IT教程FG306-Linux系统安全加固

1. 账户安全加固

账户安全是Linux系统安全的基础，需要对系统账户进行全面检查和加固。更多学习教程www.fgedu.net.cn

# 查看系统所有用户
# cat /etc/passwd | grep -v nologin | grep -v false
root:x:0:0:root:/root:/bin/bash
fengge:x:1000:1000:www.itpux.com:/home/fengge:/bin/bash
oracle:x:54321:54321::/home/oracle:/bin/bash

# 查看空密码账户
# awk -F: ‘($2 == “”) {print $1}’ /etc/shadow

# 锁定空密码账户
# passwd -l username

# 查看UID为0的账户（只有root应该为0）
# awk -F: ‘($3 == 0) {print $1}’ /etc/passwd
root

# 查看sudo权限用户
# cat /etc/sudoers | grep -v “^#” | grep -v “^$”
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL

# 禁用不需要的系统账户
# usermod -L lp
# usermod -L news
# usermod -L uucp
# usermod -L games
# usermod -L ftp

# 查看账户锁定状态
# passwd -S lp
lp LK 2026-01-15 0 99999 7 -1 (Password locked.)

# 删除不需要的账户
# userdel -r games
userdel: games mail spool (/var/spool/mail/games) not found
userdel: games home directory (/usr/games) not found

# 设置账户失效时间
# chage -E 2026-12-31 testuser

# 查看账户过期信息
# chage -l testuser
Last password change : Jan 15, 2026
Password expires : never
Password inactive : never
Account expires : Dec 31, 2026
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

生产环境风哥建议：定期审计系统账户，删除或锁定不需要的账户，确保只有root账户UID为0，为临时账户设置过期时间。

2. 密码策略配置

强密码策略是防止暴力破解的重要手段，需要配置密码复杂度和有效期策略。学习交流加群风哥微信: itpux-com

# 查看当前密码策略
# chage -l root
Last password change : Jan 01, 2026
Password expires : Apr 01, 2026
Password inactive : never
Account expires : never
Minimum number of days between password change : 1
Maximum number of days between password change : 90
Number of days of warning before password expires : 7

# 修改密码有效期策略
# chage -M 90 root
# chage -m 1 root
# chage -W 7 root

# 配置密码复杂度要求
# vi /etc/security/pwquality.conf

# 设置最小密码长度
minlen = 12

# 设置最少数字字符数
dcredit = -1

# 设置最少大写字母数
ucredit = -1

# 设置最少小写字母数
lcredit = -1

# 设置最少特殊字符数
ocredit = -1

# 设置密码历史记录
# vi /etc/pam.d/system-auth
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=12 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5

# 设置登录失败锁定策略
# vi /etc/pam.d/system-auth

# 添加以下内容
auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_faillock.so authfail audit deny=5 unlock_time=900
auth required pam_deny.so

# 查看锁定账户
# faillock –user root
root:
When Type Service Source Valid
2026-04-03 10:15:23 R sshd 192.168.1.100 V
2026-04-03 10:15:25 R sshd 192.168.1.100 V

# 解锁账户
# faillock –user root –reset

风哥风哥提示：密码策略需要在安全性和可用性之间取得平衡，过于严格的策略可能导致用户将密码写在纸上，反而降低安全性。

3. SSH安全配置

SSH是远程管理的主要方式，也是攻击者的主要目标，需要进行严格的安全配置。

# 备份SSH配置文件
# cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# 编辑SSH配置文件
# vi /etc/ssh/sshd_config

# 禁止root直接登录
PermitRootLogin no

# 修改默认端口
Port 2222

# 禁止空密码登录
PermitEmptyPasswords no

# 限制登录尝试次数
MaxAuthTries 3

# 设置登录超时时间
LoginGraceTime 60

# 禁止密码认证，只允许密钥认证（推荐）
PasswordAuthentication no
PubkeyAuthentication yes

# 限制允许登录的用户
AllowUsers fengge oracle@192.168.1.0/24

# 设置空闲超时断开
ClientAliveInterval 300
ClientAliveCountMax 2

# 禁用X11转发
X11Forwarding no

# 禁用端口转发
AllowTcpForwarding no

# 重启SSH服务
# systemctl restart sshd

# 验证SSH配置
# sshd -t

# 查看SSH监听端口
# netstat -tlnp | grep sshd
tcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN 1234/sshd
tcp6 0 0 :::2222 :::* LISTEN 1234/sshd

# 查看SSH登录日志
# tail -20 /var/log/secure
Apr 3 10:20:15 fgedu sshd[12345]: Accepted publickey for fengge from 192.168.1.100 port 52341 ssh2
Apr 3 10:20:15 fgedu sshd[12345]: pam_unix(sshd:session): session opened for user fengge by (uid=0)
Apr 3 10:25:30 fgedu sshd[12350]: Failed password for invalid user admin from 10.0.0.1 port 45123 ssh2
Apr 3 10:25:32 fgedu sshd[12350]: Connection closed by 10.0.0.1 port 45123 [preauth]

# 配置SSH密钥认证
$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/fengge/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/fengge/.ssh/id_rsa.
Your public key has been saved in /home/fengge/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:abc123def456 fengge@fgedu.net.cn
The key’s randomart image is:
+—[RSA 4096]—-+
| .o. |
| … . |
| . . . . |
| . . o |
| S o o |
| . o |
| . |
| |
| |
+—-[SHA256]—–+

# 上传公钥到服务器
$ ssh-copy-id -p 2222 fengge@fgedu.net.cn
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: “/home/fengge/.ssh/id_rsa.pub”
Number of key(s) added: 1

生产环境风哥建议：修改SSH默认端口，禁用root登录，使用密钥认证替代密码认证，限制允许登录的用户和IP地址。

4. 防火墙配置

防火墙是网络安全的第一道防线，需要正确配置规则来保护系统。学习交流加群风哥QQ113257174

# 查看防火墙状态
# systemctl status firewalld
● firewalld.service – firewalld – dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2026-04-03 09:00:00 CST; 2h ago
Main PID: 789 (firewalld)
Tasks: 2
Memory: 28.5M
CGroup: /system.slice/firewalld.service
└─789 /usr/bin/python3 -Es /usr/sbin/firewalld –nofork –nopid

# 查看默认区域
# firewall-cmd –get-default-zone
public

# 查看当前区域规则
# firewall-cmd –list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: ssh dhcpv6-client
ports: 2222/tcp
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

# 开放必要端口
# firewall-cmd –permanent –add-port=2222/tcp
# firewall-cmd –permanent –add-port=80/tcp
# firewall-cmd –permanent –add-port=443/tcp

# 限制特定IP访问
# firewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”192.168.1.0/24″ port protocol=”tcp” port=”22″ accept’

# 禁止特定IP访问
# firewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”10.0.0.100″ reject’

# 开放服务
# firewall-cmd –permanent –add-service=http
# firewall-cmd –permanent –add-service=https

# 重载防火墙配置
# firewall-cmd –reload
success

# 验证配置
# firewall-cmd –list-ports
2222/tcp 80/tcp 443/tcp

# 使用iptables配置（备选方案）
# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp — 0.0.0.0/0 0.0.0.0/0
ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state NEW
ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
REJECT all — 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

# 添加规则
# iptables -A INPUT -p tcp –dport 2222 -j ACCEPT
# iptables -A INPUT -p tcp –dport 80 -j ACCEPT
# iptables -A INPUT -s 192.168.1.0/24 -p tcp –dport 3306 -j ACCEPT

# 保存规则
# iptables-save > /etc/sysconfig/iptables
# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

5. 服务安全加固

关闭不必要的服务可以减少攻击面，提高系统安全性。更多学习教程公众号风哥教程itpux_com

# 查看所有运行的服务
# systemctl list-units –type=service –state=running
UNIT LOAD ACTIVE SUB DESCRIPTION
auditd.service loaded active running Security Auditing Service
crond.service loaded active running Command Scheduler
dbus.service loaded active running D-Bus System Message Bus
firewalld.service loaded active running firewalld – dynamic firewall daemon
NetworkManager.service loaded active running Network Manager
polkit.service loaded active running Authorization Manager
postfix.service loaded active running Postfix Mail Transport Agent
sshd.service loaded active running OpenSSH server daemon
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running Login Service

# 查看开机自启服务
# systemctl list-unit-files –type=service | grep enabled
auditd.service enabled
autofs.service enabled
crond.service enabled
firewalld.service enabled
httpd.service enabled
NetworkManager.service enabled
postfix.service enabled
sshd.service enabled

# 停止并禁用不需要的服务
# systemctl stop postfix
# systemctl disable postfix
Removed /etc/systemd/system/multi-user.target.wants/postfix.service.

# systemctl stop autofs
# systemctl disable autofs
Removed /etc/systemd/system/multi-user.target.wants/autofs.service.

# 检查服务依赖
# systemctl list-dependencies sshd
sshd.service
● ├─system.slice
● └─basic.target
● ├─microcode.service
● ├─rhel-autorelabel-mark.service
● ├─rhel-autorelabel.service
● ├─rhel-configure.service
● ├─rhel-dmesg.service

# 查看服务状态详情
# systemctl status sshd
● sshd.service – OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2026-04-03 09:00:00 CST; 2h ago
Docs: man:sshd(8)
man:sshd_config(5)
Main PID: 1234 (sshd)
Tasks: 1
Memory: 4.5M
CGroup: /system.slice/sshd.service
└─1234 /usr/sbin/sshd -D

风哥风哥提示：关闭服务前务必确认该服务是否被其他关键服务依赖，建议先停止服务观察一段时间，确认无影响后再禁用开机自启。

6. 文件权限加固

正确的文件权限设置可以防止未授权访问和篡改。

# 查找SUID文件
# find / -perm -4000 -type f 2>/dev/null
/usr/bin/su
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/libexec/openssh/ssh-keysign
/usr/libexec/dbus-1/dbus-daemon-launch-helper

# 查找SGID文件
# find / -perm -2000 -type f 2>/dev/null
/usr/bin/write
/usr/bin/wall
/usr/bin/locate
/usr/libexec/openssh/ssh-keysign

# 查找无主文件
# find / -nouser -o -nogroup 2>/dev/null
/tmp/testfile
/var/tmp/orphan

# 查找可写文件
# find / -perm -0002 -type f 2>/dev/null
/tmp/test.log
/var/tmp/shared

# 设置关键文件权限
# chmod 600 /etc/passwd
# chmod 600 /etc/shadow
# chmod 600 /etc/gshadow
# chmod 644 /etc/group

# 验证权限
# ls -la /etc/passwd /etc/shadow /etc/group /etc/gshadow
-rw-r–r– 1 root root 1234 Apr 3 09:00 /etc/passwd
-rw——- 1 root root 567 Apr 3 09:00 /etc/shadow
-rw-r–r– 1 root root 890 Apr 3 09:00 /etc/group
-rw——- 1 root root 456 Apr 3 09:00 /etc/gshadow

# 设置SSH目录权限
# chmod 700 /root/.ssh
# chmod 600 /root/.ssh/authorized_keys
# chmod 600 /root/.ssh/id_rsa
# chmod 644 /root/.ssh/id_rsa.pub

# 设置日志文件权限
# chmod 640 /var/log/secure
# chmod 640 /var/log/messages

# 查找并修复全局可写目录
# find / -type d -perm -0002 2>/dev/null | head -10
/tmp
/var/tmp
/dev/shm
/dev/mqueue
/run/lock

# 设置粘滞位
# chmod +t /tmp
# chmod +t /var/tmp

# 验证粘滞位
# ls -ld /tmp /var/tmp
drwxrwxrwt. 8 root root 4096 Apr 3 10:00 /tmp
drwxrwxrwt. 2 root root 4096 Apr 3 09:00 /var/tmp

# 设置关键目录权限
# chmod 755 /root
# chmod 755 /home
# chmod 750 /home/fengge

# 查看目录权限
# ls -ld /root /home /home/fengge
drwxr-xr-x. 10 root root 4096 Apr 3 09:00 /root
drwxr-xr-x. 3 root root 4096 Jan 15 10:00 /home
drwxr-x—. 15 fengge fengge 4096 Apr 3 10:00 /home/fengge

生产环境风哥建议：定期扫描SUID/SGID文件，移除不必要的特殊权限，确保关键配置文件权限正确，设置粘滞位防止临时目录文件被删除。

7. 内核安全参数

内核参数对网络安全有重要影响，需要根据安全要求进行配置。

# 查看当前内核安全参数
# sysctl -a | grep net.ipv4
net.ipv4.ip_forward = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 编辑内核安全参数
# vi /etc/sysctl.conf

# 添加以下安全参数
# 禁用IP转发
net.ipv4.ip_forward = 0

# 启用反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# 禁用ICMP重定向
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# 禁用源路由
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 启用SYN Cookies防护SYN洪水攻击
net.ipv4.tcp_syncookies = 1

# 忽略ICMP广播请求
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 禁用ICMP重定向发送
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

# 记录欺骗性源地址
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 使配置生效
# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 验证配置
# sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1

# 查看TCP SYN队列
# sysctl net.ipv4.tcp_max_syn_backlog
net.ipv4.tcp_max_syn_backlog = 1024

8. 审计系统配置

审计系统可以记录系统中的重要操作，便于安全事件追踪和分析。

# 安装审计服务
# yum install -y audit
Installed:
audit-3.0-7.el8.x86_64

# 启动审计服务
# systemctl start auditd
# systemctl enable auditd

# 查看审计服务状态
# systemctl status auditd
● auditd.service – Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2026-04-03 09:00:00 CST; 2h ago
Docs: man:auditd(8)
https://github.com/linux-audit/audit-documentation
Process: 789 ExecStartPost=/sbin/augenrules –load (code=exited, status=0/SUCCESS)
Main PID: 788 (auditd)
Tasks: 2
Memory: 3.5M
CGroup: /system.slice/auditd.service
└─788 /sbin/auditd

# 配置审计规则
# vi /etc/audit/rules.d/audit.rules

# 监控用户和组变更
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity

# 监控sudo使用
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers

# 监控登录相关文件
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

# 监控系统时间变更
-w /etc/localtime -p wa -k time-change
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change

# 监控模块加载
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules

# 重载审计规则
# augenrules –load

# 查看审计日志
# ausearch -k identity
—-
time->Thu Apr 3 10:00:00 2026
type=PROCTITLE msg=audit(1749234000.123:456): proctitle=7669002D2F6574632F706173737764
type=PATH msg=audit(1749234000.123:456): item=1 name=”/etc/passwd” inode=12345 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1749234000.123:456): item=0 name=”/etc/” inode=12 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1749234000.123:456): cwd=”/root”
type=SYSCALL msg=audit(1749234000.123:456): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=5643f2b8e0 a2=241 a3=1b6 items=2 ppid=1234 pid=5678 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=”vi” exe=”/usr/bin/vi” key=”identity”

# 生成审计报告
# aureport –summary
Audit Report Summary
=====================
Range of time in logs: 04/01/2026 00:00:00.000 – 04/03/2026 10:00:00.000
Selected time for report: 04/01/2026 00:00:00 – 04/03/2026 10:00:00

Number of changes in configuration: 15
Number of changes to accounts, groups, or roles: 8
Number of logins: 25
Number of failed logins: 3
Number of authentications: 30
Number of failed authentications: 5
Number of users: 5
Number of terminals: 8
Number of host names: 10

生产环境风哥建议：配置审计规则监控关键文件和操作，定期检查审计日志，将审计日志发送到集中日志服务器进行备份分析。

9. 日志安全配置

日志是安全审计的重要依据，需要确保日志的完整性和安全性。

# 查看日志服务状态
# systemctl status rsyslog
● rsyslog.service – System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2026-04-03 09:00:00 CST; 2h ago
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 789 (rsyslogd)
Tasks: 3
Memory: 2.5M
CGroup: /system.slice/rsyslog.service
└─789 /usr/sbin/rsyslogd -n

# 查看日志配置
# cat /etc/rsyslog.conf | grep -v “^#” | grep -v “^$”
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log

# 配置日志轮转
# cat /etc/logrotate.conf | grep -v “^#” | grep -v “^$”
weekly
rotate 4
create
dateext
include /etc/logrotate.d

# 查看secure日志轮转配置
# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
missingok
sharedscripts
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
endscript
}

# 手动轮转日志
# logrotate -f /etc/logrotate.conf

# 配置远程日志服务器
# vi /etc/rsyslog.conf

# 发送日志到远程服务器
*.* @@192.168.1.100:514

# 重启rsyslog服务
# systemctl restart rsyslog

# 验证日志发送
# logger -p local0.info “Test message from fgedu”
# tail -1 /var/log/messages
Apr 3 10:30:00 fgedu root: Test message from fgedu

# 查看关键安全日志
# grep -i “failed\|error\|attack” /var/log/secure | tail -10
Apr 3 10:15:23 fgedu sshd[12345]: Failed password for invalid user admin from 10.0.0.1 port 45123 ssh2
Apr 3 10:20:15 fgedu sshd[12346]: Failed password for root from 10.0.0.2 port 45234 ssh2
Apr 3 10:25:30 fgedu sshd[12347]: error: maximum authentication attempts exceeded for root from 10.0.0.2 port 45234 ssh2

10. 安全扫描与检查

定期进行安全扫描可以发现系统潜在的安全隐患，及时修复漏洞。

# 使用rkhunter检查rootkit
# yum install -y rkhunter
# rkhunter –update
[ Rootkit Hunter version 1.4.6 ]
Checking rkhunter data files…
Checking file mirrors.dat [ Updated ]
Checking file programs_bad.dat [ Updated ]
Checking file backdoorports.dat [ Updated ]
Checking file suspscan.dat [ Updated ]
Checking file i18n/cn [ No update ]
Checking file i18n/en [ No update ]

# 执行系统扫描
# rkhunter –check
[ Rootkit Hunter version 1.4.6 ]
Checking system commands…
Performing ‘strings’ command checks
Checking ‘strings’ command [ OK ]
Performing ‘shared libraries’ checks
Checking for preloading variables [ None found ]
Checking for preloaded libraries [ None found ]
Performing file properties checks
Checking for prerequisites [ OK ]
/usr/bin/awk [ OK ]
/usr/bin/basename [ OK ]
/usr/bin/bash [ OK ]

# 使用Lynis进行安全审计
# yum install -y lynis
# lynis audit system

[ Lynis 3.0.8 ]
================================================================================
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
================================================================================

[+] Initializing program
————————————
– Detecting OS… [ DONE ]
– Checking profiles… [ DONE ]

[+] System tools
————————————
– Scanning available tools…
– Checking system binaries…

[+] Plugins (phase 1)
————————————
– Plugins enabled [ NONE ]

[+] Boot and services
————————————
– Service Manager [ systemd ]
– Checking UEFI boot entries [ NONE ]
– Checking presence GRUB2 [ FOUND ]

# 检查已安装软件的安全更新
# yum check-update –security
Last metadata expiration check: 0:05:23 ago on Thu Apr 3 10:00:00 2026.
Security: kernel-4.18.0-348.el8.x86_64 is an installed security update
Security: kernel-4.18.0-305.el8.x86_64 is the currently running version

生产环境风哥建议：定期执行安全扫描，建立漏洞修复流程，保持系统和软件更新到最新安全版本，配置自动化安全检查任务。

author:www.itpux.com

本文由风哥教程整理发布,仅用于学习测试使用,转载注明出处:http://www.fgedu.net.cn/10327.html