SECURITY-linux安全基线检查脚本

#! /bin/bash @H_450_4@#vesion 1.1 20190505 @H_450_4@#author by (jxwpX)

ipadd=ifconfig -a | grep Bcast | awk -F "[ :]+" ‘{print $4}‘ | tr "\n" "_"@H_450_4@cat <<EOF

linux基线检查脚本 @H_450_4@ Author(jxwpX)

linux基线配置规范设计 @H_450_4@ 输出结果"/tmp/${ipadD}_checkResult.txt"

EOF

echo "IP: ${ipadD}" >> "/tmp/${ipadD}_checkResult.txt"

user_id=whoami@H_450_4@echo "当前扫描用户：${user_iD}" >> "/tmp/${ipadD}_checkResult.txt"

scAnner_time=date ‘+%Y-%m-%d %H:%M:%s‘@H_450_4@echo "当前扫描时间：${scAnner_timE}" >> "/tmp/${ipadD}_checkResult.txt"

echo ""@H_450_4@echo "账号策略检查中..."@H_450_4@echo ""

#编号：GOOAnn-Linux-02-01-01 @H_450_4@#项目：帐号与口令-用户口令设置@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方

passmax=cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk ‘{print $2}‘@H_450_4@passmin=cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk ‘{print $2}‘@H_450_4@passlen=cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk ‘{print $2}‘@H_450_4@passage=cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk ‘{print $2}‘

echo "GOOAnn-Linux-02-01-01:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@if [ $passmax -le 90 -a $passmax -gt 0 ];then@H_450_4@echo "Y:口令生存周期为${passmax}天，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:口令生存周期为${passmax}天，不符合要求,建议设置不大于90天" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

if [ $passmin -ge 6 ];then@H_450_4@echo "Y:口令更改最小时间间隔为${passmin}天，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:口令更改最小时间间隔为${passmin}天，不符合要求，建议设置大于等于6天" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

if [ $passlen -ge 8 ];then@H_450_4@echo "Y:口令最小长度为${passlen},符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:口令最小长度为${passlen},不符合要求，建议设置最小长度大于等于8" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

if [ $passage -ge 30 -a $passage -lt $passmax ];then@H_450_4@echo "Y:口令过期警告时间天数为${passagE},符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:口令过期警告时间天数为${passagE},不符合要求，建议设置大于等于30并小于口令生存周期" >> /"/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

echo ""@H_450_4@echo "账号是否会主动注销检查中..."@H_450_4@echo ""@H_450_4@checkTimeout=$(cat /etc/profile | grep TMOUT | awk -F[=] ‘{print $2}‘)@H_450_4@if [ $? -eq 0 ];then@H_450_4@TMOUT=cat /etc/profile | grep TMOUT | awk -F[=] ‘{print $2}‘@H_450_4@if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];then@H_450_4@echo "Y:账号超时时间${TMOUT}秒,符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:账号超时时间${TMOUT}秒,不符合要求，建议设置小于600秒" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@else@H_450_4@echo "N:账号超时不存在自动注销,不符合要求，建议设置小于600秒" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

#编号：GOOAnn-Linux-02-01-02 @H_450_4@#项目：帐号与口令-root用户远程登录限制@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方

echo ""@H_450_4@echo "检查root用户是否能远程登录限制..."@H_450_4@echo ""

echo "GOOAnn-Linux-02-01-02:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@remoteLogin=$(cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no")@H_450_4@if [ $? -eq 0 ];then@H_450_4@echo "Y:已经设置远程root不能登陆，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:已经设置远程root能登陆，不符合要求，建议/etc/ssh/sshd_config添加PermitRootLogin no" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-03@H_450_4@#项目：帐号与口令-检查是否存在除root之外UID为0的用户@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@#查找非root账号UID为0的账号@H_450_4@echo "GOOAnn-Linux-02-01-03:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@UIDS=awk -F[:] ‘NR!=1{print $3}‘ /etc/passwd@H_450_4@flag=0@H_450_4@for i in $UIDS@H_450_4@do@H_450_4@if [ $i = 0 ];then@H_450_4@echo "N:存在非root账号的账号UID为0，不符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@flag=1@H_450_4@fi@H_450_4@done@H_450_4@if [ $flag = 1 ];then@H_450_4@echo "Y:不存在非root账号的账号UID为0，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-04@H_450_4@#项目：帐号与口令-检查telnet服务是否开启@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@#检查telnet是否开启@H_450_4@echo "GOOAnn-Linux-02-01-04:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@telnetd=cat /etc/xinetd.d/telnet | grep disable | awk ‘{print $3}‘@H_450_4@if [ "$telnetd"x = "yes"x ]; then@H_450_4@echo "N:检测到telnet服务开启，不符合要求，建议关闭telnet" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-05@H_450_4@#项目：帐号与口令-root用户环境变量的安全性@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@#检查目录权限是否为777@H_450_4@echo "GOOAnn-Linux-02-01-05:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@dirPri=$(find $(echo $PATH | tr ‘:‘ ‘ ‘) -type d ( -perm -0777 ) 2> /dev/null)@H_450_4@if [ -z "$dirPri" ] @H_450_4@then@H_450_4@echo "Y:目录权限无777的,符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:文件${dirPri}目录权限为777的，不符合要求。" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-06@H_450_4@#项目：帐号与口令-远程连接的安全性配置@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-01-06:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fileNetrc=find / -xdev -mount -name .netrc -print 2> /dev/null@H_450_4@if [ -z "${fileNetrc}" ];then@H_450_4@echo "Y:不存在.netrc文件，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:存在.netrc文件，不符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@fileRhosts=find / -xdev -mount -name .rhosts -print 2> /dev/null@H_450_4@if [ -z "$fileRhosts" ];then@H_450_4@echo "Y:不存在.rhosts文件，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:存在.rhosts文件，不符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-07@H_450_4@#项目：帐号与口令-用户的umask安全配置@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@#检查umask设置@H_450_4@echo "GOOAnn-Linux-02-01-07:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@umask1=cat /etc/profile | grep umask | grep -v ^# | awk ‘{print $2}‘@H_450_4@umask2=cat /etc/csh.cshrc | grep umask | grep -v ^# | awk ‘{print $2}‘@H_450_4@umask3=cat /etc/bashrc | grep umask | grep -v ^# | awk ‘NR!=1{print $2}‘@H_450_4@flags=0@H_450_4@for i in $umask1@H_450_4@do@H_450_4@if [ $i != "027" ];then@H_450_4@echo "N:/etc/profile文件中所所设置的umask为${i},不符合要求，建议设置为027" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@flags=1@H_450_4@break@H_450_4@fi@H_450_4@done@H_450_4@if [ $flags == 0 ];then@H_450_4@echo "Y:/etc/profile文件中所设置的umask为${i},符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi @H_450_4@flags=0@H_450_4@for i in $umask2@H_450_4@do@H_450_4@if [ $i != "027" ];then@H_450_4@echo "N:/etc/csh.cshrc文件中所所设置的umask为${i},不符合要求，建议设置为027" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@flags=1@H_450_4@break@H_450_4@fi@H_450_4@done @H_450_4@if [ $flags == 0 ];then@H_450_4@echo "Y:/etc/csh.cshrc文件中所设置的umask为${i},符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@flags=0@H_450_4@for i in $umask3@H_450_4@do@H_450_4@if [ $i != "027" ];then@H_450_4@echo "N:/etc/bashrc文件中所设置的umask为${i},不符合要求，建议设置为027" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@flags=1@H_450_4@break@H_450_4@fi@H_450_4@done@H_450_4@if [ $flags == 0 ];then@H_450_4@echo "Y:/etc/bashrc文件中所设置的umask为${i},符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-01-08@H_450_4@#项目：帐号与口令-grub和lilo密码是否设置检查@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@#grub和lilo密码是否设置检查@H_450_4@echo "GOOAnn-Linux-02-01-08:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@grubfile=$(cat /etc/grub.conf | grep password)@H_450_4@if [ $? -eq 0 ];then@H_450_4@echo "Y:已设置grub密码,符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:没有设置grub密码，不符合要求,建议设置grub密码" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@lilo=$(cat /etc/lilo.conf | grep password)@H_450_4@if [ $? -eq 0 ];then@H_450_4@echo "Y:已设置lilo密码,符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:没有设置lilo密码，不符合要求,建议设置lilo密码" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-02-01@H_450_4@#项目：文件系统-重要目录和文件的权限设置@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-02-01:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@echo ""@H_450_4@echo "检查重要文件权限中..."@H_450_4@echo ""@H_450_4@file1=ls -l /etc/passwd | awk ‘{print $1}‘@H_450_4@file2=ls -l /etc/shadow | awk ‘{print $1}‘@H_450_4@file3=ls -l /etc/group | awk ‘{print $1}‘@H_450_4@file4=ls -l /etc/securetty | awk ‘{print $1}‘@H_450_4@file5=ls -l /etc/services | awk ‘{print $1}‘@H_450_4@file6=ls -l /etc/xinetd.conf | awk ‘{print $1}‘@H_450_4@file7=ls -l /etc/grub.conf | awk ‘{print $1}‘@H_450_4@file8=ls -l /etc/lilo.conf | awk ‘{print $1}‘@H_450_4@#检测文件权限为400的文件@H_450_4@if [ $file2 = "-r--------" ];then@H_450_4@echo "Y:/etc/shadow文件权限为400，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/shadow文件权限不为400，不符合要求，建议设置权限为400" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#检测文件权限为600的文件@H_450_4@if [ $file4 = "-rw-------" ];then@H_450_4@echo "Y:/etc/security文件权限为600，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/security文件权限不为600，不符合要求，建议设置权限为600" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ $file6 = "-rw-------" ];then@H_450_4@echo "Y:/etc/xinetd.conf文件权限为600，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/xinetd.conf文件权限不为600，不符合要求，建议设置权限为600" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ $file7 = "-rw-------" ];then@H_450_4@echo "Y:/etc/grub.conf文件权限为600，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/grub.conf文件权限不为600，不符合要求，建议设置权限为600" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ -f /etc/lilo.conf ];then@H_450_4@if [ $file8 = "-rw-------" ];then@H_450_4@echo "Y:/etc/lilo.conf文件权限为600，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/lilo.conf文件权限不为600，不符合要求，建议设置权限为600" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi

else@H_450_4@echo "N:/etc/lilo.conf文件夹不存在"@H_450_4@fi@H_450_4@#检测文件权限为644的文件@H_450_4@if [ $file1 = "-rw-r--r--" ];then@H_450_4@echo "Y:/etc/passwd文件权限为644，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/passwd文件权限不为644，不符合要求，建议设置权限为644" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ $file5 = "-rw-r--r--" ];then@H_450_4@echo "Y:/etc/services文件权限为644，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/services文件权限不为644，不符合要求，建议设置权限为644" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ $file3 = "-rw-r--r--" ];then@H_450_4@echo "Y:/etc/group文件权限为644，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:/etc/group文件权限不为644，不符合要求，建议设置权限为644" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-02-02-02@H_450_4@#项目：文件系统-查找未授权的SUID/SGID文件@H_450_4@#合格：Y;不合格：N@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-02-02:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@unauthorizedfile=find / \( -perm -04000 -o -perm -02000 \) -type f@H_450_4@echo "C:文件${unauthorizedfilE}设置了SUID/SGID，请检查是否授权" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@#编号：GOOAnn-Linux-02-02-03@H_450_4@#项目：文件系统-检查任何人都有写权限的目录@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-02-03:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@checkWriteDre=$(find / -xdev -mount -type d ( -perm -0002 -a ! -perm -1000 ) 2> /dev/null)@H_450_4@if [ -z "${checkWriteDrE}" ];then@H_450_4@echo "Y:不存在任何人都有写权限的目录，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:${checkWriteDrE}目录任何人都可以写，不符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi @H_450_4@#编号：GOOAnn-Linux-02-02-04@H_450_4@#项目：文件系统-检查任何人都有写权限的文件@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-02-04:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@checkWriteFile=$(find / -xdev -mount -type f ( -perm -0002 -a ! -perm -1000 ) 2> /dev/null)@H_450_4@if [ -z "${checkWriteFilE}" ];then@H_450_4@echo "Y:不存在任何人都有写权限的目录，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:${checkWriteFilE}目录任何人都可以写，不符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi @H_450_4@#编号：GOOAnn-Linux-02-02-05@H_450_4@#项目：文件系统-检查异常隐含文件@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-02-02-05:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@hideFile=$(find / -xdev -mount ( -name ".." -o -name "..." ) 2> /dev/null)@H_450_4@if [ -z "${hideFilE}" ];then@H_450_4@echo "Y:不存在隐藏文件，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:${hideFilE}是隐藏文件，建议审视" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi @H_450_4@#编号：GOOAnn-Linux-03-01-01 @H_450_4@#项目：日志审计-syslog登录事件记录@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@#不合格地方@H_450_4@echo "GOOAnn-Linux-03-01-01:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@recodeFile=$(cat /etc/syslog.conf)@H_450_4@if [ ! -z "${recodeFilE}" ];then@H_450_4@logFile=$(cat /etc/syslog.conf | grep -V ^# | grep authpriv.)@H_450_4@if [ ! -z "${logFilE}" ];then@H_450_4@echo "Y:存在保存authpirv的日志文件" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@else@H_450_4@echo "N:不存在保存authpirv的日志文件" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@else@H_450_4@echo "N:不存在／etc/syslog.conf文件，建议对所有登录事件都记录" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi @H_450_4@#编号：GOOAnn-Linux-03-01-02@H_450_4@#项目：系统文件-检查日志审核功能是否开启@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@echo "GOOAnn-Linux-03-01-02:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@auditdStatus=$(service auditd status 2> /dev/null)@H_450_4@if [ $? = 0 ];then@H_450_4@echo "Y:系统日志审核功能已开启，符合要求" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ $? = 3 ];then@H_450_4@echo "N:系统日志审核功能已关闭，不符合要求，建议service auditd start开启" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@#编号：GOOAnn-Linux-04-01-01 @H_450_4@#项目：系统文件-系统core dump状态@H_450_4@#合格：Y;不合格：N;检查：C@H_450_4@echo "GOOAnn-Linux-04-01-01:" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@limitsFile=$(cat /etc/security/limits.conf | grep -V ^# | grep corE)@H_450_4@if [ $? -eq 0 ];then@H_450_4@soft=cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}@H_450_4@for i in $soft@H_450_4@do@H_450_4@if [ "$i"x = "soft"x ];then@H_450_4@echo "Y: soft core 0 已经设置" >> "/tmp/${ipadD}_checkResult.txt"@H_450_4@fi@H_450_4@if [ "$i"x = "hard"x ];then@H_450_4@echo "Y: hard core 0 已经设置" >> "/tmp/${ipadD}_checkResult.txt"fidoneelse echo "N:没有设置core，建议在/etc/security/limits.conf中添加 soft core 0和* hard core 0" >> "/tmp/${ipadD}_checkResult.txt"fi#编号：GOOAnn-Linux-04-01-02#项目：系统文件-检查磁盘动态空间，是否大于等于80%#合格：Y;不合格：N;检查：C#echo "GOOAnn-Linux-04-01-02:" >> "/tmp/${ipadD}_checkResult.txt"space=$(df -h | awk -F "[ %]+" ‘NR!=1{print $5}‘)for i in $spacedoif [ $i -ge 80 ];thenecho "C:警告！磁盘存储容量大于80%,建议扩充磁盘容量或者删除垃圾文件" >> "/tmp/${ipadD}_checkResult.txt"fi