分享一个实用脚本——Linux主机15条安全基线检查

今天主要分享一个Linux主机安全基线脚本，仅供参考。
#! /bin/bash linux主机安全基线检查# copyright by hwb# date:2020-12-17scanner_time=`date '+%Y-%m-%d_%H:%M:%S'`scanner_log="/tmp/checkResult_${scanner_time}.log"uptime=$(uptime | sed 's/.*up \(*\), .*/\1/')#调用函数库&& source /etc/init.d/functionsexport PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/binsource /etc/profile#Require root to run this script.&& echo "请用root用户执行此脚本！" && exit 1#报错日志记录|| touch ${scanner_log}function getSystemStatus{echo ""if ;thendefault_LANG="$(grep "LANG=" /etc/sysconfig/i18n | grep -v "^#" | awk -F '"' '{print $2}')"elsedefault_LANG=$LANGfiexport LANG="en_US.UTF-8"Release=$(cat /etc/redhat-release 2>/dev/null)Kernel=$(uname -r)OS=$(uname -o)Hostname=$(uname -n)SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}')LastReboot=$(who -b | awk '{print $3,$4}')uptime=$(uptime | sed 's/.*up \(*\), .*/\1/')echo " 系统：$OS"echo " 发行版本：$Release"echo " 内核：$Kernel"echo " 主机名：$Hostname"echo " SELinux：$SELinux"echo "语言/编码：$default_LANG"echo " 扫描时间：$(date +'%F %T')"echo " 最后启动：$LastReboot"echo " 运行时间：$uptime"export LANG="$default_LANG"}bk_safe{echo ""echo -e "\033[33mLinux主机安全基线检查033[0m"echo ""echo -e "\033[36m 输出结果"/tmp/bk_safe_$scanner_time.txt" \033[0m"echo ""echo "" >> ${scanner_log}echo hostname -s` 主机安全检查结果 >> ${scanner_log}getSystemStatus >> ${scanner_log}echo "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`账号策略检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 账号策略检查中..." /bin/truepassmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'`passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'`passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'`passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`if ;thenecho " 口令生存周期为${passmax}天，符合要求" >> ${scanner_log}elseecho " 口令生存周期为${passmax}天，不符合要求,建议设置不大于90天" >> ${scanner_log}fiif ;thenecho " 口令更改最小时间间隔为${passmin}天，符合要求" >> ${scanner_log}elseecho " 口令更改最小时间间隔为${passmin}天，不符合要求，建议设置大于等于6天" >> ${scanner_log}fiif ;thenecho " 口令最小长度为${passlen},符合要求" >> ${scanner_log}elseecho " 口令最小长度为${passlen},不符合要求，建议设置最小长度大于等于8" >> ${scanner_log}fiif ;thenecho " 口令过期警告时间天数为${passage},符合要求" >> ${scanner_log}elseecho " 口令过期警告时间天数为${passage},不符合要求，建议设置大于等于30并小于口令生存周期" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`登录超时检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 登录超时检查中..." /bin/truecheckTimeout=$(cat /etc/profile | grep TMOUT | awk -F '{print $2}')if ;thenTMOUT=`cat /etc/profile | grep TMOUT | awk -F '{print $2}'`if ;thenecho " 账号超时时间${TMOUT}秒,符合要求" >> ${scanner_log}elseecho " 账号超时时间${TMOUT}秒,不符合要求，建议设置小于600秒">> ${scanner_log}fielseecho " 账号超时不存在自动注销,不符合要求，建议设置小于600秒" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`特权用户检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 特权用户检查中..." /bin/trueUIDS=`awk -F 'NR!=1{print $3}' /etc/passwd`flag=0for i in $UIDSdoif ;thenflag=1fidoneif ;thenecho " 不存在root账号外的UID为0的异常用户" >> ${scanner_log}elseecho " 存在非root但UID为0的异常用户，请立刻进行排查" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`空登录口令用户检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 空登录口令用户检查中..." /bin/trueuserlist=`awk -F: 'length($2)==0 {print $1}' /etc/shadow`&& echo " 不存在空登录口令用户" >> ${scanner_log}for i in $userlistdoecho " $i登录密码为空，不符合要求，建议为该用户设置密码！" >> ${scanner_log}doneecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`具有sudo权限用户检查结果" >> ${scanner_log}echo >> ${scanner_log}action " sudo权限用户检查中..." /bin/truesudolist=`cat /etc/sudoers |grep -v '^#' |grep -v Defaults| grep -v '^$'`echo "$sudolist" >> ${scanner_log}echo "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`用户缺省权限检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 用户缺省权限检查中..." /bin/trueumask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'`umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'`umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'`flags=0for i in $umask1doif ;thenecho " /etc/profile文件中所所设置的umask为${i},不符合要求，建议设置为027" >> ${scanner_log}flags=1breakfidoneif ;thenecho " /etc/profile文件中所设置的umask为${i},符合要求" >> ${scanner_log}fi flags=0for i in $umask2doif ;thenecho " /etc/csh.cshrc文件中所所设置的umask为${i},不符合要求，建议设置为027" >> ${scanner_log}flags=1breakfidone if ;thenecho " /etc/csh.cshrc文件中所设置的umask为${i},符合要求" >> ${scanner_log}fiflags=0for i in $umask3doif ;thenecho " /etc/bashrc文件中所设置的umask为${i},不符合要求，建议设置为027" >> ${scanner_log}flags=1breakfidoneif ;thenecho " /etc/bashrc文件中所设置的umask为${i},符合要求" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`系统关键目录权限检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 系统关键目录权限检查中..." /bin/truefile1=`ls -l /etc/passwd | awk '{print $1}'`file2=`ls -l /etc/shadow | awk '{print $1}'`file3=`ls -l /etc/group | awk '{print $1}'`file4=`ls -l /etc/securetty | awk '{print $1}'`file5=`ls -l /etc/services | awk '{print $1}'`#检测文件权限为400的文件if ;thenecho " /etc/shadow文件权限为400，符合要求" >> ${scanner_log}elseecho " /etc/shadow文件权限不为400，不符合要求，建议设置权限为400" >> ${scanner_log}fi#检测文件权限为600的文件if ;thenecho " /etc/security文件权限为600，符合要求" >> ${scanner_log}elseecho " /etc/security文件权限不为600，不符合要求，建议设置权限为600" >> ${scanner_log}fi#检测文件权限为644的文件if ;thenecho " /etc/passwd文件权限为644，符合要求" >> ${scanner_log}elseecho " /etc/passwd文件权限不为644，不符合要求，建议设置权限为644" >> ${scanner_log}fiif ;thenecho " /etc/services文件权限为644，符合要求" >> ${scanner_log}elseecho " /etc/services文件权限不为644，不符合要求，建议设置权限为644" >> ${scanner_log}fiif ;thenecho " /etc/group文件权限为644，符合要求" >> ${scanner_log}elseecho " /etc/group文件权限不为644，不符合要求，建议设置权限为644" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`SSH配置检查结果" >> ${scanner_log}echo >> ${scanner_log}action " ssh配置检查中..." /bin/trueremoteLogin=$(cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no")if ;thenecho " 已经设置root不能远程登陆，符合要求" >> ${scanner_log}elseecho " 已经设置root能远程登陆，不符合要求，建议/etc/ssh/sshd_config添加PermitRootLogin no参数" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`ping服务检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 系统ping服务检查中..." /bin/truepingd=`cat /proc/sys/net/ipv4/icmp_echo_ignore_all`if ; thenecho " 服务器已禁ping" >> ${scanner_log}elseecho " 服务器未禁ping" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`telnet服务检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 系统telnet服务检查中..." /bin/truetelnetd=`rpm -qa|grep telnet | wc -l`if ; thenecho " 系统未安装telnet服务 " >> ${scanner_log}else echo " 检测到安装了telnet服务，不符合要求，建议禁用telnet服务" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`远程连接的安全性配置检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 远程连接的安全性配置检查中..." /bin/truefileNetrc=`find / -xdev -mount -name .netrc -print 2> /dev/null`if ;thenecho " 不存在.netrc文件，符合要求" >> ${scanner_log}elseecho " 存在.netrc文件，不符合要求" >> ${scanner_log}fifileRhosts=`find / -xdev -mount -name .rhosts -print 2> /dev/null`if ;thenecho " 不存在.rhosts文件，符合要求" >> ${scanner_log}elseecho " 存在.rhosts文件，不符合要求" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`异常隐含文件检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 异常隐含文件检查中..." /bin/truehideFile=$(find / -xdev -mount \( -name "..*" -o -name "...*" \) 2> /dev/null)if ;thenecho " 不存在隐藏文件，符合要求" >> ${scanner_log}elseecho " 存在隐藏文件，建议仔细检查：" >> ${scanner_log} for i in ${hideFile} do echo $i >> ${scanner_log} donefi echo "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`syslog登录事件检查结果" >> ${scanner_log}echo >> ${scanner_log}action " syslog登录事件检查中..." /bin/trueif ;thenlogFile=$(cat /etc/syslog.conf | grep -V ^# | grep authpriv.*)if ;thenecho " 存在保存authpirv的日志文件" >> ${scanner_log}elseecho " 不存在保存authpirv的日志文件" >> ${scanner_log}fielseecho " 不存在／etc/syslog.conf文件，建议对所有登录事件都记录" >> ${scanner_log}fi echo "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`日志审核功能检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 日志审核功能检查中..." /bin/trueauditdStatus=$(service auditd status 2> /dev/null)if ;thenecho " 系统日志审核功能已开启，符合要求" >> ${scanner_log}fiif ;thenecho " 系统日志审核功能已关闭，不符合要求，建议service auditd start开启" >> ${scanner_log}fiecho "" >> ${scanner_log}echo >> ${scanner_log}echo "`hostname -s`系统core dump状态检查结果" >> ${scanner_log}echo >> ${scanner_log}action " 系统core dump状态检查中..." /bin/truelimitsFile=$(cat /etc/security/limits.conf | grep -V ^# | grep core)if ;thensoft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`for i in $softdoif ;thenecho " * soft core 0 已经设置" >> ${scanner_log}fiif ;thenecho " * hard core 0 已经设置" >> ${scanner_log}fidoneelse echo " 没有设置core，建议在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> ${scanner_log}fiecho ""cat ${scanner_log}echo ""}bk_safe