本篇內(nèi)容主要講解“l(fā)inux的基線檢查腳本”,感興趣的朋友不妨來(lái)看看。本文介紹的方法操作簡(jiǎn)單快捷,實(shí)用性強(qiáng)。下面就讓小編來(lái)帶大家學(xué)習(xí)“l(fā)inux的基線檢查腳本”吧!
成都創(chuàng)新互聯(lián)公司專注為客戶提供全方位的互聯(lián)網(wǎng)綜合服務(wù),包含不限于網(wǎng)站設(shè)計(jì)制作、做網(wǎng)站、高港網(wǎng)絡(luò)推廣、重慶小程序開(kāi)發(fā)、高港網(wǎng)絡(luò)營(yíng)銷、高港企業(yè)策劃、高港品牌公關(guān)、搜索引擎seo、人物專訪、企業(yè)宣傳片、企業(yè)代運(yùn)營(yíng)等,從售前售中售后,我們都將竭誠(chéng)為您服務(wù),您的肯定,是我們最大的嘉獎(jiǎng);成都創(chuàng)新互聯(lián)公司為所有大學(xué)生創(chuàng)業(yè)者提供高港建站搭建服務(wù),24小時(shí)服務(wù)熱線:028-86922220,官方網(wǎng)址:jinyejixie.com
#! /bin/bash #vesion 1.0 #author by (魔法劍客) ipadd=`ifconfig -a | grep Bcast | awk -F "[ :]+" '{print $4}' | tr "\n" "_"` cat <<EOF ************************************************************************************* ***** linux基線檢查腳本 ***** ***** Author(魔法劍客) ***** ************************************************************************************* ***** linux基線配置規(guī)范設(shè)計(jì) ***** ***** 輸出結(jié)果"/tmp/${ipadd}_checkResult.txt" ***** ************************************************************************************* EOF echo "IP: ${ipadd}" >> "/tmp/${ipadd}_checkResult.txt" user_id=`whoami` echo "當(dāng)前掃描用戶:${user_id}" >> "/tmp/${ipadd}_checkResult.txt" scanner_time=`date '+%Y-%m-%d %H:%M:%S'` echo "當(dāng)前掃描時(shí)間:${scanner_time}" >> "/tmp/${ipadd}_checkResult.txt" echo "***************************" echo "賬號(hào)策略檢查中..." echo "***************************" #編號(hào):SBL-Linux-02-01-01 #項(xiàng)目:帳號(hào)與口令-用戶口令設(shè)置 #合格:Y;不合格:N #不合格地方 passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'` passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'` passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'` passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'` echo "SBL-Linux-02-01-01:" >> "/tmp/${ipadd}_checkResult.txt" if [ $passmax -le 90 -a $passmax -gt 0 ];then echo "Y:口令生存周期為${passmax}天,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:口令生存周期為${passmax}天,不符合要求,建議設(shè)置不大于90天" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $passmin -ge 6 ];then echo "Y:口令更改最小時(shí)間間隔為${passmin}天,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:口令更改最小時(shí)間間隔為${passmin}天,不符合要求,建議設(shè)置大于等于6天" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $passlen -ge 8 ];then echo "Y:口令最小長(zhǎng)度為${passlen},符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:口令最小長(zhǎng)度為${passlen},不符合要求,建議設(shè)置最小長(zhǎng)度大于等于8" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $passage -ge 30 -a $passage -lt $passmax ];then echo "Y:口令過(guò)期警告時(shí)間天數(shù)為${passage},符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:口令過(guò)期警告時(shí)間天數(shù)為${passage},不符合要求,建議設(shè)置大于等于30并小于口令生存周期" >> /"/tmp/${ipadd}_checkResult.txt" fi echo "***************************" echo "賬號(hào)是否會(huì)主動(dòng)注銷檢查中..." echo "***************************" checkTimeout=$(cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}') if [ $? -eq 0 ];then TMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'` if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];then echo "Y:賬號(hào)超時(shí)時(shí)間${TMOUT}秒,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:賬號(hào)超時(shí)時(shí)間${TMOUT}秒,不符合要求,建議設(shè)置小于600秒" >> "/tmp/${ipadd}_checkResult.txt" fi else echo "N:賬號(hào)超時(shí)不存在自動(dòng)注銷,不符合要求,建議設(shè)置小于600秒" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-02 #項(xiàng)目:帳號(hào)與口令-root用戶遠(yuǎn)程登錄限制 #合格:Y;不合格:N #不合格地方 echo "***************************" echo "檢查root用戶是否能遠(yuǎn)程登錄限制..." echo "***************************" echo "SBL-Linux-02-01-02:" >> "/tmp/${ipadd}_checkResult.txt" remoteLogin=$(cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no") if [ $? -eq 0 ];then echo "Y:已經(jīng)設(shè)置遠(yuǎn)程root不能登陸,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:已經(jīng)設(shè)置遠(yuǎn)程root能登陸,不符合要求,建議/etc/ssh/sshd_config添加PermitRootLogin no" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-03 #項(xiàng)目:帳號(hào)與口令-檢查是否存在除root之外UID為0的用戶 #合格:Y;不合格:N #不合格地方 #查找非root賬號(hào)UID為0的賬號(hào) echo "SBL-Linux-02-01-03:" >> "/tmp/${ipadd}_checkResult.txt" UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd` flag=0 for i in $UIDS do if [ $i = 0 ];then echo "N:存在非root賬號(hào)的賬號(hào)UID為0,不符合要求" >> "/tmp/${ipadd}_checkResult.txt" else flag=1 fi done if [ $flag = 1 ];then echo "Y:不存在非root賬號(hào)的賬號(hào)UID為0,符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-04 #項(xiàng)目:帳號(hào)與口令-檢查telnet服務(wù)是否開(kāi)啟 #合格:Y;不合格:N #不合格地方 #檢查telnet是否開(kāi)啟 echo "SBL-Linux-02-01-04:" >> "/tmp/${ipadd}_checkResult.txt" telnetd=`cat /etc/xinetd.d/telnet | grep disable | awk '{print $3}'` if [ "$telnetd"x = "yes"x ]; then echo "N:檢測(cè)到telnet服務(wù)開(kāi)啟,不符合要求,建議關(guān)閉telnet" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-05 #項(xiàng)目:帳號(hào)與口令-root用戶環(huán)境變量的安全性 #合格:Y;不合格:N #不合格地方 #檢查目錄權(quán)限是否為777 echo "SBL-Linux-02-01-05:" >> "/tmp/${ipadd}_checkResult.txt" dirPri=$(find $(echo $PATH | tr ':' ' ') -type d \( -perm -0777 \) 2> /dev/null) if [ -z "$dirPri" ] then echo "Y:目錄權(quán)限無(wú)777的,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:文件${dirPri}目錄權(quán)限為777的,不符合要求。" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-06 #項(xiàng)目:帳號(hào)與口令-遠(yuǎn)程連接的安全性配置 #合格:Y;不合格:N #不合格地方 echo "SBL-Linux-02-01-06:" >> "/tmp/${ipadd}_checkResult.txt" fileNetrc=`find / -xdev -mount -name .netrc -print 2> /dev/null` if [ -z "${fileNetrc}" ];then echo "Y:不存在.netrc文件,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:存在.netrc文件,不符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi fileRhosts=`find / -xdev -mount -name .rhosts -print 2> /dev/null` if [ -z "$fileRhosts" ];then echo "Y:不存在.rhosts文件,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:存在.rhosts文件,不符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-07 #項(xiàng)目:帳號(hào)與口令-用戶的umask安全配置 #合格:Y;不合格:N #不合格地方 #檢查umask設(shè)置 echo "SBL-Linux-02-01-07:" >> "/tmp/${ipadd}_checkResult.txt" umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'` umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'` umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'` flags=0 for i in $umask1 do if [ $i != "027" ];then echo "N:/etc/profile文件中所所設(shè)置的umask為${i},不符合要求,建議設(shè)置為027" >> "/tmp/${ipadd}_checkResult.txt" flags=1 break fi done if [ $flags == 0 ];then echo "Y:/etc/profile文件中所設(shè)置的umask為${i},符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi flags=0 for i in $umask2 do if [ $i != "027" ];then echo "N:/etc/csh.cshrc文件中所所設(shè)置的umask為${i},不符合要求,建議設(shè)置為027" >> "/tmp/${ipadd}_checkResult.txt" flags=1 break fi done if [ $flags == 0 ];then echo "Y:/etc/csh.cshrc文件中所設(shè)置的umask為${i},符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi flags=0 for i in $umask3 do if [ $i != "027" ];then echo "N:/etc/bashrc文件中所設(shè)置的umask為${i},不符合要求,建議設(shè)置為027" >> "/tmp/${ipadd}_checkResult.txt" flags=1 break fi done if [ $flags == 0 ];then echo "Y:/etc/bashrc文件中所設(shè)置的umask為${i},符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-01-08 #項(xiàng)目:帳號(hào)與口令-grub和lilo密碼是否設(shè)置檢查 #合格:Y;不合格:N #不合格地方 #grub和lilo密碼是否設(shè)置檢查 echo "SBL-Linux-02-01-08:" >> "/tmp/${ipadd}_checkResult.txt" grubfile=$(cat /etc/grub.conf | grep password) if [ $? -eq 0 ];then echo "Y:已設(shè)置grub密碼,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:沒(méi)有設(shè)置grub密碼,不符合要求,建議設(shè)置grub密碼" >> "/tmp/${ipadd}_checkResult.txt" fi lilo=$(cat /etc/lilo.conf | grep password) if [ $? -eq 0 ];then echo "Y:已設(shè)置lilo密碼,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:沒(méi)有設(shè)置lilo密碼,不符合要求,建議設(shè)置lilo密碼" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-02-01 #項(xiàng)目:文件系統(tǒng)-重要目錄和文件的權(quán)限設(shè)置 #合格:Y;不合格:N #不合格地方 echo "SBL-Linux-02-02-01:" >> "/tmp/${ipadd}_checkResult.txt" echo "***************************" echo "檢查重要文件權(quán)限中..." echo "***************************" file1=`ls -l /etc/passwd | awk '{print $1}'` file2=`ls -l /etc/shadow | awk '{print $1}'` file3=`ls -l /etc/group | awk '{print $1}'` file4=`ls -l /etc/securetty | awk '{print $1}'` file5=`ls -l /etc/services | awk '{print $1}'` file6=`ls -l /etc/xinetd.conf | awk '{print $1}'` file7=`ls -l /etc/grub.conf | awk '{print $1}'` file8=`ls -l /etc/lilo.conf | awk '{print $1}'` #檢測(cè)文件權(quán)限為400的文件 if [ $file2 = "-r--------" ];then echo "Y:/etc/shadow文件權(quán)限為400,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/shadow文件權(quán)限不為400,不符合要求,建議設(shè)置權(quán)限為400" >> "/tmp/${ipadd}_checkResult.txt" fi #檢測(cè)文件權(quán)限為600的文件 if [ $file4 = "-rw-------" ];then echo "Y:/etc/security文件權(quán)限為600,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/security文件權(quán)限不為600,不符合要求,建議設(shè)置權(quán)限為600" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $file6 = "-rw-------" ];then echo "Y:/etc/xinetd.conf文件權(quán)限為600,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/xinetd.conf文件權(quán)限不為600,不符合要求,建議設(shè)置權(quán)限為600" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $file7 = "-rw-------" ];then echo "Y:/etc/grub.conf文件權(quán)限為600,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/grub.conf文件權(quán)限不為600,不符合要求,建議設(shè)置權(quán)限為600" >> "/tmp/${ipadd}_checkResult.txt" fi if [ -f /etc/lilo.conf ];then if [ $file8 = "-rw-------" ];then echo "Y:/etc/lilo.conf文件權(quán)限為600,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/lilo.conf文件權(quán)限不為600,不符合要求,建議設(shè)置權(quán)限為600" >> "/tmp/${ipadd}_checkResult.txt" fi else echo "N:/etc/lilo.conf文件夾不存在" fi #檢測(cè)文件權(quán)限為644的文件 if [ $file1 = "-rw-r--r--" ];then echo "Y:/etc/passwd文件權(quán)限為644,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/passwd文件權(quán)限不為644,不符合要求,建議設(shè)置權(quán)限為644" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $file5 = "-rw-r--r--" ];then echo "Y:/etc/services文件權(quán)限為644,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/services文件權(quán)限不為644,不符合要求,建議設(shè)置權(quán)限為644" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $file3 = "-rw-r--r--" ];then echo "Y:/etc/group文件權(quán)限為644,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:/etc/group文件權(quán)限不為644,不符合要求,建議設(shè)置權(quán)限為644" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-02-02 #項(xiàng)目:文件系統(tǒng)-查找未授權(quán)的SUID/SGID文件 #合格:Y;不合格:N #不合格地方 echo "SBL-Linux-02-02-02:" >> "/tmp/${ipadd}_checkResult.txt" unauthorizedfile=`find / \( -perm -04000 -o -perm -02000 \) -type f ` echo "C:文件${unauthorizedfile}設(shè)置了SUID/SGID,請(qǐng)檢查是否授權(quán)" >> "/tmp/${ipadd}_checkResult.txt" #編號(hào):SBL-Linux-02-02-03 #項(xiàng)目:文件系統(tǒng)-檢查任何人都有寫權(quán)限的目錄 #合格:Y;不合格:N;檢查:C #不合格地方 echo "SBL-Linux-02-02-03:" >> "/tmp/${ipadd}_checkResult.txt" checkWriteDre=$(find / -xdev -mount -type d \( -perm -0002 -a ! -perm -1000 \) 2> /dev/null) if [ -z "${checkWriteDre}" ];then echo "Y:不存在任何人都有寫權(quán)限的目錄,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:${checkWriteDre}目錄任何人都可以寫,不符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-02-04 #項(xiàng)目:文件系統(tǒng)-檢查任何人都有寫權(quán)限的文件 #合格:Y;不合格:N;檢查:C #不合格地方 echo "SBL-Linux-02-02-04:" >> "/tmp/${ipadd}_checkResult.txt" checkWriteFile=$(find / -xdev -mount -type f \( -perm -0002 -a ! -perm -1000 \) 2> /dev/null) if [ -z "${checkWriteFile}" ];then echo "Y:不存在任何人都有寫權(quán)限的目錄,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:${checkWriteFile}目錄任何人都可以寫,不符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-02-02-05 #項(xiàng)目:文件系統(tǒng)-檢查異常隱含文件 #合格:Y;不合格:N;檢查:C #不合格地方 echo "SBL-Linux-02-02-05:" >> "/tmp/${ipadd}_checkResult.txt" hideFile=$(find / -xdev -mount \( -name "..*" -o -name "...*" \) 2> /dev/null) if [ -z "${hideFile}" ];then echo "Y:不存在隱藏文件,符合要求" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:${hideFile}是隱藏文件,建議審視" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-03-01-01 #項(xiàng)目:日志審計(jì)-syslog登錄事件記錄 #合格:Y;不合格:N;檢查:C #不合格地方 echo "SBL-Linux-03-01-01:" >> "/tmp/${ipadd}_checkResult.txt" recodeFile=$(cat /etc/syslog.conf) if [ ! -z "${recodeFile}" ];then logFile=$(cat /etc/syslog.conf | grep -V ^# | grep authpriv.*) if [ ! -z "${logFile}" ];then echo "Y:存在保存authpirv的日志文件" >> "/tmp/${ipadd}_checkResult.txt" else echo "N:不存在保存authpirv的日志文件" >> "/tmp/${ipadd}_checkResult.txt" fi else echo "N:不存在/etc/syslog.conf文件,建議對(duì)所有登錄事件都記錄" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-03-01-02 #項(xiàng)目:系統(tǒng)文件-檢查日志審核功能是否開(kāi)啟 #合格:Y;不合格:N;檢查:C echo "SBL-Linux-03-01-02:" >> "/tmp/${ipadd}_checkResult.txt" auditdStatus=$(service auditd status 2> /dev/null) if [ $? = 0 ];then echo "Y:系統(tǒng)日志審核功能已開(kāi)啟,符合要求" >> "/tmp/${ipadd}_checkResult.txt" fi if [ $? = 3 ];then echo "N:系統(tǒng)日志審核功能已關(guān)閉,不符合要求,建議service auditd start開(kāi)啟" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-04-01-01 #項(xiàng)目:系統(tǒng)文件-系統(tǒng)core dump狀態(tài) #合格:Y;不合格:N;檢查:C echo "SBL-Linux-04-01-01:" >> "/tmp/${ipadd}_checkResult.txt" limitsFile=$(cat /etc/security/limits.conf | grep -V ^# | grep core) if [ $? -eq 0 ];then soft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}` for i in $soft do if [ "$i"x = "soft"x ];then echo "Y:* soft core 0 已經(jīng)設(shè)置" >> "/tmp/${ipadd}_checkResult.txt" fi if [ "$i"x = "hard"x ];then echo "Y:* hard core 0 已經(jīng)設(shè)置" >> "/tmp/${ipadd}_checkResult.txt" fi done else echo "N:沒(méi)有設(shè)置core,建議在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> "/tmp/${ipadd}_checkResult.txt" fi #編號(hào):SBL-Linux-04-01-02 #項(xiàng)目:系統(tǒng)文件-檢查磁盤動(dòng)態(tài)空間,是否大于等于80% #合格:Y;不合格:N;檢查:C # echo "SBL-Linux-04-01-02:" >> "/tmp/${ipadd}_checkResult.txt" space=$(df -h | awk -F "[ %]+" 'NR!=1{print $5}') for i in $space do if [ $i -ge 80 ];then echo "C:警告!磁盤存儲(chǔ)容量大于80%,建議擴(kuò)充磁盤容量或者刪除垃圾文件" >> "/tmp/${ipadd}_checkResult.txt" fi done
到此,相信大家對(duì)“l(fā)inux的基線檢查腳本”有了更深的了解,不妨來(lái)實(shí)際操作一番吧!這里是創(chuàng)新互聯(lián)網(wǎng)站,更多相關(guān)內(nèi)容可以進(jìn)入相關(guān)頻道進(jìn)行查詢,關(guān)注我們,繼續(xù)學(xué)習(xí)!
新聞標(biāo)題:linux的基線檢查腳本
文章源于:http://jinyejixie.com/article14/pgiode.html
成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián),為您提供外貿(mào)網(wǎng)站建設(shè)、網(wǎng)站導(dǎo)航、標(biāo)簽優(yōu)化、網(wǎng)站制作、企業(yè)網(wǎng)站制作、品牌網(wǎng)站制作
聲明:本網(wǎng)站發(fā)布的內(nèi)容(圖片、視頻和文字)以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主,如果涉及侵權(quán)請(qǐng)盡快告知,我們將會(huì)在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng),如需處理請(qǐng)聯(lián)系客服。電話:028-86922220;郵箱:631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載,或轉(zhuǎn)載時(shí)需注明來(lái)源: 創(chuàng)新互聯(lián)