스워드 복잡성 설정 / U-03 계정 잠금 임계값 설정
/etc/pam.d/system-auth 파일 수정

auth        required                                     pam_env.so
auth        required                                     pam_faillock.so preauth silent audit deny=5 unlock_time=600
auth        required                                     pam_faildelay.so delay=2000000
auth        sufficient                                   pam_fprintd.so
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
... 중략 ...

account     required                                     pam_faillock.so
account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
password    requisite                                    pam_pwquality.so try_first_pass local_users_only
password    requisite                                    pam_cracklib.so try_first_pass retry=3 minlen=9 ucredit=-1 dcredit=-1 ocredit=-1 lcredit=-1
... 중략 ...

U-45 root 계정 su 제한
1. 스위칭(일반) 계정 생성
/usr/sbin/useradd swichuser -G wheel
echo 'Swichuser12#$' | passwd --stdin swichuser
-> 계정 미리 생성 했을 경우 /etc/group 파일 내 wheel 그룹에 계정만 추가

2. /etc/pam.d/su 수정
auth            required        pam_wheel.so    debug use_uid
-> 주석되어 있는 해당 라인 주석 해제
auth            include         system-auth
... 중략
3. /etc/pam.d/system-auth 수정
auth        required      pam_env.so
auth        required                                     pam_faillock.so preauth silent audit deny=5 unlock_time=600
-> pam_env.so 아래 5번째 라인에 위 구문 삽입
auth        sufficient    pam_fprintd.so
... 중략
account     required      pam_faillock.so
-> pam_unix.so 위 라인에 위 구문 삽입
account     required      pam_unix.so

4. /bin/su 바이너리 권한 확인
chown root.wheel /bin/su
chmod 4750 /bin/su

-rwsr-x---. 1 root wheel 34904 2014-10-15 13:51 /bin/su

5. sshd 서비스 재 기동
systemctl restart sshd.service