tencent cloud

TencentOS Server

DocumentaçãoTencentOS ServerUser GuideSecurity ConfigurationAccount and Password Security

Account and Password Security

Baixar
Modo Foco
Tamanho da Fonte
Última atualização: 2026-10-19 17:22:49
Traduzido por IA
This document describes how to configure account and password security policies in TencentOS Server, including su/sudo permission management, password policy configuration, and root remote login restrictions, to improve system security.

Configuring su Commands

In TencentOS Server, correctly configuring su is equally important for improving system security. You can reduce the risk of privilege abuse by limiting the scope of the su command.

Prohibiting Ordinary Users from Directly Using the su Commands

Only users in the wheel group are allowed to switch to the root user. Edit the /etc/pam.d/su file and find the following line:
#auth required pam_wheel.so use_uid
Uncomment the line and save the file:
auth required pam_wheel.so use_uid

Adding a User to the Wheel Group

Add users who need to use the su commands to the wheel group:
sudo usermod -aG wheel <username>

Setting a Mandatory Password Policy

To enhance system security, you can configure a mandatory password policy through PAM (Pluggable Authentication Modules).

Password Complexity

Edit the /etc/pam.d/system-auth file and add or modify the following lines to set the password complexity policy:
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 minlen=8 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
The parameters are described as follows:
Parameter
Description
minlen=8
The password must contain at least 8 characters.
dcredit=-1
Contains at least 1 digit.
ucredit=-1
Contains at least 1 uppercase letter.
lcredit=-1
Contains at least 1 lowercase letter.
ocredit=-1
Contains at least 1 special character.
retry=3
Allows up to 3 attempts.

Password Expiration Policy

Set the password expiration policy by using the chage command or modifying the /etc/login.defs file:
Edit /etc/login.defs and modify the following parameters:
PASS_MAX_DAYS   90    # Maximum number of days a password can be used
PASS_MIN_DAYS   1     # Minimum number of days a password must be used before it can be changed (to prevent frequent password changes)
PASS_WARN_AGE   7     # Warn 7 days before the password expires
Set a password expiration policy for existing users:
# Set user passwords to expire after 90 days
sudo chage --maxdays 90 <username>

# View user password expiration information
sudo chage -l <username>

Password History Restrictions

To prevent users from reusing recent passwords, edit /etc/pam.d/system-auth and add the following line before the pam_unix.so line:
password required pam_pwhistory.so remember=5 use_authtok
This configuration remembers the last five passwords, preventing users from reusing them.

Restricting Remote Login for the root User

Disabling SSH remote login for the root user can reduce the risk of brute-force attacks.
Edit the SSH configuration file:
sudo vi /etc/ssh/sshd_config
Locate the following line:
#PermitRootLogin prohibit-password
Change it to:
PermitRootLogin no
Note:
If the sshd configuration contains errors, you may be unable to establish a new SSH connection after restarting the service. Before restarting, run sudo sshd -t to verify the configuration syntax. Keep the current session open, and after the restart, confirm that a new SSH connection can be established before disconnecting the current session.
Restart the sshd service:
sudo systemctl restart sshd

Configuring sudo

sudo allows ordinary users to run commands as another user identity (usually root), offering more flexibility and auditability than su. It is recommended to use sudo instead of su for daily management operations.

Installing sudo

sudo is installed by default on TencentOS Server. If it is not installed, switch to the root user and run the following command to install it:
dnf install sudo

Editing the sudoers File

Use the visudo command to safely edit the sudoers file:
sudo visudo
Warning: Always use visudo instead of directly editing /etc/sudoers, because visudo checks the syntax before saving to prevent configuration errors that could make sudo unavailable.

Common sudo Configuration Examples

Allows users to run all commands:
<username> ALL=(ALL) ALL
Allows user groups to run all commands without a password:
%wheel ALL=(ALL) NOPASSWD: ALL
Restricts users to running only specific commands:
<username> ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx

sudo Alias Configuration

To improve maintainability, you can set aliases for users, hosts, and commands:
# User alias
User_Alias ADMINS = alice, bob

# Command alias
Cmnd_Alias NETWORKING = /usr/sbin/ifconfig, /usr/sbin/route, /usr/sbin/dnf

# Authorization
ADMINS ALL=(ALL) NETWORKING

sudo Log Auditing

You can monitor the commands that users run on the system by viewing sudo logs. Ensure that logging is enabled in the sudoers file:
Defaults logfile=/var/log/sudo.log
By default, sudo usage records are also written to the system log (/var/log/secure). Check these logs regularly to detect abnormal activity:
# View sudo logs
sudo grep sudo /var/log/secure

sudo Timeout Settings

To reduce security risks, you can set a timeout for the sudo password cache. Add the following to the sudoers file:
Defaults timestamp_timeout=5
This setting makes the sudo password cache expire after 5 minutes, requiring users to re-enter their passwords.

Regularly Updating the System and Software Packages

Keeping the system and software packages up to date helps prevent potential security vulnerabilities. Run the following commands regularly to update the system and software packages:
sudo dnf update

Anterior: SELinux User GuidePróximo: Authentication and Services (PAM-Kerberos-SSSD)

Ajuda e Suporte

Esta página foi útil?

comentários

Search
    Enter keywords to search documentation