一个服务器批处理设置安全配置的Dos批处理代码,安全,实用.
做服务器安全的可以研究一下..
以下是引用片段：
@echo off
echo.
echo.
echo. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
echo.
echo 你现在使用"一建做安全"脚本
echo.
echo. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
echo.
echo.
echo. -------------------------------------------------------------------------
echo 请按提示操作备份好注册表,否则修改后无法还原,本人不负责.
echo.
echo yes=next set no=exit (this time 30 second default for n)
echo. -------------------------------------------------------------------------
choice /t 30 /c yn /d n
if errorlevel 2 goto end
if errorlevel 1 goto next
:next
if exist backup (echo.)else md backup
if exist temp (rmdir /s/q temp|md temp) else md temp
if exist backup\backupkey.reg (move backup\backupkey.reg backup\backupkey_old.reg ) else goto run
:run
regedit /e temp\backup-reg1.key1 "hkey_local_machine\system\currentcontrolset\"
regedit /e temp\backup-reg2.key2 "hkey_classes_root\"
copy /b /y /v temp\backup-reg1.key1+temp\backup-reg2.key2 backup\backupkey.reg
if exist backup\wshom.ocx (echo 备份已存在) else copy /v/y %systemroot%\system32\wshom.ocx backup\wshom.ocx
if exist backup\shell32.dll (echo 备份已存在) else copy /v/y %systemroot%\system32\shell32.dll backup\shell32.dll
echo 备份已经完成
echo.
goto next2
:next2
echo.
echo. -------------------------------------------------------------------
echo 修改权限system32目录中不安全的几个exe文件,改为只有administrators才有权限运行
echo yes=next set no=this set ignore (this time 30 second default for y)
echo. -------------------------------------------------------------------
choice /t 30 /c yn /d y
if errorlevel 2 goto next3
if errorlevel 1 goto next21
:next21
xcacls.exe %systemroot%\system32\net.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\net1.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\cmd.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\tftp.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\netstat.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\regedit.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\at.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\attrib.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\cacls.exe /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\fortmat.com /t /g administrators:f /y /c
xcacls.exe %systemroot%\system32\secedit.exe /t /g administrators:f /y /c
echo "虚拟主机c盘权限设定"
echo "删除c盘的everyone的权限"
cd/
cacls "%systemdrive%" /r "everyone" /e
cacls "%systemroot%" /r "everyone" /e
cacls "%systemroot%/registration" /r "everyone" /e
cacls "%systemdrive%/documents and settings" /r "everyone" /e
echo "删除c盘的所有的users的访问权限"
cacls "%systemdrive%" /r "users" /e
cacls "%systemdrive%/program files" /r "users" /e
cacls "%systemdrive%/documents and settings" /r "users" /e
cacls "%systemroot%" /r "users" /e
cacls "%systemroot%/addins" /r "users" /e
cacls "%systemroot%/apppatch" /r "users" /e
cacls "%systemroot%/connection wizard" /r "users" /e
cacls "%systemroot%/debug" /r "users" /e
cacls "%systemroot%/driver cache" /r "users" /e
cacls "%systemroot%/help" /r "users" /e
cacls "%systemroot%/iis temporary compressed files" /r "users" /e
cacls "%systemroot%/java" /r "users" /e
cacls "%systemroot%/msagent" /r "users" /e
cacls "%systemroot%/mui" /r "users" /e
cacls "%systemroot%/repair" /r "users" /e
cacls "%systemroot%/resources" /r "users" /e
cacls "%systemroot%/security" /r "users" /e
cacls "%systemroot%/system" /r "users" /e
cacls "%systemroot%/tapi" /r "users" /e
cacls "%systemroot%/temp" /r "users" /e
cacls "%systemroot%/twain_32" /r "users" /e
cacls "%systemroot%/web" /r "users" /e
cacls "%systemroot%/system32/3com_dmi" /r "users" /e
cacls "%systemroot%/system32/administration" /r "users" /e
cacls "%systemroot%/system32/cache" /r "users" /e
cacls "%systemroot%/system32/catroot2" /r "users" /e
cacls "%systemroot%/system32/com" /r "users" /e
cacls "%systemroot%/system32/config" /r "users" /e
cacls "%systemroot%/system32/dhcp" /r "users" /e
cacls "%systemroot%/system32/drivers" /r "users" /e
cacls "%systemroot%/system32/export" /r "users" /e
cacls "%systemroot%/system32/icsxml" /r "users" /e
cacls "%systemroot%/system32/lls" /r "users" /e
cacls "%systemroot%/system32/logfiles" /r "users" /e
cacls "%systemroot%/system32/microsoftpassport" /r "users" /e
cacls "%systemroot%/system32/mui" /r "users" /e
cacls "%systemroot%/system32/oobe" /r "users" /e
cacls "%systemroot%/system32/shellext" /r "users" /e
cacls "%systemroot%/system32/wbem" /r "users" /e
echo "添加iis_wpg的访问权限"
cacls "%systemroot%" /g iis_wpg:r /e
cacls "%systemdrive%/program files/common files" /g iis_wpg:r /e
cacls "%systemroot%/downloaded program files" /g iis_wpg:c /e
cacls "%systemroot%/help" /g iis_wpg:c /e
cacls "%systemroot%/iis temporary compressed files" /g iis_wpg:c /e
cacls "%systemroot%/offline web pages" /g iis_wpg:c /e
cacls "%systemroot%/system32" /g iis_wpg:c /e
cacls "%systemroot%/winsxs" /g iis_wpg:c /e
cacls "%systemroot%/winsxs" /r "users" /e
cacls "%systemroot%/tasks" /g iis_wpg:c /e
cacls "%systemroot%/temp" /g iis_wpg:c /e
cacls "%systemroot%/web" /g iis_wpg:c /e
echo "添加iis_wpg的访问权限[.net专用]"
cacls "%systemroot%/assembly" /g iis_wpg:c /e
cacls "%systemroot%/microsoft.net" /g iis_wpg:c /e
echo "添加iis_wpg的访问权限[装了macfee的软件专用]"
cacls "%systemdrive%/program files/network associates" /g iis_wpg:r /e
echo "添加users的访问权限"
cacls "%systemroot%/temp" /g users:c /e
goto next3
:next3
echo.
echo.
echo. ------------------------------------------------------------------------
echo 禁止不必要的服务,如果要退出请按ctrl+c
echo yes=next set no=this set ignore (this time 30 second default for y)
echo. ------------------------------------------------------------------------
choice /t 30 /c yn /d y
if errorlevel 2 goto next4
if errorlevel 1 goto next31
:next31
echo windows registry editor version 5.00 >temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\lanmanworkstation] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\alerter] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\browser] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\dfs] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\scheduler] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\lmhosts] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\tlntsvr] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\remoteaccess] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\ntmssvc] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\remoteregistry] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\trkwks] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\ersvc] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\messenger] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\netlogon] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\netlogon] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\netdde] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
echo [hkey_local_machine\system\currentcontrolset\services\netddedsdm] >>temp\services.reg
echo "start"=dword:00000004 >>temp\services.reg
regedit /s temp\services.reg
echo.
goto next4
:next4
echo.
echo. -------------------------------------------------------------------------
echo 防止人侵和攻击. 如果要退出请按ctrl+c
echo yes=next set no=this set ignore (this time 30 second default for y)
echo. -------------------------------------------------------------------------
choice /t 30 /c yn /d y
if errorlevel 2 goto next5
if errorlevel 1 goto next41
:next41
echo windows registry editor version 5.00 >temp\skyddos.reg
echo [hkey_local_machine\system\currentcontrolset\services\tcpip\parameters] >>temp\skyddos.reg
echo "enabledeadgwdetect"=dword:00000000 >>temp\skyddos.reg
echo "enableicmpredirects"=dword:00000000 >>temp\skyddos.reg
echo "performrouterdiscovery"=dword:00000000 >>temp\skyddos.reg
echo "nonamereleaseondemand"=dword:00000001 >>temp\skyddos.reg
echo "keepalivetime"=dword:000493e0 >>temp\skyddos.reg
echo "enablepmtudiscovery"=dword:00000000 >>temp\skyddos.reg
echo "synattackprotect"=dword:00000002 >>temp\skyddos.reg
echo "tcpmaxhalfopen"=dword:00000064 >>temp\skyddos.reg
echo "tcpmaxhalfopenretried"=dword:00000050 >>temp\skyddos.reg
echo "tcpmaxconnectresponseretransmissions"=dword:00000001 >>temp\skyddos.reg
echo "tcpmaxdataretransmissions"=dword:00000003 >>temp\skyddos.reg
echo "tcpmaxport***hausted"=dword:00000005 >>temp\skyddos.reg
echo "disableipsourcerouting"=dword:0000002 >>temp\skyddos.reg
echo "tcptimedwaitdelay"=dword:0000001e >>temp\skyddos.reg
echo "enablesecurityfilters"=dword:00000001 >>temp\skyddos.reg
echo "tcpnumconnections"=dword:000007d0 >>temp\skyddos.reg
echo "tcpmaxsendfree"=dword:000007d0 >>temp\skyddos.reg
echo "igmplevel"=dword:00000000 >>temp\skyddos.reg
echo "defaultttl"=dword:00000016 >>temp\skyddos.reg
echo 删除ipc$(internet process connection)是共享“命名管道”的资源
echo [hkey_local_machine\system\currentcontrolset\control\lsa] >>temp\skyddos.reg
echo "restrictanonymous"=dword:00000001 >>temp\skyddos.reg
echo [hkey_local_machine\system\currentcontrolset\services\tcpip\parameters\interfaces\interfaces] >>temp\skyddos.reg
echo "performrouterdiscovery"=dword:00000000 >>temp\skyddos.reg
echo [hkey_local_machine\system\currentcontrolset\services\netbt\parameters] >>temp\skyddos.reg
echo "backlogincrement"=dword:00000003 >>temp\skyddos.reg
echo "maxconnbacklog"=dword:000003e8 >>temp\skyddos.reg
echo [hkey_local_machine\system\currentcontrolset\services\afd\parameters] >>temp\skyddos.reg
echo "enabledynamicbacklog"=dword:00000001 >>temp\skyddos.reg
echo "minimumdynamicbacklog"=dword:00000014 >>temp\skyddos.reg
echo "maximumdynamicbacklog"=dword:00002e20 >>temp\skyddos.reg
echo "dynamicbackloggrowthdelta"=dword:0000000a >>temp\skyddos.reg
echo [hkey_local_machine\system\currentcontrolset\services\lanmanserver\parameters] >>temp\skyddos.reg
echo "autoshareserver"=dword:00000000 >>temp\skyddos.reg
regedit /s temp\skyddos.reg
echo.
echo.
goto next5
:next5
echo.
echo. ------------------------------------------------------------------------
echo 防止asp木马运行 卸除w******.shell, shell.application, w******.network
echo yes=next set no=this set ignore (this time 30 second default for y)
echo. -----------------------------------------------------------------------
choice /t 30 /c yn /d y
if errorlevel 2 goto next6
if errorlevel 1 goto next51
:next51
echo windows registry editor version 5.00 >temp\del.reg
echo [-hkey_classes_root\shell.application] >>temp\del.reg
echo [-hkey_classes_root\shell.application.1] >>temp\del.reg
echo [-hkey_classes_root\clsid\{13709620-c279-11ce-a49e-444553540000}] >>temp\del.reg
echo [-hkey_classes_root\adodb.command\clsid] >>temp\del.reg
echo [-hkey_classes_root\clsid\{00000566-0000-0010-8000-00aa006d2ea4}] >>temp\del.reg
regedit /s temp\del.reg
regsvr32 /u %systemroot%\system32\wshom.ocx
del /f/q %systemroot%\system32\wshom.ocx
regsvr32 /u %systemroot%\system32\shell32.dll
del /f/q %systemroot%\system32\shell32.dll
rmdir /q/s temp
echo.
goto next6
:next6
echo.
echo.
echo. ---------------------------------------------------------------------
echo 设置已经完成重启后才能生效.
echo yes=reboot server no=exit (this time 60 second default for y)
echo. ----------------------------------------------------------------------
choice /t 30 /c yn /d y
if errorlevel 2 goto end
if errorlevel 1 goto reboot
:reboot
shutdown /r /t 0
:end
if exist temp (rmdir /s/q temp|exit) else exit |
|
京ICP备14024464 公安备案号 京1081234