Linux OSを移行する時に確認する設定をまとめてみた

$ cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
SUPPORT_END="2026-06-30"

$ cat /proc/version
Linux version 5.10.234-225.917.amzn2.x86_64 (mockbuild@ip-10-0-58-131) (gcc10-gcc (GCC) 10.5.0 20230707 (Red Hat 10.5.0-1), GNU ld version 2.35.2-9.amzn2.0.3) #1 SMP Sat Mar 8 16:53:21 UTC 2025

$ uname -a
Linux ip-172-31-1-73.ec2.internal 5.10.234-225.917.amzn2.x86_64 #1 SMP Sat Mar 8 16:53:21 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

$ hostname -s
ip-172-31-1-73

$ hostname -d
ec2.internal

$ hostname -f
ip-172-31-1-73.ec2.internal

$ cat /etc/hostname
ip-172-31-1-73.ec2.internal

$ hostnamectl
   Static hostname: ip-172-31-1-73.ec2.internal
         Icon name: computer-vm
           Chassis: vm
        Machine ID: ec244a02bef1ed7bf22522fdff0e9f4f
           Boot ID: 0cfef88f47a14fc58948912a8a1b676f
    Virtualization: amazon
  Operating System: Amazon Linux 2
       CPE OS Name: cpe:2.3:o:amazon:amazon_linux:2
            Kernel: Linux 5.10.234-225.917.amzn2.x86_64
      Architecture: x86-64

$ cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost6 localhost6.localdomain6

$ cat /etc/resolv.conf
; generated by /usr/sbin/dhclient-script
search ec2.internal
options timeout:2 attempts:5
nameserver 172.31.0.2

$ dig

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.amzn2.13.11 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53535
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;.    IN NS

;; ANSWER SECTION:
.   47243 IN NS c.root-servers.net.
.   47243 IN NS h.root-servers.net.
.
.
(中略)
.
.
.   47243 IN NS g.root-servers.net.
.   47243 IN NS a.root-servers.net.

;; Query time: 0 msec
;; SERVER: 172.31.0.2#53(172.31.0.2)
;; WHEN: Fri Mar 28 00:50:50 UTC 2025
;; MSG SIZE  rcvd: 239

$ cat /etc/nsswitch.conf
#
# /etc/nsswitch.conf
#
.
.
(中略)
.
.
passwd:     sss files
shadow:     files sss
group:      sss files

#hosts:     db files nisplus nis dns
hosts:      files dns myhostname

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss

netgroup:   nisplus sss

publickey:  nisplus

automount:  files nisplus
aliases:    files nisplus

$ chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^- time.circlevps.net            2   6   377    21  -2755us[-2755us] +/-   16ms
^- lithium.constant.com          2   6   377    22   -163us[ -163us] +/-   35ms
^* 169.254.169.123               3   4   377    32    +16us[  +19us] +/-  246us
^- 208.67.72.43                  3   6   377    20  +3935us[+3935us] +/-  109ms
^- t2.time.bf1.yahoo.com         2   6   377    21    -99us[  -98us] +/- 8417us

$ cat /etc/chrony.conf
# Use NTP servers from DHCP.
sourcedir /run/chrony-dhcp

# Include configuration found in /etc/chrony.d/*.conf
confdir /etc/chrony.d

# Use NTP sources found in /etc/chrony.d/*.sources
sourcedir /etc/chrony.d

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

# Enable hardware timestamping on all interfaces that support it.
#hwtimestamp *

# Increase the minimum number of selectable sources required to adjust
# the system clock.
#minsources 2

# Allow NTP client access from local network.
#allow 192.168.0.0/16

# Serve time even if not synchronized to a time source.
#local stratum 10

# Require authentication (nts or key option) for all NTP sources.
#authselectmode require

# Specify file containing keys for NTP authentication.
keyfile /etc/chrony.keys

# Insert/delete leap seconds by slewing instead of stepping.
#leapsecmode slew

# Get TAI-UTC offset and leap seconds from the system tz database.
# Clients of leap smearing servers must not use this directive.
#leapsectz right/UTC

# Specify directory for log files.
logdir /var/log/chrony

# Select which information is logged.
log measurements statistics tracking

$ cat /etc/localtime
TZif2UTCTZif2�UTC
UTC0

$ timedatectl
      Local time: Fri 2025-03-28 00:43:11 UTC
  Universal time: Fri 2025-03-28 00:43:11 UTC
        RTC time: Fri 2025-03-28 00:43:12
       Time zone: n/a (UTC, +0000)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: n/a

$ cat /etc/locale.conf
# Created by cloud-init v. 19.3-46.amzn2.0.5 on Fri, 28 Mar 2025 00:32:48 +0000
LANG=en_US.UTF-8

$ localectl
   System Locale: LANG=en_US.UTF-8
       VC Keymap: n/a
      X11 Layout: n/a

$ ifconfig -a
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
        inet 172.31.1.73  netmask 255.255.240.0  broadcast 172.31.15.255
        inet6 fe80::89:a3ff:fe44:502d  prefixlen 64  scopeid 0x20<link>
        ether 02:89:a3:44:50:2d  txqueuelen 1000  (Ethernet)
        RX packets 34042  bytes 40662397 (38.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8423  bytes 1569288 (1.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ ls -l /etc/sysconfig/network-scripts/ifcfg-*
-rw-r--r-- 1 root root 185 Mar 21 22:03 /etc/sysconfig/network-scripts/ifcfg-eth0
-rw-r--r-- 1 root root 254 Mar 29  2019 /etc/sysconfig/network-scripts/ifcfg-lo

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
TYPE=Ethernet
USERCTL=yes
PEERDNS=yes
DHCPV6C=yes
DHCPV6C_OPTIONS=-nw
PERSISTENT_DHCLIENT=yes
RES_OPTIONS="timeout:2 attempts:5"
DHCP_ARP_CHECK=no

$ ls -l /etc/sysconfig/network-scripts/route-*
-rw-r--r-- 1 root root 73 Mar 21 22:03 /etc/sysconfig/network-scripts/route-eth0

$ cat /etc/sysconfig/network-scripts/route-eth0
# Static route for metadata service
169.254.169.254 via 0.0.0.0 dev eth0

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.31.0.1      0.0.0.0         UG    0      0        0 eth0
169.254.169.254 0.0.0.0         255.255.255.255 UH    0      0        0 eth0
172.31.0.0      0.0.0.0         255.255.240.0   U     0      0        0 eth0

$ ip route show
default via 172.31.0.1 dev eth0
169.254.169.254 dev eth0
172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.73

$ ip route show table all
default via 172.31.0.1 dev eth0
169.254.169.254 dev eth0
172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.73
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 172.31.0.0 dev eth0 table local proto kernel scope link src 172.31.1.73
local 172.31.1.73 dev eth0 table local proto kernel scope host src 172.31.1.73
broadcast 172.31.15.255 dev eth0 table local proto kernel scope link src 172.31.1.73
unreachable ::/96 dev lo metric 1024 pref medium
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 pref medium
unreachable 2002:a00::/24 dev lo metric 1024 pref medium
unreachable 2002:7f00::/24 dev lo metric 1024 pref medium
unreachable 2002:a9fe::/32 dev lo metric 1024 pref medium
unreachable 2002:ac10::/28 dev lo metric 1024 pref medium
unreachable 2002:c0a8::/32 dev lo metric 1024 pref medium
unreachable 2002:e000::/19 dev lo metric 1024 pref medium
unreachable 3ffe:ffff::/32 dev lo metric 1024 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
local fe80::89:a3ff:fe44:502d dev eth0 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev eth0 table local proto kernel metric 256 pref medium

$ routel
         target            gateway          source    proto    scope    dev tbl
        default         172.31.0.1                                     eth0
169.254.169.254                                                        eth0
    172.31.0.0/ 20                     172.31.1.73   kernel     link   eth0
      127.0.0.0          broadcast       127.0.0.1   kernel     link     lo local
     127.0.0.0/ 8            local       127.0.0.1   kernel     host     lo local
      127.0.0.1              local       127.0.0.1   kernel     host     lo local
127.255.255.255          broadcast       127.0.0.1   kernel     link     lo local
     172.31.0.0          broadcast     172.31.1.73   kernel     link   eth0 local
    172.31.1.73              local     172.31.1.73   kernel     host   eth0 local
  172.31.15.255          broadcast     172.31.1.73   kernel     link   eth0 local
            ::/ 96     unreachable                                       lo
::ffff:0.0.0.0/ 96     unreachable                                       lo
    2002:a00::/ 24     unreachable                                       lo
   2002:7f00::/ 24     unreachable                                       lo
   2002:a9fe::/ 32     unreachable                                       lo
   2002:ac10::/ 28     unreachable                                       lo
   2002:c0a8::/ 32     unreachable                                       lo
   2002:e000::/ 19     unreachable                                       lo
   3ffe:ffff::/ 32     unreachable                                       lo
        fe80::/ 64                                   kernel            eth0
            ::1              local                   kernel              lo local
fe80::89:a3ff:fe44:502d              local                   kernel            eth0 local
      multicast

$ cat /etc/fstab
#
UUID=e44ce04c-3882-4123-8840-29cdc5ba3f3c     /           xfs    defaults,noatime  1   1

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        455M     0  455M   0% /dev
tmpfs           464M     0  464M   0% /dev/shm
tmpfs           464M  400K  464M   1% /run
tmpfs           464M     0  464M   0% /sys/fs/cgroup
/dev/nvme0n1p1  8.0G  2.0G  6.1G  24% /
tmpfs            93M     0   93M   0% /run/user/0

$ findmnt
TARGET                                SOURCE     FSTYPE     OPTIONS
/                                     /dev/nvme0n1p1
│                                                xfs        rw,noatime,attr2,inode64,logbufs=8,logbsize=32k,noq
├─/sys                                sysfs      sysfs      rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/debug                 debugfs    debugfs    rw,relatime
│ ├─/sys/kernel/security              securityfs securityfs rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup                    tmpfs      tmpfs      ro,nosuid,nodev,noexec,mode=755
│ │ ├─/sys/fs/cgroup/systemd          cgroup     cgroup     rw,nosuid,nodev,noexec,relatime,xattr,release_agent
.
.
(中略)
.
.
│ │ ├─/sys/fs/cgroup/perf_event       cgroup     cgroup     rw,nosuid,nodev,noexec,relatime,perf_event
│ │ └─/sys/fs/cgroup/hugetlb          cgroup     cgroup     rw,nosuid,nodev,noexec,relatime,hugetlb
│ └─/sys/fs/pstore                    pstore     pstore     rw,nosuid,nodev,noexec,relatime
├─/proc                               proc       proc       rw,nosuid,nodev,noexec,relatime
│ └─/proc/sys/fs/binfmt_misc          systemd-1  autofs     rw,relatime,fd=33,pgrp=1,timeout=0,minproto=5,maxpr
├─/dev                                devtmpfs   devtmpfs   rw,nosuid,size=465672k,nr_inodes=116418,mode=755
│ ├─/dev/shm                          tmpfs      tmpfs      rw,nosuid,nodev
│ ├─/dev/pts                          devpts     devpts     rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=0
│ ├─/dev/hugepages                    hugetlbfs  hugetlbfs  rw,relatime,pagesize=2M
│ └─/dev/mqueue                       mqueue     mqueue     rw,relatime
├─/run                                tmpfs      tmpfs      rw,nosuid,nodev,mode=755
│ └─/run/user/0                       tmpfs      tmpfs      rw,nosuid,nodev,relatime,size=95004k,mode=700
└─/var/lib/nfs/rpc_pipefs             sunrpc     rpc_pipefs rw,relatime

$ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=465672k,nr_inodes=116418,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
.
.
(中略)
.
.
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
/dev/nvme0n1p1 on / type xfs (rw,noatime,attr2,inode64,logbufs=8,logbsize=32k,noquota)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=21,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=13505)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,size=95004k,mode=700)

$ sudo parted -l
Model: NVMe Device (nvme)
Disk /dev/nvme0n1: 8590MB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start   End     Size    File system  Name                 Flags
128     1049kB  2097kB  1049kB               BIOS Boot Partition  bios_grub
 1      2097kB  8590MB  8588MB  xfs          Linux

$ sudo lsblk
NAME          MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme0n1       259:0    0   8G  0 disk
├─nvme0n1p1   259:1    0   8G  0 part /
└─nvme0n1p128 259:2    0   1M  0 part

$ swapon -s

$ cat /proc/swaps
Filename    Type  Size  Used  Priority

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
.
.
(中略)
.
.
tcpdump:x:72:72::/:/sbin/nologin
ec2-user:x:1000:1000:EC2 Default User:/home/ec2-user:/bin/bash

$ cat /etc/group
root:x:0:
bin:x:1:
.
.
(中略)
.
.
tcpdump:x:72:
ec2-user:x:1000:

$ sudo cat /etc/sudoers
## Sudoers allows particular users to run various commands as
.
.
(中略)
.
.
#
# Refuse to run if unable to disable echo on the tty.
#
Defaults   !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home
Defaults    match_group_by_gid

# Prior to version 1.8.15, groups listed in sudoers that were not
# found in the system group database were passed to the group
# plugin, if any. Starting with 1.8.15, only groups of the form
# %:group are resolved via the group plugin by default.
# We enable always_query_group_plugin to restore old behavior.
# Disable this option for new behavior.
Defaults    always_query_group_plugin

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
##  user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL)  ALL

## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL

## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

$ sudo ls -lR /etc/sudoers.d/
/etc/sudoers.d/:
total 4
-r--r----- 1 root root 139 Mar 28 00:32 90-cloud-init-users

$ sudo cat /etc/sudoers.d/90-cloud-init-users
# Created by cloud-init v. 19.3-46.amzn2.0.5 on Fri, 28 Mar 2025 00:32:47 +0000

# User rules for ec2-user
ec2-user ALL=(ALL) NOPASSWD:ALL

$ ls -l /home/*/.bash*
-rw------- 1 ec2-user ec2-user 7628 Mar 29 09:05 /home/ec2-user/.bash_history
-rw-r--r-- 1 ec2-user ec2-user   18 Jul 15  2020 /home/ec2-user/.bash_logout
-rw-r--r-- 1 ec2-user ec2-user  193 Jul 15  2020 /home/ec2-user/.bash_profile
-rw-r--r-- 1 ec2-user ec2-user  231 Jul 15  2020 /home/ec2-user/.bashrc

$ cat /home/ec2-user/.bash_profile
# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
 . ~/.bashrc
fi

# User specific environment and startup programs

PATH=$PATH:$HOME/.local/bin:$HOME/bin

export PATH

$ cat /home/ec2-user/.bashrc
# .bashrc

# Source global definitions
if [ -f /etc/bashrc ]; then
 . /etc/bashrc
fi

# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=

# User specific aliases and functions

$ sudo cat /etc/ssh/sshd_config
# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
.
.
(中略)
.
.
AuthorizedKeysCommand /opt/aws/bin/eic_run_authorized_keys %u %f
AuthorizedKeysCommandUser ec2-instance-connect

$ sudo ls -l /home/*/.ssh/authorized_keys
-rw------- 1 ec2-user ec2-user 393 Mar 28 00:32 /home/ec2-user/.ssh/authorized_keys

$ sudo cat /home/ec2-user/.ssh/authorized_keys
ssh-rsa AAAAB3N..(中略)..18iQ7v non-97-test

$ ls -l /etc/pam.d
total 96
-rw-r--r-- 1 root root 272 Jan 16  2020 atd
-rw-r--r-- 1 root root 232 Jan 29  2024 config-util
-rw-r--r-- 1 root root 287 Jan 16  2020 crond
-rw-r--r-- 1 root root 701 Jan 29  2024 fingerprint-auth
-rw-r--r-- 1 root root 715 Jan 23  2023 login
-rw-r--r-- 1 root root 154 Jan 29  2024 other
-rw-r--r-- 1 root root 188 Feb 13  2020 passwd
-rw-r--r-- 1 root root 760 Jan 29  2024 password-auth
-rw-r--r-- 1 root root 329 Jan 29  2024 postlogin
-rw-r--r-- 1 root root 640 Jan 23  2023 remote
-rw-r--r-- 1 root root 143 Jan 23  2023 runuser
-rw-r--r-- 1 root root 138 Jan 23  2023 runuser-l
-rw-r--r-- 1 root root  36 Apr 23  2023 screen
-rw-r--r-- 1 root root 145 Aug 16  2018 setup
-rw-r--r-- 1 root root 743 Jan 29  2024 smartcard-auth
lrwxrwxrwx 1 root root  25 Mar 21 22:02 smtp -> /etc/alternatives/mta-pam
-rw-r--r-- 1 root root  76 Jan 11  2024 smtp.postfix
-rw-r--r-- 1 root root 904 Feb 25 11:17 sshd
-rw-r--r-- 1 root root 540 Jan 23  2023 su
-rw-r--r-- 1 root root 200 Feb 22  2024 sudo
-rw-r--r-- 1 root root 178 Feb 22  2024 sudo-i
-rw-r--r-- 1 root root 137 Jan 23  2023 su-l
-rw-r--r-- 1 root root 760 Jan 29  2024 system-auth
-rw-r--r-- 1 root root 129 Sep  5  2024 systemd-user
-rw-r--r-- 1 root root  84 Feb 20  2020 vlock

$ cat /etc/pam.d/sshd
#%PAM-1.0
auth    required pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

$ for service in $(systemctl list-unit-files --type=service --no-legend | awk '{print $1}'); do
    current=$(systemctl list-unit-files "$service" --no-legend | awk '{print $2}')
    preset=$(systemctl is-enabled "$service" 2>&1)
    if [[ "$preset" == *"enable"* ]]; then
      preset_state="enable"
    elif [[ "$preset" == *"disable"* ]]; then
      preset_state="disable"
    else
      preset_state="unknown"
    fi
    printf "%-40s %-15s %s\n" "$service" "$current" "$preset_state"
  done
acpid.service                            enabled         enable
amazon-ssm-agent.service                 enabled         enable
amzn2-early-relabel-modules.service      enabled         enable
arp-ethers.service                       disabled        disable
atd.service                              enabled         enable
.
.
(中略)
.
.
systemd-update-utmp.service              static          unknown
systemd-user-sessions.service            static          unknown
systemd-vconsole-setup.service           static          unknown
teamd@.service                           static          unknown
update-motd.service                      enabled         enable

$ ls -l /etc/systemd/system
total 8
-rw-r--r-- 1 root root  588 Feb 27 00:27 amazon-ssm-agent.service
drwxr-xr-x 2 root root   57 Mar 21 22:02 basic.target.wants
drwxr-xr-x 2 root root  119 Mar 21 22:02 cloud-init.target.wants
lrwxrwxrwx 1 root root   40 Mar 21 22:02 default.target -> /usr/lib/systemd/system/graphical.target
drwxr-xr-x 2 root root   87 Mar 21 22:02 default.target.wants
drwxr-xr-x 2 root root   32 Mar 21 22:02 getty.target.wants
drwxr-xr-x 2 root root   78 Mar 21 22:02 local-fs.target.wants
drwxr-xr-x 2 root root 4096 Mar 28 00:34 multi-user.target.wants
drwxr-xr-x 2 root root   31 Mar 21 22:02 remote-fs.target.wants
drwxr-xr-x 2 root root   51 Mar 21 22:02 sockets.target.wants
drwxr-xr-x 2 root root  287 Mar 21 22:02 sysinit.target.wants
drwxr-xr-x 2 root root   44 Mar 21 22:02 system-update.target.wants

$ cat /etc/systemd/system/amazon-ssm-agent.service
[Unit]
Description=amazon-ssm-agent
After=network-online.target

[Service]
Type=simple
WorkingDirectory=/usr/bin/
ExecStart=/usr/bin/amazon-ssm-agent
KillMode=process

# Restart the agent regardless of whether it crashes (and returns a non-zero result code) or if
# is terminated normally (e.g. via 'kill -HUP').  Delay restart so that the agent is less likely
# to restart during a reboot initiated by a script. If the agent exits with status 194 (reboot
# requested), don't restart at all.
Restart=always
RestartPreventExitStatus=194
RestartSec=90

[Install]
WantedBy=multi-user.target

$ ls -l /etc/init.d/
total 40
-rw-r--r-- 1 root root 18281 Mar 29  2019 functions
-rwxr-xr-x 1 root root  4569 Mar 29  2019 netconsole
-rwxr-xr-x 1 root root  7923 Mar 29  2019 network
-rw-r--r-- 1 root root  1160 Sep  5  2024 README

$ sudo ps -ej uf
USER       PID  PGID   SID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         2     0     0  0.0  0.0      0     0 ?        S    07:24   0:00 [kthreadd]
root         3     0     0  0.0  0.0      0     0 ?        I<   07:24   0:00  \_ [rcu_gp]
root         4     0     0  0.0  0.0      0     0 ?        I<   07:24   0:00  \_ [rcu_par_gp]
root         6     0     0  0.0  0.0      0     0 ?        I<   07:24   0:00  \_ [kworker/0:0H-ev]
.
.
(中略)
.
.
root      2766     0     0  0.0  0.0      0     0 ?        I    07:52   0:00  \_ [kworker/0:0-eve]
root      2771     0     0  0.0  0.0      0     0 ?        I    07:53   0:00  \_ [kworker/u4:0-ev]
root      2779     0     0  0.0  0.0      0     0 ?        I    07:53   0:00  \_ [kworker/1:3-mm_]
root         1     1     1  0.0  0.5  41568  5280 ?        Ss   07:24   0:00 /usr/lib/systemd/systemd --switched-root --system --deserialize 21
root      1230  1230  1230  0.0  0.8  38944  8300 ?        Ss   07:24   0:00 /usr/lib/systemd/systemd-journald
.
.
(中略)
.
.
root      2055  2055  2055  0.0  0.3  98688  3700 ?        Ss   07:24   0:00 /sbin/dhclient -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H ip-172-31-1-73 eth0
root      2102  2102  2102  0.0  0.4  98688  4104 ?        Ss   07:24   0:00 /sbin/dhclient -6 -nw -lf /var/lib/dhclient/dhclient6--eth0.lease -pf /var/run/dhclient6-eth0.pid eth0 -H ip-172-31-1-73
root      2230  2230  2230  0.0  0.5  90312  4812 ?        Ss   07:24   0:00 /usr/libexec/postfix/master -w
postfix   2232  2230  2230  0.0  0.6  90400  6536 ?        S    07:24   0:00  \_ pickup -l -t unix -u
postfix   2233  2230  2230  0.0  0.7  90472  6920 ?        S    07:24   0:00  \_ qmgr -l -t unix -u
root      2287  2287  2287  0.0  1.9 1849420 18824 ?       Ssl  07:24   0:00 /usr/bin/amazon-ssm-agent
root      2357  2357  2287  0.0  3.1 2315756 29628 ?       Sl   07:24   0:00  \_ /usr/bin/ssm-agent-worker
root      2469  2469  2287  0.1  2.5 1930336 24532 ?       Sl   07:28   0:02      \_ /usr/bin/ssm-session-worker botocore-session-1743492500-rfndastvcuc9o27hdv7q96vbqe
ec2-user  2483  2483  2483  0.0  0.3 124212  3408 pts/0    Ss   07:28   0:00          \_ sh
ec2-user  2484  2484  2483  0.0  0.4 124740  3816 pts/0    S    07:28   0:00              \_ /bin/bash
root      2795  2795  2483  0.0  0.7 239812  7172 pts/0    S+   07:53   0:00                  \_ sudo ps -ej uf
root      2796  2795  2483  0.0  0.4 162444  3976 pts/0    R+   07:53   0:00                      \_ ps -ej uf
root      2288  2288  2288  0.0  0.8 224708  7836 ?        Ssl  07:24   0:00 /usr/sbin/rsyslogd -n
root      2294  2294  2294  0.0  0.7 110852  7168 ?        Ss   07:24   0:00 /usr/sbin/sshd -D
root      2301  2301  2301  0.0  0.2  27888  2236 ?        Ss   07:24   0:00 /usr/sbin/atd -f
root      2312  2312  2312  0.0  0.3 135084  3104 ?        Ss   07:24   0:00 /usr/sbin/crond -n
root      2326  2326  2326  0.0  0.1 121312  1740 tty1     Ss+  07:24   0:00 /sbin/agetty --noclear tty1 linux
root      2327  2327  2327  0.0  0.2 120960  2264 ttyS0    Ss+  07:24   0:00 /sbin/agetty --keep-baud 115200,38400,9600 ttyS0 vt220

$ sudo ss -antup
Netid    State     Recv-Q    Send-Q                          Local Address:Port           Peer Address:Port    Process
udp      UNCONN    0         0                                     0.0.0.0:68                  0.0.0.0:*        users:(("dhclient",pid=2054,fd=6))
udp      UNCONN    0         0                                     0.0.0.0:111                 0.0.0.0:*        users:(("rpcbind",pid=1805,fd=6))
udp      UNCONN    0         0                                     0.0.0.0:704                 0.0.0.0:*        users:(("rpcbind",pid=1805,fd=7))
udp      UNCONN    0         0                                   127.0.0.1:323                 0.0.0.0:*        users:(("chronyd",pid=1830,fd=5))
udp      UNCONN    0         0              [fe80::89:a3ff:fe44:502d]%eth0:546                    [::]:*        users:(("dhclient",pid=2101,fd=5))
udp      UNCONN    0         0                                        [::]:111                    [::]:*        users:(("rpcbind",pid=1805,fd=9))
udp      UNCONN    0         0                                        [::]:704                    [::]:*        users:(("rpcbind",pid=1805,fd=10))
udp      UNCONN    0         0                                       [::1]:323                    [::]:*        users:(("chronyd",pid=1830,fd=6))
tcp      LISTEN    0         128                                   0.0.0.0:111                 0.0.0.0:*        users:(("rpcbind",pid=1805,fd=8))
tcp      LISTEN    0         128                                   0.0.0.0:22                  0.0.0.0:*        users:(("sshd",pid=2292,fd=3))
tcp      LISTEN    0         100                                 127.0.0.1:25                  0.0.0.0:*        users:(("master",pid=2229,fd=13))
tcp      ESTAB     0         0                                 172.31.1.73:36104         67.220.249.15:443      users:(("ssm-agent-worke",pid=2354,fd=15))
tcp      ESTAB     0         0                                 172.31.1.73:60658         67.220.249.15:443      users:(("ssm-session-wor",pid=2431,fd=16))
tcp      LISTEN    0         128                                      [::]:111                    [::]:*        users:(("rpcbind",pid=1805,fd=11))
tcp      LISTEN    0         128                                      [::]:22                     [::]:*        users:(("sshd",pid=2292,fd=4))

$ sudo netstat -antup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1805/rpcbind
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2292/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2229/master
tcp        0      0 172.31.1.73:36104       67.220.249.15:443       ESTABLISHED 2354/ssm-agent-work
tcp        0      0 172.31.1.73:60658       67.220.249.15:443       ESTABLISHED 2431/ssm-session-wo
tcp6       0      0 :::111                  :::*                    LISTEN      1805/rpcbind
tcp6       0      0 :::22                   :::*                    LISTEN      2292/sshd
udp        0      0 0.0.0.0:68              0.0.0.0:*                           2054/dhclient
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1805/rpcbind
udp        0      0 0.0.0.0:704             0.0.0.0:*                           1805/rpcbind
udp        0      0 127.0.0.1:323           0.0.0.0:*                           1830/chronyd
udp6       0      0 fe80::89:a3ff:fe44::546 :::*                                2101/dhclient
udp6       0      0 :::111                  :::*                                1805/rpcbind
udp6       0      0 :::704                  :::*                                1805/rpcbind
udp6       0      0 ::1:323                 :::*                                1830/chronyd

$ cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
 minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

$ ls -l /etc/logrotate.d/
total 20
-rw-r--r-- 1 root root  76 Aug  2  2018 bootlog
-rw-r--r-- 1 root root 223 Aug 24  2022 chrony
-rw-r--r-- 1 root root 408 Aug  2  2018 psacct
-rw-r--r-- 1 root root 224 Feb  7  2023 syslog
-rw-r--r-- 1 root root 100 Oct 18  2023 yum

$ cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
 /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

$ cat /etc/rsyslog.conf
# rsyslog configuration file
.
.
(中略)
.
.
#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

.
.
(中略)
.
.
#*.* @@remote-host:514
# ### end of the forwarding rule ###

$ ls -l /etc/rsyslog.d/
total 8
-rw-r--r-- 1 root root 255 Nov  5  2019 21-cloudinit.conf
-rw-r--r-- 1 root root  49 Sep  5  2024 listen.conf
$ cat /etc/rsyslog.d/21-cloudinit.conf
# Log cloudinit generated log messages to file
:syslogtag, isequal, "[CLOUDINIT]" /var/log/cloud-init.log

# comment out the following line to allow CLOUDINIT messages through.
# Doing so means you'll also get CLOUDINIT messages in /var/log/syslog
& stop

$ cat /etc/rsyslog.d/listen.conf
$SystemLogSocketName /run/systemd/journal/syslog

$ sudo cat /var/spool/cron/*
cat: /var/spool/cron/*: No such file or directory

$ sudo cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed

$ ls -l /etc/cron.*
-rw------- 1 root root  0 Jan 16  2020 /etc/cron.deny

/etc/cron.d:
total 16
-rw-r--r-- 1 root root 128 Jan 16  2020 0hourly
-rw-r--r-- 1 root root 108 Sep 22  2023 raid-check
-rw------- 1 root root 235 May 31  2023 sysstat
-rw-r--r-- 1 root root 194 Jun  8  2021 update-motd

/etc/cron.daily:
total 12
-rwx------ 1 root root 219 Jul 27  2018 logrotate
-rwxr-xr-x 1 root root 618 Apr 29  2019 man-db.cron
-rwx------ 1 root root 208 Jul 27  2018 mlocate

/etc/cron.hourly:
total 4
-rwxr-xr-x 1 root root 392 Jan 16  2020 0anacron

/etc/cron.monthly:
total 0

/etc/cron.weekly:
total 0

$ sudo systemctl list-timers
NEXT                         LEFT     LAST                         PASSED    UNIT                         ACTIV
Sun 2025-03-30 07:53:41 UTC  23h left Sat 2025-03-29 07:53:41 UTC  33min ago systemd-tmpfiles-clean.timer syste

1 timers listed.
Pass --all to see loaded but inactive timers, too.

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --list-all-zones
block
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

.
.
(中略)
.
.

work
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh dhcpv6-client
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

$ cat /etc/hosts.allow
#
# hosts.allow This file contains access rules which are used to
#  allow or deny connections to network services that
#  either use the tcp_wrappers library or that have been
#  started through a tcp_wrappers-enabled xinetd.
#
#  See 'man 5 hosts_options' and 'man 5 hosts_access'
#  for information on rule syntax.
#  See 'man tcpd' for information on tcp_wrappers
#

$ cat /etc/hosts.deny
#
# hosts.deny This file contains access rules which are used to
#  deny connections to network services that either use
#  the tcp_wrappers library or that have been
#  started through a tcp_wrappers-enabled xinetd.
#
#  The rules in this file can also be set up in
#  /etc/hosts.allow with a 'deny' option instead.
#
#  See 'man 5 hosts_options' and 'man 5 hosts_access'
#  for information on rule syntax.
#  See 'man tcpd' for information on tcp_wrappers
#

$ cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

$ getenforce
Disabled

$ sestatus
SELinux status:                 disabled

$ yum repolist -v
Loading "extras_suggestions" plugin
Loading "langpacks" plugin
Loading "priorities" plugin
Loading "update-motd" plugin
Adding en_US to language list
Config time: 0.301
Yum version: 3.4.3
Setting up Package Sacks
pkgsack time: 0.020
Repo-id      : amzn2-core/2/x86_64
Repo-name    : Amazon Linux 2 core repository
Repo-revision: 1741817581
Repo-updated : Wed Mar 12 22:13:01 2025
Repo-pkgs    : 37,262
Repo-size    : 67 G
Repo-mirrors : https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/core/latest/x86_64/mirror.list
Repo-baseurl : https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/core/2.0/x86_64/bc531fc2103715ef50af98052d276ae6bcc929adfd69cfff0b74db1e663484a9/
Repo-expire  : 300 second(s) (last: Tue Apr  1 08:45:29 2025)
  Filter     : read-only:present
Repo-filename: /etc/yum.repos.d/amzn2-core.repo
.
.
(中略)
.
.
Repo-id      : amzn2extra-kernel-5.10/2/x86_64
Repo-name    : Amazon Extras repo for kernel-5.10
Repo-revision: 1741817618
Repo-updated : Wed Mar 12 22:13:38 2025
Repo-pkgs    : 695
Repo-size    : 3.9 G
Repo-mirrors : https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/extras/kernel-5.10/latest/x86_64/mirror.list
Repo-baseurl : https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/extras/kernel-5.10/stable/x86_64/496b28ff4889564fa775fed03c026fb05e36ca1c836a53f7836482a364777b0b/
Repo-expire  : 21,600 second(s) (last: Tue Apr  1 07:24:32 2025)
  Filter     : read-only:present
Repo-filename: /etc/yum.repos.d/amzn2-extras.repo

repolist: 38,096

$ cat /etc/sysctl.conf
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).

$ ls -l /etc/sysctl.d/
total 8
-r--r--r-- 1 root root 699 Mar 26  2021 00-defaults.conf
-rw-r--r-- 1 root root 279 Mar 21 22:03 99-amazon.conf
lrwxrwxrwx 1 root root  14 Mar 21 22:02 99-sysctl.conf -> ../sysctl.conf

$ cat /etc/sysctl.d/00-defaults.conf
# Maximize console logging level for kernel printk messages
kernel.printk = 8 4 1 7

# Wait 30 seconds and then reboot
kernel.panic = 30

# Allow neighbor cache entries to expire even when the cache is not full
net.ipv4.neigh.default.gc_thresh1 = 0
net.ipv6.neigh.default.gc_thresh1 = 0

# Avoid neighbor table contention in large subnets
net.ipv4.neigh.default.gc_thresh2 = 15360
net.ipv6.neigh.default.gc_thresh2 = 15360
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv6.neigh.default.gc_thresh3 = 16384

# Increasing to account for skb structure growth since the 3.4.x kernel series
net.ipv4.tcp_wmem = 4096 20480 4194304

# Bumped the default TTL to 255 (maximum)
net.ipv4.ip_default_ttl = 255

$ sysctl -a
abi.vsyscall32 = 1
crypto.fips_enabled = 0
debug.exception-trace = 1
debug.kprobes-optimization = 1
.
.
(中略)
.
.
vm.watermark_boost_factor = 15000
vm.watermark_scale_factor = 10
vm.zone_reclaim_mode = 0

$ ls -l /etc/security/limits.*
-rw-r--r-- 1 root root 2422 Jan 29  2024 /etc/security/limits.conf

/etc/security/limits.d:
total 0

$ cat /etc/security/limits.conf
# /etc/security/limits.conf
#
#This file sets the resource limits for the users logged in via PAM.
.
.
(中略)
.
.
#*               soft    core            0
#*               hard    rss             10000
#@student        hard    nproc           20
#@faculty        soft    nproc           20
#@faculty        hard    nproc           50
#ftp             hard    nproc           0
#@student        -       maxlogins       4

# End of file