1.ensp
telnet server enable
aaa
local-user admin password cipher admin@123 privilege level 3
local-user admin service-type telnet
user-interface vty 0 4
authentication-mode aaa
stelnet server enable
rsa local-key-pair create
aaa
local-user admin password cipher admin@123 privilege level 15
local-user admin service-type ssh
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
ip route-static
AR1配置
4.4.4.0允许访问3.3.3.2
3.3.3.0允许访问2.2.2.2
AR2配置
1.1.1.0允许访问2.2.2.1
4.4.4.0允许访问3.3.3.2
AR3配置
1.1.1.0允许访问2.2.2.1
2.2.2.0允许访问3.3.3.1
acl 3000
设置规则10只允许源IP地址为192.168.1.1的设备访问服务器的Web服务（80端口）
rule 10 permit tcp source 192.168.1.1 0 destination 192.168.3.1 0 destination-port eq 80
设置规则5只允许源IP地址为192.168.1.1、源端?号为80的设备通过HTTP?式登录交换机
rule 5 permit tcp source 192.168.1.1 0 source-port eq 80
acl 2000
定义行号为 5 的规则，拒绝来源IP为 192.168.10.0至192.168.10.255地址访问
rule 5 deny source 192.168.10.0 0.0.0.255
应用ACL到端口
interface GigabitEthernet0/0/1
traffic-filter outbound acl 2000
acl 3001
rule 1 deny tcp source 192.168.10.0 0.0.0.255 destination 202.96.209.11 0 destination-port eq ftp
interface GigabitEthernet0/0/0
traffic-filter inbound acl 3001
dis acl all
2.网络安全加固
管理层面加固
Console口登录设备安全
user-interface console 0
authentication-mode aaa
aaa
local-user admin password cipher admin@123 privilege level 3
local-user admin service-type terminal
Telnet 登录设备安全
undo telnet server enable //关闭telnet服务
telnet server port 53555 //设置telnet端口
配置acl策略，限定telnet允许访问到的IP
ssh替代telnet
SSH 登录设备安全
undo stelnet server enable //关闭stelnet服务
ssh server port 53555 //设置telnet端口
WEB 登录设备安全
undo http server enable
http server port 53555
http acl 2000 //配置acl允许访问http
ssl policy userserver type server //配置ssl服务
pki-realm default //quit
http secure-server ssl-policy userserver
http secure-server enable
禁用不安全的管理协议从业务平面接入
cpu-defend policy 1
deny packet-type telnet
deny packet-type ssh
deny packet-type http
deny packet-type snmp
deny packet-type ftp
deny packet-type icmp
管理平面防护 MPAC
service-security policy ipv4 test //创建一个IPV4 MPAC策略test
rule 10 deny protocol ip source-ip 10.10.1.1 0 //quit
service-security global-bind ipv4 test
控制平面加固
CPCAR 报文速率限制的 CPU 防护
cpu-defend policy 1
car packet-type icmp cir 64
deny packet-type ttl-expired //quit
cpu-defend-policy 1 global 1
cpu-defend-policy 1
禁止指定源MAC的ARP报文上送
acl number 4000
rule 10 permit 12-protocol 0x0806 0xffff source-mac 0000-0000-00db //quit
cpu-defend policy 1
blacklist 1 acl 4000 //quit
cpu-denfend-policy 1 global
畸形报文防范
anti-attack abnormal enable
分片报文防范
anti-attack fragment enable
anti-attack fragment car cir 8000 //限制分片报文接收的速率
TCP SYN 泛洪防范
anti-attack tcp-syn enable
anti-attack tcp-syn car cir 8000 //限制tcp syn报文接收的速率
UDP 泛洪防范
anti-attack udp-flood enable
ICMP 泛洪防范
anti-attack icmp-flood enable
anti-attack icmp-flood car cir 8000
防 ARP 欺骗
interface GigabitEthernet0/0/1 //外网口
arp anti-attack check user-bind enable
防 ARP 泛洪
interface vlanif 100
arp-limit maximum 20 //最多学习20条ARP表项
arp speed-limit source-ip maximum //arp速率限制
携带路由选项的 IP 报文防范
interface vlanif 100
discard rr //记录转发路径上每台设备的IP地址
IP 地址欺骗防范
user-bind static ip-address 10.0.0.1 mac-address 0000-0000-00db
interface GigabitEthernet0/0/1
ip source check user-bind enable //IPSG功能
ip source check user-bind alarm enable //IP报文检查告警功能
ip source check user-bind alarm threshold 200 //丢弃报文200以上告警
转发平面加固
风暴控制加固
interface GigabitEthernet0/0/1
storm-control broadcast min-rate 5000 max-rate 8000
storm-control action error-down
storm-control enable trap
配置URPF严格检查功能
interface GigabitEthernet0/0/1
urpf strict allow-default-route
MAC 地址防漂移
interface GigabitEthernet0/0/1
mac-learning priority 3
undo mac-learning priority 1 allow-flapping //不允许优先级为1的接口发生MAC地址漂移
3.linux安全加固
检查系统版本内核
uname -a
cat /etc/redhat-release
cat /etc/centos-release
检查口令为空的账户
grep | -f passwd shadow
检查UID与Root相同的账户
echo "guest:x:0:0::/:/bin/sh" >> /etc/passwd
检查是否启用core dump设置
vi /etc/security/limits.conf
soft core 0
hard core 0
检查硬盘使用情况
df -h
检查History历史命令条数设置
cat /etc/profile | grep HISTSIZE=1000
检查系统当前umask值
umask 022
口令策略检查
检查密码最小长度
cat /etc/login.defs | grep PASS_MIN_LEN
vi /etc/login.defs PASS_MIN_LEN 10
检查密码过期时间
cat /etc/login.defs | grep PASS_MAX_DAYS
vi /etc/login.defs PASS_MAX_DAYS 90
检查密码认证失败次数
cat /etc/pam.d/login | grep deny
vi /etc/pam.d/login auth required pam_tally2.so deny=5
检查密码复杂度
cat /etc/pam.d/login | grep pam_cracklib.so
vi /pam.d/login dicpath=/usr/share/cracklib/pw_dict
检查密码过期告警天数
cat /etc/login.defs | grep PASS_WARN_AGE
vi /etc/login.defs PASS_WARN_AGE 3
日志审计检查
检查系统是否开启日志功能
ps -ef | grep syslogd
systemctl start rsyslog
检查系统是否开启审计功能
ps -ef | grep auditd
systemctl start auditd
检查是否对登录进行记录
last -f /var/log/wtmp
系统服务检查
检查是否启用talk服务
ps -ef | grep talk
ps -ef | grep ntalk
kill -9 <PID> //kill talk进程
systemctl disable <talk service name>
检查是否启用sendmail服务
ps -ef | grep sendmail
kill -9 <PID>
systemctl disable <sendmail service name>
检查是否启用FTP服务
ps -ef | grep ftp
kill -9 <PID>
systemctl disable <ftp service name>
检查是否启用Telnet服务
ps -ef | grep telnet
kill -9 <PID>
systemctl disable <telnet service name>
访问控制检查
检查系统登录和SSH登录超时时间
cat /etc/profile |grep TMOUT
vi /etc/profile export TMOUT=100
检查SSH协议是否使用SSH2
cat /etc/ssh/sshd_config
vi /etc/ssh/sshd_config Protocol 2
检查是否允许root账户远程SSH连接
cat /etc/ssh/sshd_config
vi /etc/ssh/sshd_config PermitRootLogin no
检查是否允许所有IP访问主机
cat /etc/hosts.allow
vi /etc/hosts.allow sshd:192.168.1.2
检查是否拒绝所有IP访问主机
cat /etc/hosts.deny
vi /etc/hosts.deny sshd:ALL
4.windows安全加固
5.ST测试
6.流量分析
7.应急响应
