技術標籤：工具使用

這個指令碼主要是用於檢查Linux系統的一些基礎配置是否存在危險，能夠快速的發現問題，定位問題，目前功能還不夠全面，後面慢慢完善。
喜歡安全的朋友可以微信關注Gamma安全實驗室公眾號，裡面有很多高質量文章以及免費的學習資料。

#! /bin/bash 
######################################
# Linux主機安全基線檢查
# Date:2020-12-23
# 使用前請給檔案執行許可權:chmod u+x check.sh
# 如提示找不到檔案 在vi編輯模式下 set ff=uninx
# by Gamma安全實驗室
######################################
 


scanner_time=`date '+%Y-%m-%d_%H:%M:%S'`
mkdir Check_log
scanner_log="./Check_log/checkResult_${scanner_time}.log"
uptime=$(uptime | sed 's/.*up \([^,]*\), .*/\1/')

#呼叫函式庫
[ -f /etc/init.d/functions ] && source /etc/init.d/functions
export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
source /etc/profile

#Require root to run this script.
[ $(
 
id -u) -gt 0 ] && echo "請用root使用者執行此指令碼！" && exit 1

#報錯日誌記錄
[ -f ${scanner_log} ] || touch ${scanner_log}

function getSystemStatus(){
    echo ""
    if [ -e /etc/sysconfig/i18n ];then
        default_LANG="$(grep "LANG=" /etc/sysconfig/i18n | grep -v "^#"
 
 | awk -F '"' '{print $2}')"
    else
        default_LANG=$LANG
    fi
    export LANG="en_US.UTF-8"
    Release=$(cat /etc/redhat-release 2>/dev/null)
    Kernel=$(uname -r)
    OS=$(uname -o)
    Hostname=$(uname -n)
    SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}')
    LastReboot=$(who -b | awk '{print $3,$4}')
    uptime=$(uptime | sed 's/.*up \([^,]*\), .*/\1/')
    echo "     系統：$OS"
    echo " 發行版本：$Release"
    echo "     核心：$Kernel"
    echo "   主機名：$Hostname"
    echo "  SELinux：$SELinux"
    echo "語言/編碼：$default_LANG"
    echo " 掃描時間：$(date +'%F %T')"
    echo " 最後啟動：$LastReboot"
    echo " 執行時間：$uptime"
    export LANG="$default_LANG"
}

bk_safe(){
  echo ""
  echo -e "\033[33m********************************Linux主機安全基線檢查***********************************\033[0m"

  
  echo "" >> ${scanner_log}
  echo "***********************`hostname -s` 主機安全檢查結果********************************"  >> ${scanner_log}
  getSystemStatus >> ${scanner_log}
 

  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`賬號策略檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[1] 賬號策略檢查中..." /bin/true
  
  passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'`
  passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'`
  passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'`
  passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`

  if [ $passmax -le 90 -a $passmax -gt 0 ];then
    echo "[Y] 口令生存週期為${passmax}天，符合要求" >> ${scanner_log}
  else
    echo "[N] 口令生存週期為${passmax}天，不符合要求,建議設定不大於90天" >> ${scanner_log}
  fi

  if [ $passmin -ge 6 ];then
    echo "[Y] 口令更改最小時間間隔為${passmin}天，符合要求" >> ${scanner_log}
  else
    echo "[N] 口令更改最小時間間隔為${passmin}天，不符合要求，建議設定大於等於6天" >> ${scanner_log}
  fi

  if [ $passlen -ge 8 ];then
    echo "[Y] 口令最小長度為${passlen},符合要求" >> ${scanner_log}
  else
    echo "[N] 口令最小長度為${passlen},不符合要求，建議設定最小長度大於等於8" >> ${scanner_log}
  fi
 
  if [ $passage -ge 30 -a $passage -lt $passmax ];then
    echo "[Y] 口令過期警告時間天數為${passage},符合要求" >> ${scanner_log}
  else
    echo "[N] 口令過期警告時間天數為${passage},不符合要求，建議設定大於等於30並小於口令生存週期" >> ${scanner_log}
  fi

  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`登入超時檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  
  action "[2] 登入超時檢查中..." /bin/true

  checkTimeout=$(cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}')
  if [ $? -eq 0 ];then
    TMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'`
    if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];then
      echo "[Y] 賬號超時的時間是${TMOUT}秒,符合要求" >> ${scanner_log}
    else
      echo "[N] 賬號超時的時間是${TMOUT}秒,不符合要求，建議設定小於600秒">> ${scanner_log}
    fi
  else
    echo "[N] 賬號超時不存在自動登出,不符合要求，建議設定小於600秒" >> ${scanner_log}
  fi
  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`特權使用者檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  
  action "[3] 特權使用者檢查中..." /bin/true
  UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd`
  flag=0
  for i in $UIDS
  do
    if [ $i = 0 ];then
       flag=1
    fi
  done
  if [ $flag != 1 ];then
    echo "[Y] 不存在root賬號外的UID為0的異常使用者" >> ${scanner_log}
  else
    echo "[N] 存在非root但UID為0的異常使用者，請立刻進行排查" >> ${scanner_log}
  fi
  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`空登入口令使用者檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[4] 空登入口令使用者檢查中..." /bin/true
  
  userlist=`awk -F: 'length($2)==0 {print $1}' /etc/shadow`
  [ ! $userlist ] && echo "[Y] 不存在空登入口令使用者"  >> ${scanner_log}
  for i in $userlist
  do
    echo "[N] $i登入密碼為空，不符合要求，建議為該使用者設定密碼！"  >> ${scanner_log}
  done

  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`具有sudo許可權使用者檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  
  action "[5] sudo許可權使用者檢查中..." /bin/true

  sudolist=`cat /etc/sudoers |grep -v '^#' |grep -v Defaults| grep -v '^$'`
  echo "$sudolist"  >> ${scanner_log}

  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`使用者預設許可權檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[6] 使用者預設許可權檢查中..." /bin/true

  umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'`
  umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'`
  umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'`
  flags=0
  for i in $umask1
  do
    if [ $i != "027" ];then
      echo "[N] /etc/profile檔案中所所設定的umask為${i},不符合要求，建議設定為027" >> ${scanner_log}
      flags=1
      break
    fi
  done
  if [ $flags == 0 ];then
    echo "[Y] /etc/profile檔案中所設定的umask為${i},符合要求" >> ${scanner_log}
  fi 
  
  flags=0
  for i in $umask2
  do
    if [ $i != "027" ];then
      echo "[N] /etc/csh.cshrc檔案中所所設定的umask為${i},不符合要求，建議設定為027" >> ${scanner_log}
      flags=1
      break
    fi
  done  
  if [ $flags == 0 ];then
    echo "[Y] /etc/csh.cshrc檔案中所設定的umask為${i},符合要求" >> ${scanner_log}
  fi
  flags=0
  for i in $umask3
  do
    if [ $i != "027" ];then
      echo "[N] /etc/bashrc檔案中所設定的umask為${i},不符合要求，建議設定為027" >> ${scanner_log}
      flags=1
      break
    fi
  done
  if [ $flags == 0 ];then
    echo "[Y] /etc/bashrc檔案中所設定的umask為${i},符合要求" >> ${scanner_log}
  fi
  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`系統關鍵目錄許可權檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[7] 系統關鍵目錄許可權檢查中..." /bin/true

  file1=`ls -l /etc/passwd | awk '{print $1}'`
  file2=`ls -l /etc/shadow | awk '{print $1}'`
  file3=`ls -l /etc/group | awk '{print $1}'`
  file4=`ls -l /etc/securetty | awk '{print $1}'`
  file5=`ls -l /etc/services | awk '{print $1}'`

  #檢測檔案許可權為400的檔案
  if [ $file2 = "-r--------" ];then
    echo "[Y] /etc/shadow檔案許可權為400，符合要求" >> ${scanner_log}
  else
    echo "[N] /etc/shadow檔案許可權不為400，不符合要求，建議設定許可權為400" >> ${scanner_log}
  fi
  #檢測檔案許可權為600的檔案
  if [ $file4 = "-rw-------" ];then
    echo "[Y] /etc/security檔案許可權為600，符合要求" >> ${scanner_log}
  else
    echo "[N] /etc/security檔案許可權不為600，不符合要求，建議設定許可權為600" >> ${scanner_log}
  fi

  #檢測檔案許可權為644的檔案
  if [ $file1 = "-rw-r--r--" ];then
    echo "[Y] /etc/passwd檔案許可權為644，符合要求" >> ${scanner_log}
  else
    echo "[N] /etc/passwd檔案許可權不為644，不符合要求，建議設定許可權為644" >> ${scanner_log}
  fi
  if [ $file5 = "-rw-r--r--" ];then
    echo "[Y] /etc/services檔案許可權為644，符合要求" >> ${scanner_log}
  else
    echo "[N] /etc/services檔案許可權不為644，不符合要求，建議設定許可權為644" >> ${scanner_log}
  fi
  if [ $file3 = "-rw-r--r--" ];then
    echo "[Y] /etc/group檔案許可權為644，符合要求" >> ${scanner_log}
  else
    echo "[N] /etc/group檔案許可權不為644，不符合要求，建議設定許可權為644" >> ${scanner_log}
  fi
  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`SSH配置檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[8] ssh配置檢查中..." /bin/true
  
  remoteLogin=$(cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no")
  if [ $? -eq 0 ];then
    echo "[Y] 已經設定root不能遠端登陸，符合要求" >> ${scanner_log}
  else
    echo "[N] 已經設定root能遠端登陸，不符合要求，建議/etc/ssh/sshd_config新增PermitRootLogin no引數" >> ${scanner_log}
  fi


  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`ping服務檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[9] 系統ping服務檢查中..." /bin/true
  
  pingd=`cat /proc/sys/net/ipv4/icmp_echo_ignore_all`
  if [ "$pingd" = "1" ]; then
    echo "[Y] 伺服器已禁ping" >> ${scanner_log}
  else
    echo "[N] 伺服器未禁ping" >> ${scanner_log}
  fi

  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`telnet服務檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[10] 系統telnet服務檢查中..." /bin/true
  
  telnetd=`rpm -qa|grep telnet | wc -l`
  if [ $telnetd = "0" ]; then
    echo "[Y] 系統未安裝telnet服務 " >> ${scanner_log}
  else
	echo "[N] 檢測到安裝了telnet服務，不符合要求，建議禁用telnet服務" >> ${scanner_log}
  fi


  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`遠端連線的安全性配置檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[11] 遠端連線的安全性配置檢查中..." /bin/true

  fileNetrc=`find / -xdev -mount -name .netrc -print 2> /dev/null`
  if [  -z "${fileNetrc}" ];then
    echo "[Y] 不存在.netrc檔案，符合要求" >> ${scanner_log}
  else
    echo "[N] 存在.netrc檔案，不符合要求" >> ${scanner_log}
  fi
  fileRhosts=`find / -xdev -mount -name .rhosts -print 2> /dev/null`
  if [ -z "$fileRhosts" ];then
    echo "[Y] 不存在.rhosts檔案，符合要求" >> ${scanner_log}
  else
    echo "[N] 存在.rhosts檔案，不符合要求" >> ${scanner_log}
  fi


  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`異常隱含檔案檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[12] 異常隱含檔案檢查中..." /bin/true

  hideFile=$(find / -xdev -mount \( -name "..*" -o -name "...*" \) 2> /dev/null)
  if [  -z "${hideFile}" ];then
    echo "[Y] 不存在隱藏檔案，符合要求" >> ${scanner_log}
  else
    echo "[N] 存在隱藏檔案，建議仔細檢查：" >> ${scanner_log}
	for i in ${hideFile}
	do
	 echo $i >> ${scanner_log}
	done
  fi  

  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`syslog登入事件檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[13] syslog登入事件檢查中..." /bin/true
  
  if [  -f "/etc/syslog.conf" ];then
    logFile=$(cat /etc/syslog.conf | grep -V ^# | grep authpriv.*)
    if [ ! -z "${logFile}" ];then
      echo "[Y] 存在儲存authpirv的日誌檔案" >> ${scanner_log}
    else
      echo "[N] 不存在儲存authpirv的日誌檔案" >> ${scanner_log}
    fi
  else
    echo "[N] 不存在／etc/syslog.conf檔案，建議對所有登入事件都記錄" >> ${scanner_log}
  fi  
  
  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`日誌稽核功能檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[14] 日誌稽核功能檢查中..." /bin/true
  
  auditdStatus=$(service auditd status 2> /dev/null)
  if [ $? = 0 ];then
    echo "[Y] 系統日誌稽核功能已開啟，符合要求" >> ${scanner_log}
  fi
  if [ $? = 3 ];then
    echo "[N] 系統日誌稽核功能已關閉，不符合要求，建議service auditd start開啟" >> ${scanner_log}
  fi


  echo "" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  echo "`hostname -s`系統core dump狀態檢查結果" >> ${scanner_log}
  echo "****************************************************" >> ${scanner_log}
  action "[15] 系統core dump狀態檢查中..." /bin/true
  
  limitsFile=$(cat /etc/security/limits.conf | grep -V ^# | grep core)
  if [ $? -eq 0 ];then
    soft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`
    for i in $soft
    do
      if [ "$i"x = "soft"x ];then
        echo "[Y] * soft core 0 已經設定" >> ${scanner_log}
      fi
      if [ "$i"x = "hard"x ];then
        echo "[Y] * hard core 0 已經設定" >> ${scanner_log}
      fi
    done
  else 
    echo "[N] 沒有設定core，建議在/etc/security/limits.conf中新增* soft core 0和* hard core 0" >> ${scanner_log}
  fi
  
  echo ""
  cat  ${scanner_log}
  echo ""
  echo ""
  echo -e "\033[36m輸出結果"$scanner_log" \033[0m"
  echo ""
}

bk_safe