This document describes how to configure account and password security policies in TencentOS Server, including su/sudo permission management, password policy configuration, and root remote login restrictions, to improve system security.
Configuring su Commands
In TencentOS Server, correctly configuring su is equally important for improving system security. You can reduce the risk of privilege abuse by limiting the scope of the su command.
Prohibiting Ordinary Users from Directly Using the su Commands
Only users in the wheel group are allowed to switch to the root user. Edit the /etc/pam.d/su file and find the following line:
#auth required pam_wheel.so use_uid
Uncomment the line and save the file:
auth required pam_wheel.so use_uid
Adding a User to the Wheel Group
Add users who need to use the su commands to the wheel group:
sudo usermod -aG wheel <username>
Setting a Mandatory Password Policy
To enhance system security, you can configure a mandatory password policy through PAM (Pluggable Authentication Modules).
Password Complexity
Edit the /etc/pam.d/system-auth file and add or modify the following lines to set the password complexity policy:
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 minlen=8 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
The parameters are described as follows:
|
minlen=8
| The password must contain at least 8 characters. |
dcredit=-1
| Contains at least 1 digit. |
ucredit=-1
| Contains at least 1 uppercase letter. |
lcredit=-1
| Contains at least 1 lowercase letter. |
ocredit=-1
| Contains at least 1 special character. |
retry=3
| Allows up to 3 attempts. |
Password Expiration Policy
Set the password expiration policy by using the chage command or modifying the /etc/login.defs file:
Edit /etc/login.defs and modify the following parameters:
PASS_MAX_DAYS 90 # Maximum number of days a password can be used
PASS_MIN_DAYS 1 # Minimum number of days a password must be used before it can be changed (to prevent frequent password changes)
PASS_WARN_AGE 7 # Warn 7 days before the password expires
Set a password expiration policy for existing users:
sudo chage --maxdays 90 <username>
sudo chage -l <username>
Password History Restrictions
To prevent users from reusing recent passwords, edit /etc/pam.d/system-auth and add the following line before the pam_unix.so line:
password required pam_pwhistory.so remember=5 use_authtok
This configuration remembers the last five passwords, preventing users from reusing them.
Restricting Remote Login for the root User
Disabling SSH remote login for the root user can reduce the risk of brute-force attacks.
Edit the SSH configuration file:
sudo vi /etc/ssh/sshd_config
Locate the following line:
#PermitRootLogin prohibit-password
Change it to:
Note:
If the sshd configuration contains errors, you may be unable to establish a new SSH connection after restarting the service. Before restarting, run sudo sshd -t to verify the configuration syntax. Keep the current session open, and after the restart, confirm that a new SSH connection can be established before disconnecting the current session.
Restart the sshd service:
sudo systemctl restart sshd
Configuring sudo
sudo allows ordinary users to run commands as another user identity (usually root), offering more flexibility and auditability than su. It is recommended to use sudo instead of su for daily management operations.
Installing sudo
sudo is installed by default on TencentOS Server. If it is not installed, switch to the root user and run the following command to install it:
Editing the sudoers File
Use the visudo command to safely edit the sudoers file:
Warning: Always use visudo instead of directly editing /etc/sudoers, because visudo checks the syntax before saving to prevent configuration errors that could make sudo unavailable.
Common sudo Configuration Examples
Allows users to run all commands:
Allows user groups to run all commands without a password:
%wheel ALL=(ALL) NOPASSWD: ALL
Restricts users to running only specific commands:
<username> ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx
sudo Alias Configuration
To improve maintainability, you can set aliases for users, hosts, and commands:
# User alias
User_Alias ADMINS = alice, bob
# Command alias
Cmnd_Alias NETWORKING = /usr/sbin/ifconfig, /usr/sbin/route, /usr/sbin/dnf
# Authorization
ADMINS ALL=(ALL) NETWORKING
sudo Log Auditing
You can monitor the commands that users run on the system by viewing sudo logs. Ensure that logging is enabled in the sudoers file:
Defaults logfile=/var/log/sudo.log
By default, sudo usage records are also written to the system log (/var/log/secure). Check these logs regularly to detect abnormal activity:
sudo grep sudo /var/log/secure
sudo Timeout Settings
To reduce security risks, you can set a timeout for the sudo password cache. Add the following to the sudoers file:
Defaults timestamp_timeout=5
This setting makes the sudo password cache expire after 5 minutes, requiring users to re-enter their passwords.
Regularly Updating the System and Software Packages
Keeping the system and software packages up to date helps prevent potential security vulnerabilities. Run the following commands regularly to update the system and software packages: