1.jpg

    1. #!/bin/bash
    2. # ================ Global function for print result ===================
    3. dash_line="------------------------------------------------------------------"
    4. # 绿色字体输出检测通过
    5. pass=$(($pass+1))
    6. print_pass(){
    7.     echo -e "\033[32m++> PASS \033[0m"
    8.     echo "++> PASS" >> "$file"
    9. }
    10. # 红色字体输出检测失败FAIL
    11. fail=$(($fail+1))
    12. print_fail(){
    13.   echo -e "\033[31m--> FAIL \033[0m"
    14.   echo "--> FAIL" >> "$file"
    15. }
    16. # 黄色字体输出需手工再检查的项
    17. print_manual_check(){
    18.   echo -e "\033[33m##> Manual \033[0m"
    19.   echo "##> Manual" >> "$file"
    20. }
    21. # 蓝色字体输出补充
    22. print_info(){
    23.   echo -e "\033[34m$1 \033[0m"
    24. }
    25. # 紫色字体输出检测项
    26. print_check_point(){
    27.   echo ""
    28.   echo -e "\033[35m[No."$1"] "$2" \033[0m"
    29.   echo "[$1]"" $2" >> "$file"
    30. }
    31. print_dot_line(){
    32.   echo "$dash_line"
    33. }
    34. print_summary(){
    35.   # 输出显示
    36.   print_info "---------------------------- Summary -----------------------------"
    37.   echo -e "\033[35m全部检测项: $1 \033[0m"
    38.   echo -e "\033[32m通过检测项: $2 \033[0m"
    39.   echo -e "\033[31m失败检测项: $3 \033[0m"
    40.   echo -e "\033[33m手工检测项: $4 \033[0m"
    41.   print_info "检测结果将写入文件 $file中..."
    42.   print_info "$dash_line"
    43.   # 写入文件
    44.   echo "---------------------------- Summary -----------------------------" >> "$file"
    45.   echo "全部检测项: $1" >> "$file"
    46.   echo "通过检测项: $2" >> "$file"
    47.   echo "失败检测项: $3" >> "$file"
    48.   echo "手工检测项: $4" >> "$file"
    49.   echo "$dash_line" >> "$file"
    50. }
    51. # ====================================
    52. begin_msg="-------------------- 正在执行操作系统基线检查 --------------------"
    53. print_info "$begin_msg"
    54. index=0       # 检测项编号
    55. pass=0        # 通过的检测项数
    56. fail=0        # 未通过的检测项数
    57. manual=0      # 需手工复核的检测项数
    58. file="os_check_result.txt"
    60. echo "$begin_msg" > "$file"
    62. check_point="帐号管理-1:检查是否设置除root之外UID为0的用户"
    63. index=$(($index+1))
    64. print_check_point $index "$check_point"
    66. print_info "'任何UID为0的帐户都具有系统上的超级用户特权，只有root账号的uid才能为0'"
    67. print_dot_line
    69. result=`/bin/cat /etc/passwd | /bin/awk -F: '($3 == 0) { print $1 }'`
    70. print_info "UID为0的用户如下:"
    71. print_info "[ $result ]"
    73. if [ "root" = $result  ]; then
    74.   pass=$(($pass+1))
    75.   print_pass
    76. else
    77.   fail=$(($fail+1))
    78.   print_fail
    79. fi
    82. check_point="帐号管理-2:检查是否按用户分配账号 "
    83. index=$(($index+1))
    84. print_check_point $index "$check_point"
    86. print_info "'应按照不同的用户分配不同的账号，避免不同用户间共享账号，避免用户账号和设备间通信使用的账号共享'"
    87. print_dot_line
    89. up_uidmin=`(grep -v ^# /etc/login.defs |grep "^UID_MIN"|awk '($1="UID_MIN"){print $2}')`
    90. up_uidmax=`(grep -v ^# /etc/login.defs |grep "^UID_MAX"|awk '($1="UID_MAX"){print $2}')`
    91. users=`/bin/cat /etc/passwd | /bin/awk -F: '{if( $3>='$up_uidmin' && $3<='$up_uidmax' ) {print $1":"$3}}'`
    92. print_info "系统中存在的用户如下:"
    93. print_info "[ $users ]"
    94. if [ "$users" ]; then
    95.   pass=$(($pass+1))
    96.   print_pass
    97. else
    98.   fail=$(($fail+1))
    99.   print_fail
    100. fi
    101. check_point="帐号管理-3:检查是否删除与设备运行、维护等工作无关的账号"
    102. index=$(($index+1))
    103. print_check_point $index "$check_point"
    104. print_info "'应删除或锁定与设备运行、维护等工作无关的账号'"
    105. print_dot_line
    106. print_info "系统中存在的账号如下:"
    107. account=`/bin/cat /etc/shadow | /usr/bin/sed '/^\s*#/d' | /bin/awk -F: '($2!~/^*/) && ($2!~/^!!/) {print $1}'`
    108. print_info "[ $account ]"
    109. manual=$(($manual+1))
    110. print_manual_check
    111. check_point="帐号管理-4:检查是否设置不同的用户组"
    112. index=$(($index+1))
    113. print_check_point $index "$check_point"
    114. print_info "'根据系统要求及用户的业务需求，建立多账户组，将用户账号分配到相应的账户组'"
    115. print_dot_line
    116. groups=`cat /etc/group | awk -F ':' '$3>1000{print $1}'`
    117. print_info "系统中存在的用户自定义用户组 gid >= 1000，如下"
    118. print_info "[ $groups ]"
    119. if [ -n "$groups" ];then
    120.   pass=$(($pass+1))
    121.   print_pass
    122. else
    123.   fail=$(($fail+1))
    124.   print_fail
    125. fi
    126. check_point="口令策略-1:检查是否设置口令生存周期 "
    127. index=$(($index+1))
    128. print_check_point $index "$check_point"
    129. passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^#`
    130. print_info "'PASS_MAX_DAYS 应介于1~90'"
    131. print_dot_line
    132. print_info "$passmax"
    133. if [ -n "$passmax" ]; then
    134.   days=`echo $passmax | awk '{print $2}'`
    135.   if [ "$days" -gt 90 ]; then
    136.       fail=$(($fail+1))
    137.       print_fail
    138.   else
    139.       pass=$(($pass+1))
    140.       print_pass
    141.   fi
    142. else
    143.   fail=$(($fail+1))
    144.   print_fail
    145. fi
    146. check_point="口令策略-2:检查是否设置口令更改最小间隔天数 "
    147. index=$(($index+1))
    148. print_check_point $index "$check_point"
    149. passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^#`
    150. print_info "'PASS_MIN_DAYS 应大于等于 7'"
    151. print_dot_line
    152. print_info "$passmin"
    153. if [ -n "$passmin" ]; then
    154.   days=`echo $passmin | awk '{print $2}'`
    155.   if [ "$days" -lt 7 ]; then
    156.       fail=$(($fail+1))
    157.       print_fail
    158.   else
    159.       pass=$(($pass+1))
    160.       print_pass
    161.   fi
    162. else
    163.   fail=$(($fail+1))
    164.   print_fail
    165. fi
    166. check_point="口令策略-3:检查是否设置口令过期前警告天数  "
    167. index=$(($index+1))
    168. print_check_point $index "$check_point"
    169. print_info "'口令过期前告警天数PASS_WARN_AGE应设置为 7'"
    170. print_dot_line
    171. pass_age=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# `
    172. print_info "$pass_age"
    173. if [ -n "$pass_age" ]; then
    174.   days=`echo $pass_age | awk '{print $2}'`
    175.   if [ "$days" -eq 7 ]; then
    176.     pass=$(($pass+1))
    177.     print_pass
    178.   else
    179.     fail=$(($fail+1))
    180.     print_fail
    181.   fi
    182. else
    183.   fail=$(($fail+1))
    184.   print_fail
    185. fi
    186. check_point="口令策略-4:检查设备密码复杂度策略"
    187. index=$(($index+1))
    188. print_check_point $index "$check_point"
    189. print_info "'系统应设置密码复杂度策略，避免设置账号弱口令'"
    190. print_dot_line
    191. print_info "此部分要求可能不一致，请手工检查/etc/pam.d/system-auth或/etc/security/pwquality.conf文件配置"
    192. # 以下内容是以密码长度至少为8位，并且存在大写字母、小写字母、数字、特殊字符至少一个要求来检测的
    193. # ------------------------------------------------------------------------------
    194. # print_info "'密码长度>=8，且至少包含一个大写字母、小写字母、数字、特殊字符(可自定义密码复杂度策略)'"
    195. # print_info "可在/etc/pam.d/system-auth或/etc/security/pwquality.conf进行配置"
    196. # print_dot_line
    197. # print_info "检查/etc/pam.d/system-auth，如下:"
    198. #
    199. # flag=0
    200. #
    201. # # 以下检查/etc/pam.d/system-auth文件中的内容
    202. # #
    203. # info=`cat /etc/pam.d/system-auth | grep password | grep requisite`
    204. # print_info "$info"
    205. # line=`cat /etc/pam.d/system-auth | grep password | grep pam_cracklib.so | grep -v ^#`
    206. # if [ -n "$line" ]; then
    207. #   check_min=`echo $line | grep minlen`
    208. #   check_dcredit=`echo $line | grep dcredit`
    209. #   check_ucredit=`echo $line | grep ucredit`
    210. #   check_ocredit=`echo $line | grep ocredit`
    211. #   check_lcredit=`echo $line | grep lcredit`
    212. #   # minlen:密码字符串长度，dcredit数字字符个数，ucredit大写字符个数，ocredit特殊字符个数，lcredit小写字符个数
    213. #   if [ -n "$check_min"  ] && [ -n "$check_dcredit"  ] && [ -n "$check_ucredit"  ] && [ -n "$check_ocredit"  ] && [ -n "$check_lcredit"  ]; then
    214. #     minlen=`echo $line | awk -F 'minlen=' '{print $2}' | awk -F ' ' '{print $1}'`
    215. #     dcredit=`echo $line | awk -F 'dcredit=' '{print $2}' | awk -F ' ' '{print $1}'`
    216. #     ucredit=`echo $line | awk -F 'ucredit=' '{print $2}' | awk -F ' ' '{print $1}'`
    217. #     ocredit=`echo $line | awk -F 'ocredit=' '{print $2}' | awk -F ' ' '{print $1}'`
    218. #     lcredit=`echo $line | awk -F 'lcredit=' '{print $2}' | awk -F ' ' '{print $1}'`
    219. #
    220. #     if [ "$minlen" -ge 8 ] && [ ${dcredit#-} -ge 1 ] && [ ${ucredit#-} -ge 1 ] && [ ${ucredit#-} -ge 1 ] && \
    221. #      [ ${ocredit#-} -ge 1 ] && [ ${lcredit#-} -ge 1 ]; then
    222. #        print_info "minlen => ""[ $minlen ]"
    223. #        print_info "dcredit => ""[ $dcredit ]"
    224. #        print_info "ucredit => ""[ $ucredit ]"
    225. #        print_info "ocredit => ""[ $ocredit ]"
    226. #        print_info "lcredit => ""[ $lcredit ]"
    227. #       flag=1
    228. #     fi
    229. #   fi
    230. # fi
    231. #
    232. # # 以下检查/etc/security/pwquality.conf文件中的内容
    233. # # minlen为密码字符串长度，minclass为字符类别
    234. # print_info "检查/etc/security/pwquality.conf，如下:"
    235. # line_minlen=`cat /etc/security/pwquality.conf | grep minlen | grep -v ^#`
    236. # line_minclass=`cat /etc/security/pwquality.conf | grep minclass | grep -v ^#`
    237. #
    238. # if [ -n "$line_minlen" ] && [ -n "$line_minclass" ]; then
    239. #   minlen=`echo "$line_minlen" | awk -F "=" '{print $2}' | awk '{gsub(/^\s+|\s+$/, "");print}'`
    240. #   minclass=`echo "$line_minclass" | awk -F "=" '{print $2}' | awk '{gsub(/^\s+|\s+$/, "");print}'`
    241. #   if [ "$minlen" -ge 8 ] && [ "$minclass" -ge 4 ];then
    242. #     print_info "minlen =>"" [ $minlen ]"
    243. #     print_info "minclass =>"" [ $minclass ]"
    244. #     flag=1
    245. #   fi
    246. # fi
    247. #
    248. # if [ "$flag" -eq 1 ]; then
    249. #   pass=$(($pass+1))
    250. #   print_pass
    251. # else
    252. #   fail=$(($fail+1))
    253. #   print_fail
    254. # fi
    255. # ------------------------------------------------------------------------------
    256. manual=$(($manual+1))
    257. print_manual_check
    258. check_point="口令策略-5:检查是否存在空口令账号"
    259. index=$(($index+1))
    260. print_check_point $index "$check_point"
    261. print_info "'不允许存在空口令的账号'"
    262. print_dot_line
    263. tmp=`/bin/cat /etc/shadow | /bin/awk -F: '($2 == "" ) { print "user " $1 " does not have a password "}'`
    264. print_info '空口令账号:'"[ $tmp ]"
    265. if [ -z "$tmp" ]; then
    266.   pass=$(($pass+1))
    267.   print_pass
    268. else
    269.   fail=$(($fail+1))
    270.   print_fail
    271. fi
    272. check_point="口令策略-6:检查密码重复使用次数限制"
    273. index=$(($index+1))
    274. print_check_point $index "$check_point"
    275. line=`cat /etc/pam.d/system-auth | grep password | grep sufficient | grep pam_unix.so | grep remember | grep -v ^#`
    276. print_info "'口令重复使用限制次数 remember >=5'"
    277. print_dot_line
    278. print_info "[ $line ]"
    279. if [ -n "$line" ]; then
    280.   times=`echo $line|awk -F "remember=" '{print $2}'`
    281.   if [ $times -ge 5 ]; then
    282.     pass=$(($pass+1))
    283.     print_pass
    284.   else
    285.     fail=$(($fail+1))
    286.     print_fail
    287.   fi
    288. else
    289.   fail=$(($fail+1))
    290.   print_fail
    291. fi
    292. check_point="口令策略-7:检查账户认证失败次数限制"
    293. index=$(($index+1))
    294. print_check_point $index "$check_point"
    295. print_dot_line
    296. print_info "登录失败限制可以使用pam_tally或pam.d，请手工检测/etc/pam.d/system-auth"
    297. manual=$(($manual+1))
    298. print_manual_check
    299. check_point="认证授权-1:检查用户目录缺省访问权限设置 "
    300. index=$(($index+1))
    301. print_check_point $index "$check_point"
    302. tmp=`umask`
    303. print_info "'文件目录缺省访问权限应是 027'"
    304. print_dot_line
    305. print_info "实际检测值为:"
    306. print_info "[ $tmp ]"
    307. tt=`echo $tmp | grep 027`
    308. if [ -n "$tt" ];then
    309.   pass=$(($pass+1))
    310.   print_pass
    311. else
    312.   fail=$(($fail+1))
    313.   print_fail
    314. fi
    315. check_point="认证授权-2:检查是否设置SSH登录前警告Banner"
    316. index=$(($index+1))
    317. print_check_point $index "$check_point"
    318. banner1=`cat /etc/ssh/sshd_config | grep Banner`
    319. print_info "'检查SSH配置文件:/etc/ssh/sshd_config，未启用banner或合理设置banner的内容'"
    320. print_dot_line
    321. print_info "$banner1"
    322. # 如果banner为空或者为 None，则符合要求
    323. if [ -z "$banner1" ]; then
    324.   print_info "不存在Banner配置项"
    325.   pass=$(($pass+1))
    326.   print_pass
    327. else
    328.   banner2=`cat /etc/ssh/sshd_config | grep Banner | awk '{print $2}' | grep -v "none"`
    329.   if [ -z "$banner2" ]; then
    330.     print_info "未配置Banner路径文件"
    331.     pass=$(($pass+1))
    332.     print_pass
    333.   else
    334.     manual=$(($manual+1))
    335.     path=`cat /etc/ssh/sshd_config | grep Banner | awk '{print $2}'`
    336.     print_info "请手工检查文件 $path 是否符合要求"
    337.     print_manual_check
    338.   fi
    339. fi
    340. check_point="日志审计-1:检查是否对登录进行日志记录"
    341. index=$(($index+1))
    342. print_check_point $index "$check_point"
    343. print_info "'设备应配置日志功能，对用户登录进行记录，记录内容包括用户登录使用的账号，登录是否成功，登录时间，以及远程登录时，用户使用的IP地址'"
    344. tmp=`cat /etc/rsyslog.conf | grep /var/log/secure | egrep 'authpriv'.\('info|\*'\) | grep -v ^#`
    345. print_dot_line
    346. print_info "/etc/rsyslog.conf 文件中 authpriv 的配置如下所示:"
    347. print_info "$tmp"
    348. if [ -n "$tmp" ]; then
    349.   pass=$(($pass+1))
    350.   print_pass
    351. else
    352.   fail=$(($fail+1))
    353.   print_fail
    354. fi
    355. check_point="日志审计-2:检查是否启用cron行为日志功能"
    356. index=$(($index+1))
    357. print_check_point $index "$check_point"
    358. print_dot_line
    359. tmp=`cat /etc/rsyslog.conf | grep /var/log/cron | egrep 'cron.\*' | grep -v ^#`
    360. print_info "/etc/rsyslog.conf 文件中 cron 的配置如下所示:"
    361. print_info "$tmp"
    362. if [ -n "$tmp" ]; then
    363.   pass=$(($pass+1))
    364.   print_pass
    365. else
    366.   fail=$(($fail+1))
    367.   print_fail
    368. fi
    369. check_point="日志审计-3:检查是否配置远程日志功能"
    370. index=$(($index+1))
    371. print_check_point $index "$check_point"
    372. print_info "'在远程主机上存储日志数据保护日志完整性免受本地攻击'"
    373. print_dot_line
    374. msg="请检查/etc/rsyslog.conf文件，查看是否配置日志服务器"
    375. print_info "$msg"
    376. manual=$(($manual+1))
    377. print_manual_check
    378. check_point="日志审计-4:检查是否配置su命令使用情况记录"
    379. index=$(($index+1))
    380. print_check_point $index "$check_point"
    381. print_info "'启用syslog系统日志审计功能'"
    382. print_dot_line
    383. tmp=`cat /etc/rsyslog.conf | grep /var/log/secure | egrep 'authpriv'.\('info|\*'\) | grep -v ^#`
    384. print_info "/etc/rsyslog.conf 文件中 authpriv 的配置如下所示:"
    385. print_info "$tmp"
    386. if [ -n "$tmp" ]; then
    387.   pass=$(($pass+1))
    388. print_pass
    389. else
    390.   fail=$(($fail+1))
    391. print_fail
    392. fi
    393. check_point="日志审计-5:检查日志文件权限设置"
    394. index=$(($index+1))
    395. print_check_point $index "$check_point"
    396. messages=`stat -c %a /var/log/messages`
    397. dmesg=`stat -c %a /var/log/dmesg`
    398. maillog=`stat -c %a /var/log/maillog`
    399. secure=`stat -c %a /var/log/secure`
    400. wtmp=`stat -c %a /var/log/wtmp`
    401. cron=`stat -c %a /var/log/cron`
    402. print_info "'设备应配置权限，控制对日志文件读取、修改和删除等操作'"
    403. print_info "推荐的文件权限:(不大于左侧值)"
    404. print_info "600 /var/log/messages"
    405. print_info "600 /var/log/secure、"
    406. print_info "600 /var/log/maillog、"
    407. print_info "600 /var/log/cron"
    408. print_info "644 /var/log/dmesg"
    409. print_info "664 /var/log/wtmp"
    410. print_dot_line
    411. print_info "目前的文件权限如下:"
    412. print_info $messages' /var/log/messages'
    413. print_info $dmesg' /var/log/dmesg  '
    414. print_info $maillog' /var/log/maillog  '
    415. print_info $secure' /var/log/secure  '
    416. print_info $wtmp' /var/log/wtmp  '
    417. print_info $cron' /var/log/cron  '
    418. if [ "$messages" -le 600 ] && [ "$secure" -le 600 ] && [ "$maillog" -le 600 ] && [ "$cron" -le 600 ] && [ "$dmesg" -le 644 ] && [ "$wtmp" -le 664 ]; then
    419.   pass=$(($pass+1))
    420.   print_pass
    421. else
    422.   fail=$(($fail+1))
    423.   print_fail
    424. fi
    425. check_point="日志审计-6:检查安全事件日志配置"
    426. index=$(($index+1))
    427. print_check_point $index "$check_point"
    428. print_info "'设备应配置日志功能，记录对与设备相关的安全事件'"
    429. print_dot_line
    430. tmp=`cat /etc/rsyslog.conf | grep /var/log/messages | egrep '\*.info;mail.none;authpriv.none;cron.none' | grep -v ^#`
    431. print_info "/etc/rsyslog.conf 文件中 /var/log/messages 的配置如下所示:"
    432. print_info "$tmp"
    433. if [ -n "$tmp" ]; then
    434.   pass=$(($pass+1))
    435.   print_pass
    436. else
    437.   fail=$(($fail+1))
    438.   print_fail
    439. fi
    440. check_point="文件权限-1:检查FTP用户上传的文件所具有的权限"
    441. index=$(($index+1))
    442. print_check_point $index "$check_point"
    443. print_info "'FTP服务未运行，或ftp用户和匿名用户上传文件的权限为022'"
    444. print_dot_line
    445. tmp=`netstat -lntp | grep ftp`
    446. print_info "$tmp"
    447. if [ -z "$tmp" ]; then
    448.   print_info "No FTP Service"
    449.   pass=$(($pass+1))
    450.   print_pass
    451. else
    452.   local_umask=`cat /etc/vsftpd/vsftpd.conf | grep local_umask | grep 022 | grep -v ^#`
    453.   anon_umask=`cat /etc/vsftpd/vsftpd.conf | grep anon_umask | grep 022 | grep -v ^#`
    454.   if [ -n "$local_umask" ] && [ -n "$anon_umask" ]; then
    455.     pass=$(($pass+1))
    456.     print_pass
    457.   else
    458.     print_info 'local_umask:'"[ $local_umask ]"
    459.     print_info 'anon_umask:'"[ $anon_umask ]"
    460.     fail=$(($fail+1))
    461.     print_fail
    462.   fi
    463. fi
    464. check_point="文件权限-2:检查重要目录或文件权限设置"
    465. index=$(($index+1))
    466. print_check_point $index "$check_point"
    467. passwd=`stat -c %a /etc/passwd`
    468. shadow=`stat -c %a /etc/shadow`
    469. group=`stat -c %a /etc/group`
    470. print_info "'在设备权限配置能力内，根据用户的业务需要，配置其所需的最小权限'"
    471. print_info "建议文件权限:(不大于左侧值)"
    472. print_info "644 /etc/passwd"
    473. print_info "400 /etc/shadow"
    474. print_info "644 /etc/group"
    475. print_dot_line
    476. print_info "实际检测值为:"
    477. print_info "$passwd"" /etc/passwd"
    478. print_info "$shadow"" /etc/shadow"
    479. print_info "$group"" /etc/group"
    480. if [ "$passwd" -le 644 ] && [ "$shadow" -le 400 ] && [ "$group" -le 644 ]; then
    481.   pass=$(($pass+1))
    482. print_pass
    483. else
    484.   fail=$(($fail+1))
    485. print_fail
    486. fi
    487. check_point="网络通信-1:检查是否禁止root用户远程登录"
    488. index=$(($index+1))
    489. print_check_point $index "$check_point"
    490. Protocol=`cat /etc/ssh/sshd_config | grep -i Protocol | egrep -v ^\# | awk '{print $2}'`
    491. PermitRootLogin=`cat /etc/ssh/sshd_config | grep -i PermitRootLogin | egrep -v ^\# | awk '{print $2}'`
    492. print_info "'PermitRootLogin 为no 且 Protocol 为2'"
    493. print_dot_line
    494. print_info "/etc/ssh/sshd_config 两项配置如下:"
    495. print_info 'PermitRootLogin ==> '"[ $PermitRootLogin ]"
    496. print_info 'Protocol ==> '"[ $Protocol ]"
    497. if [ "$PermitRootLogin" = "no" ] && [ "$Protocol" -eq 2 ]; then
    498.   pass=$(($pass+1))
    499.   print_pass
    500. else
    501.   fail=$(($fail+1))
    502.   print_fail
    503. fi
    504. check_point="网络通信-2:检查使用IP协议远程维护的设备是否配置SSH协议，禁用Telnet协议"
    505. index=$(($index+1))
    506. print_check_point $index "$check_point"
    507. print_dot_line
    508. telnet=`netstat -lntp |grep telnet`
    509. ssh=`netstat -lntp |grep ssh`
    510. print_info "==> telnet"
    511. print_info "$telnet"
    512. print_info "==> ssh"
    513. print_info "$ssh"
    514. if [ -z "$telnet" ] && [ -n "$ssh" ]; then
    515.   pass=$(($pass+1))
    516.   print_pass
    517. else
    518.   fail=$(($fail+1))
    519.   print_fail
    520. fi
    521. check_point="网络通信-3:检查是否修改SNMP默认团体字"
    522. index=$(($index+1))
    523. print_check_point $index "$check_point"
    524. print_info "'如果没有必要，需要停止SNMP服务，如果确实需要使用SNMP服务，需要修改SNMP默认团体字'"
    525. print_dot_line
    526. snmp=`ps -ef|grep "snmpd"|grep -v "grep"`
    527. if [ -z "$snmp" ]; then
    528.   print_info "SNMP Server is not running..."
    529.   pass=$(($pass+1))
    530.   print_pass
    531. else
    532.   string=`cat /etc/snmp/snmpd.conf | grep com2sec  | grep public | grep -v ^# `
    533.   if [ -n "$string" ]; then
    534.     fail=$(($fail+1))
    535.     print_fail
    536.   else
    537.     pass=$(($pass+1))
    538.     print_pass
    539.   fi
    540. fi
    541. check_point="网络通信-4:检查是否禁止root用户登录FTP"
    542. index=$(($index+1))
    543. print_check_point $index "$check_point"
    544. print_info "'FTP服务未运行 或 root被禁用'"
    545. print_dot_line
    546. tmp=`ps -ef | grep ftp | grep -v grep`
    547. if [ -z "$tmp" ]; then
    548.   print_info "No FTP Service"
    549.   pass=$(($pass+1))
    550.   print_pass
    551. else
    552.   print_info "1.FTP服务正在运行..."
    553.   print_info "2.检查 /etc/vsftpd/ftpusers 配置文件中是否有root，以下是文件内容"
    554.   print_info "`cat /etc/vsftpd/ftpusers`"
    555.   root=`cat /etc/vsftpd/ftpusers | grep root | grep -v ^#`
    556.   if [ -n "$root" ]; then
    557.     pass=$(($pass+1))
    558.     print_pass
    559.   else
    560.     fail=$(($fail+1))
    561.     print_fail
    562.   fi
    563. fi
    564. check_point="网络通信-5:检查是否使用PAM认证模块禁止wheel组之外的用户su为root"
    565. index=$(($index+1))
    566. print_check_point $index "$check_point"
    567. print_info "'使用PAM禁止任何人su为root'"
    568. print_info "检查/etc/pam.d/su文件中，是否存在如下配置:"
    569. print_info "auth  sufficient pam_rootok.so"
    570. print_info "auth  required pam_wheel.so group=wheel"
    571. print_dot_line
    572. pam_rootok=`cat /etc/pam.d/su | grep auth | grep sufficient | grep pam_rootok.so | grep -v ^#`
    573. pam_wheel=`cat /etc/pam.d/su | grep auth | grep pam_wheel.so | grep group=wheel | grep -v ^#`
    574. print_info "实际配置如下:"
    575. print_info "$pam_rootok"
    576. print_info "$pam_wheel"
    577. if [ -n "$pam_rootok" ] && [ -n "$pam_wheel" ]; then
    578.   pass=$(($pass+1))
    579.   print_pass
    580. else
    581.   fail=$(($fail+1))
    582.   print_fail
    583. fi
    584. check_point="其他配置-1:检查是否禁止匿名用户登录FTP"
    585. index=$(($index+1))
    586. print_check_point $index "$check_point"
    587. print_info "'FTP服务未启用或者限制了匿名账号登录ftp服务器则合规'"
    588. print_dot_line
    589. tmp=`ps -ef | grep ftp | grep -v grep`
    590. if [ -z "$tmp" ]; then
    591.   print_info "No FTP Service"
    592.   pass=$(($pass+1))
    593.   print_pass
    594. else
    595.   tmp=`cat /etc/vsftpd/vsftpd.conf | grep "anonymous_enable=NO" | grep -v ^#`
    596.   if [ -z "$tmp" ]; then
    597.     tmp=`cat /etc/vsftpd/vsftpd.conf | grep "anonymous_enable" | grep -v ^#`
    598.     print_info "$tmp"
    599.     fail=$(($fail+1))
    600.     print_fail
    601.   else
    602.     pass=$(($pass+1))
    603.     print_pass
    604.   fi
    605. fi
    606. check_point="其他配置-2:检查是否删除了潜在危险文件"
    607. index=$(($index+1))
    608. print_check_point $index "$check_point"
    609. print_info "'系统不应该存在.rhost、.netrc、hosts.equiv这三个文件则合规'"
    610. print_dot_line
    611. rhost=`locate .rhost | egrep 'rhost$'`
    612. equiv=`locate .netrc | egrep 'netrc$'`
    613. equiv=`locate .equiv | egrep 'hosts.equiv$'`
    614. print_info "rhost ==> "" [ $rhost ]"
    615. print_info "netrc ==> "" [ $netrc ]"
    616. print_info "equiv ==> "" [ $equiv ]"
    617. if [ -z "$rhost" ] && [ -z "$netrc" ] && [ -z "$equiv" ]; then
    618.   pass=$(($pass+1))
    619.   print_pass
    620. else
    621.   fail=$(($fail+1))
    622.   print_fail
    623. fi
    624. check_point="其他配置-3:检查是否设置命令行界面超时退出"
    625. index=$(($index+1))
    626. print_check_point $index "$check_point"
    627. print_info "'命令行界面超时自动登出时间TMOUT应不大于300s'"
    628. print_dot_line
    629. TMOUT=`cat /etc/profile |grep -i TMOUT | grep -v ^#`
    630. if [ -z "$TMOUT" ]; then
    631.   print_info "没有设置超时时间TMOUT"
    632.   fail=$(($fail+1))
    633.   print_fail
    634. else
    635.   TMOUT=`cat /etc/profile |grep -i TMOUT | egrep -v ^\# | awk -F "=" '{print $2}'`
    636.   if [ "$TMOUT" -gt 300 ]; then
    637.     print_info "TMOUT值过大:""$TMOUT"
    638.     fail=$(($fail+1))
    639.     print_fail
    640.   else
    641.     print_info "TMOUT:""$TMOUT"
    642.     pass=$(($pass+1))
    643.     print_pass
    644.   fi
    645. fi
    646. check_point="其他配置-4:检查系统是否禁用Ctrl+Alt+Delete组合键"
    647. index=$(($index+1))
    648. print_check_point $index "$check_point"
    649. tmp=`cat /usr/lib/systemd/system/ctrl-alt-del.target | grep "Alias=ctrl-alt-del.target" | grep -v ^#`
    650. print_info "'应禁用Ctrl+Alt+Delete组合键重启系统'"
    651. print_dot_line
    652. print_info "Ctrl+Alt+Delete的配置如下:"
    653. print_info $tmp
    654. if [ -n "$tmp" ]; then
    655.   fail=$(($fail+1))
    656.   print_fail
    657. else
    658.   pass=$(($pass+1))
    659.   print_pass
    660. fi
    661. check_point="其他配置-5:检查root用户的path环境变量"
    662. index=$(($index+1))
    663. print_check_point $index "$check_point"
    664. print_info "'PATH环境变量中不存在.或者..的路径(此处以不存在'..'为检查条件，因为'.'可能会存在于软件版本号中)'"
    665. print_dot_line
    666. print_info "PATH环境变量如下:"
    667. tmp=`echo $PATH | egrep '\.\.'`
    668. print_info "$PATH"
    669. if [ -z "$tmp" ]; then
    670.   pass=$(($pass+1))
    671.   print_pass
    672. else
    673.   fail=$(($fail+1))
    674.   print_fail
    675. fi
    676. check_point="其他配置-6:检查历史命令设置"
    677. index=$(($index+1))
    678. print_check_point $index "$check_point"
    679. print_info "'HISTFILESIZE和HISTSIZE的值应小于等于5'"
    680. print_dot_line
    681. print_info "实际检测值为:"
    682. HISTSIZE=`cat /etc/profile | grep ^HISTSIZE | egrep -v ^\#`
    683. HISTFILESIZE=`cat /etc/profile | grep ^HISTFILESIZE | egrep -v ^\#`
    684. if [ -n "$HISTSIZE" ] && [ -n "$HISTFILESIZE" ]; then
    685.   HISTSIZE=`cat /etc/profile | grep HISTSIZE | egrep -v ^\# | awk -F "=" '{print $2}'`
    686.   HISTFILESIZE=`cat /etc/profile | grep HISTFILESIZE | egrep -v ^\# | awk -F "=" '{print $2}'`
    687.   print_info "HISTSIZE => "" [ $HISTSIZE ]"
    688.   print_info "HISTFILESIZE => "" [ $HISTFILESIZE ]"
    689.   if [ "$HISTSIZE" -lt 5 ] && [ "$HISTFILESIZE" -lt 5 ]; then
    690.     pass=$(($pass+1))
    691.     print_pass
    692.   else
    693.     fail=$(($fail+1))
    694.     print_fail
    695.   fi
    696. else
    697.   fail=$(($fail+1))
    698.   print_fail
    699. fi
    700. check_point="其他配置-7:检查是否设置SSH成功登录后Banner"
    701. index=$(($index+1))
    702. print_check_point $index "$check_point"
    703. print_info "'用户通过网络或者本地成功登录系统后，显示一些警告信息'"
    704. print_dot_line
    705. tmp=`systemctl status sshd | grep running`
    706. if [ -z "$tmp" ]; then
    707.   print_info "==>SSHD is not running..."
    708.   pass=$(($pass+1))
    709.   print_pass
    710. else
    711.   temp=`cat /etc/motd`
    712.   if [ -n "$temp" ]; then
    713.     print_info "请手工检查/etc/motd文件中的内容是否符合要求"
    714.     print_info "$temp"
    715.     manual=$(($manual+1))
    716.     print_manual_check
    717.   else
    718.     print_info "/etc/motd文件中内容为空，不提示登录信息"
    719.     pass=$(($pass+1))
    720.     print_pass
    721.   fi
    722. fi
    723. check_point="其他配置-8:检查是否限制FTP用户登录后能访问的目录"
    724. index=$(($index+1))
    725. print_check_point $index "$check_point"
    726. print_info "'FTP服务器应该限制FTP可以使用的目录范围'"
    727. print_dot_line
    728. tmp=`ps -ef | grep ftp | grep -v grep`
    729. if [ -z "$tmp" ]; then
    730.   print_info "No FTP Service Running"
    731.   pass=$(($pass+1))
    732.   print_pass
    733. else
    734.   chroot_local_user=`cat /etc/vsftpd/vsftpd.conf | grep ^chroot_local_user=NO`
    735.   chroot_list_enable=`cat /etc/vsftpd/vsftpd.conf | grep ^chroot_list_enable=YES`
    736.   chroot_list_file=`cat /etc/vsftpd/vsftpd.conf | grep ^chroot_list_file=/etc/vsftpd/chroot_list`
    737.   if [ -n "$chroot_local_user" ] && [ -n "$chroot_list_enable" ] && [ -n "$chroot_list_file" ]; then
    738.     pass=$(($pass+1))
    739.     print_pass
    740.   else
    741.     fail=$(($fail+1))
    742.     print_fail
    743.   fi
    744. fi
    745. check_point="其他配置-9:检查是否关闭数据包转发功能"
    746. index=$(($index+1))
    747. print_check_point $index "$check_point"
    748. print_info "'对于不做路由功能的系统，应该关闭数据包转发功能'"
    749. print_dot_line
    750. ip_forward=`sysctl -n net.ipv4.ip_forward`
    751. print_info "实际值 ==> ip_forward:"" [ $ip_forward ] "
    752. if [ 0 -eq "$ip_forward" ]; then
    753.   pass=$(($pass+1))
    754.   print_pass
    755. else
    756.   fail=$(($fail+1))
    757.   print_fail
    758. fi
    759. check_point="其他配置-10:检查别名文件/etc/aliase"
    760. index=$(($index+1))
    761. print_check_point $index "$check_point"
    762. print_info "'检查是否配合配置了ls和rm命令别名'"
    763. print_dot_line
    764. aol=`cat  ~/.bashrc | grep "^alias ls='ls -aol'"`
    765. rmi=`cat  ~/.bashrc | grep "^alias rm='rm -i"`
    766. print_info "aol ==> "" [ $aol ]"
    767. print_info "rmi ==> "" [ $rmi ]"
    768. if [ -n "$aol" ] && [ -n "$rmi" ]; then
    769.   pass=$(($pass+1))
    770.   print_pass
    771. else
    772.   fail=$(($fail+1))
    773.   print_fail
    774. fi
    775. check_point="其他配置-11:检查是否使用NTP（网络时间协议）保持时间同步"
    776. index=$(($index+1))
    777. print_check_point $index "$check_point"
    778. print_info "'如果网络中存在信任的NTP服务器，应该配置系统使用NTP服务保持时间同步'"
    779. print_dot_line
    780. print_info "NTP服务运行状态信息："
    781. ntpd=`ps -ef|egrep "ntp|ntpd"|grep -v grep | grep "/usr/sbin/ntpd"`
    782. print_info "$ntpd"
    783. if [ -n "$ntpd" ]; then
    784.   server=`cat /etc/ntp.conf | grep ^server`
    785.   print_info "==> servers <=="
    786.   print_info "$server"
    787.   if [ -n "$server" ]; then
    788.     pass=$(($pass+1))
    789.     print_pass
    790.   else
    791.     fail=$(($fail+1))
    792.     print_fail
    793.   fi
    794. else
    795.   print_info "==> NTP Service is not running..."
    796.   fail=$(($fail+1))
    797.   print_fail
    798. fi
    799. check_point="其他配置-12:检查是否限制远程登录IP范围"
    800. index=$(($index+1))
    801. print_check_point $index "$check_point"
    802. print_info "'设备应支持对允许登录到该设备的IP地址范围进行设定'"
    803. print_dot_line
    804. print_info "请手工查看/etc/hosts.allow和/etc/hosts.deny两个文件"
    805. manual=$(($manual+1))
    806. print_manual_check
    807. check_point="其他配置-13:检查NFS（网络文件系统）服务配置"
    808. index=$(($index+1))
    809. print_check_point $index "$check_point"
    810. print_info "'如果没有必要，需要停止NFS服务；如果需要NFS服务，需要限制能够访问NFS服务的IP范围'"
    811. print_dot_line
    812. tmp=`netstat -lntp | grep nfs`
    813. if [ -z "$tmp" ]; then
    814.   print_info "NFS 服务未启用..."
    815.   pass=$(($pass+1))
    816.   print_pass
    817. else
    818.   allow=`cat /etc/hosts.allow | grep -v ^#`
    819.   deny=`cat /etc/hosts.deny | grep -v ^#`
    820.   if [ -n "$allow" ] && [ -n "$deny" ]; then
    821.     print_info "hosts.allow 和 hosts.deny皆已配置"
    822.     pass=$(($pass+1))
    823.     print_pass
    824.   else
    825.     print_info "未配置hosts.allow 或 hosts.deny"
    826.     fail=$(($fail+1))
    827.     print_fail
    828.   fi
    829. fi
    830. check_point="其他配置-14:检查是否配置定时自动屏幕锁定"
    831. index=$(($index+1))
    832. print_check_point $index "$check_point"
    833. print_info "'对于具备图形界面（含WEB界面）的设备，应配置定时自动屏幕锁定(没有界面可忽略此项)'"
    834. print_dot_line
    835. idle_activation_enabled=`gconftool-2 -g /apps/gnome-screensaver/idle_activation_enabled`
    836. lock_enabled=`gconftool-2 -g /apps/gnome-screensaver/lock_enabled`
    837. mode=`gconftool-2 -g /apps/gnome-screensaver/mode`
    838. idle_delay=`gconftool-2 -g /apps/gnome-screensaver/idle_delay`
    839. print_info "idle_activation_enabled ==> "" [ $idle_activation_enabled ]"
    840. print_info "lock_enabled ==> "" [ $lock_enabled ]"
    841. print_info "mode ==> "" [ $mode ]"
    842. print_info "idle_delay ==> "" [ $idle_delay ]"
    843. if  [ "$idle_activation_enabled" == "true" ] && [ "$lock_enabled" == "true" ] \
    844.   && [ "$mode" == "blank-only" ] && [ "$idle_delay" -le 15 ]; then
    845.   pass=$(($pass+1))
    846.   print_pass
    847. else
    848.   fail=$(($fail+1))
    849.   print_fail
    850. fi
    851. check_point="其他配置-15:检查是否安装chkrootkit进行系统监测"
    852. index=$(($index+1))
    853. print_check_point $index "$check_point"
    854. print_info "'安装入侵检测攻击检查Linux系统是否遭受攻击'"
    855. print_dot_line
    856. chkrootkit=`rpm -qa|grep -i "chkrootkit"`
    857. print_info "chkrootkit ==> "" [ $chkrootkit ]"
    858. if [ -n "$chkrootkit" ]; then
    859.   pass=$(($pass+1))
    860.   print_pass
    861. else
    862.   fail=$(($fail+1))
    863.   print_fail
    864. fi
    865. check_point="其他配置-16:检查是否安装OS补丁"
    866. index=$(($index+1))
    867. print_check_point $index "$check_point"
    868. print_info "'手工检查当前系统版本是否安装最新补丁'"
    869. print_dot_line
    870. os=`uname -a`
    871. print_info "==> please manual check os version ..."
    872. print_info "$os"
    873. manual=$(($manual+1))
    874. print_manual_check
    875. check_point="其他配置-17:检查FTP banner设置"
    876. index=$(($index+1))
    877. print_check_point $index "$check_point"
    878. print_dot_line
    879. tmp=`ps -ef | grep ftp | grep -v grep`
    880. if [ -z "$banner" ]; then
    881.   print_info "FTP Service is not Running..."
    882.   pass=$(($pass+1))
    883.   print_pass
    884. else
    885.   print_info "请手工检查/etc/vsftpd/vsftpd.conf文件中的banner是否符合要求"
    886.   manual=$(($manual+1))
    887.   print_manual_check
    888. fi
    889. check_point="其他配置-18:检查Telnet banner设置"
    890. index=$(($index+1))
    891. print_check_point $index "$check_point"
    892. print_info "'FTP登录时需要显示警告信息，隐藏操作系统和FTP服务器相关信息'"
    893. print_dot_line
    894. tmp=`systemctl status telnet.socket  | grep active`
    895. if [ -z "$tmp" ]; then
    896.   print_info "==>Telnet service is not installed or not running..."
    897.   pass=$(($pass+1))
    898.   print_pass
    899. else
    900.   print_info "Please check /etc/issue、/etc/issue.net whether contains banner information"
    901.   manual=$(($manual+1))
    902.   print_manual_check
    903. fi
    904. check_point="其他配置-19:检查系统内核参数配置"
    905. index=$(($index+1))
    906. print_check_point $index "$check_point"
    907. print_info "'调整内核安全参数，增强系统安全性，tcp_syncookies的值应设为1'"
    908. print_dot_line
    909. tcp_syncookies=`cat /proc/sys/net/ipv4/tcp_syncookies`
    910. print_info "tcp_syncookies ==> "" [ $tcp_syncookies ]"
    911. if [ "$tcp_syncookies" -eq 1 ]; then
    912.   pass=$(($pass+1))
    913.   print_pass
    914. else
    915.   fail=$(($fail+1))
    916.   print_fail
    917. fi
    918. check_point="其他配置-20:检查系统openssh安全配置"
    919. index=$(($index+1))
    920. print_check_point $index "$check_point"
    921. print_info "'建议系统放弃旧的明文登录协议，使用SSH防止会话劫持和嗅探网络上的敏感数据'"
    922. print_dot_line
    923. X11Forwarding=`cat /etc/ssh/sshd_config  | grep X11Forwarding | egrep -v ^\# | awk '{print $2}'`
    924. MaxAuthTries=`cat /etc/ssh/sshd_config  | grep MaxAuthTries | egrep -v ^\# | awk '{print $2}'`
    925. IgnoreRhosts=`cat /etc/ssh/sshd_config  | grep IgnoreRhosts  | egrep -v ^\# | awk '{print $2}'`
    926. HostbasedAuthentication=`cat /etc/ssh/sshd_config  | grep HostbasedAuthentication | egrep -v ^\# | awk '{print $2}'`
    927. PermitEmptyPasswords=`cat /etc/ssh/sshd_config  | grep PermitEmptyPasswords | egrep -v ^\# | awk '{print $2}'`
    928. print_info "X11Forwarding => "" [ $X11Forwarding ]"
    929. print_info "MaxAuthTries => "" [ $MaxAuthTries ]"
    930. print_info "IgnoreRhosts => "" [ $IgnoreRhosts ]"
    931. print_info "HostbasedAuthentication => "" [ $HostbasedAuthentication ]"
    932. print_info "PermitEmptyPasswords => "" [ $PermitEmptyPasswords ]"
    933. if [ "$X11Forwarding" = "no" ] && [ "$MaxAuthTries" -le 4 ] && [ "$IgnoreRhosts" = "yes" ] && \
    934.   [ "$HostbasedAuthentication" = "no" ] && [ "$PermitEmptyPasswords" = "no" ]; then
    935.   pass=$(($pass+1))
    936.   print_pass
    937. else
    938.   fail=$(($fail+1))
    939.   print_fail
    940. fi
    941. check_point="其他配置-21:检查系统coredump设置"
    942. index=$(($index+1))
    943. print_check_point $index "$check_point"
    944. print_info "'core dump中可能包括系统信息，易被入侵者利用，建议关闭'"
    945. print_info "设置* soft  core、* hard core为0，且注释掉ulimit -S -c 0 > /dev/null 2>&1"
    946. print_dot_line
    947. soft=`cat /etc/security/limits.conf | grep soft | grep core | grep 0 | grep ^*`
    948. hard=`cat /etc/security/limits.conf | grep hard | grep core | grep 0 | grep ^*`
    949. if [ -n "$soft" ] && [ -n "$hard" ]; then
    950.   tmp=`cat /etc/profile | grep "ulimit -S -c 0 > /dev/null 2>&1" | grep -v ^#`
    951.   if [ -n $tmp ]; then
    952.     fail=$(($fail+1))
    953.     print_fail
    954.   else
    955.     pass=$(($pass+1))
    956.     print_pass
    957.   fi
    958. else
    959.   fail=$(($fail+1))
    960.   print_fail
    961. fi
    962. check_point="其他配置-22:检查是否关闭不必要的服务和端口"
    963. index=$(($index+1))
    964. print_check_point $index "$check_point"
    965. print_info "'结合实际业务需要人工判断是否存在不必要的未关闭的端口和服务，请通过以下命令，手工检查'"
    966. print_dot_line
    967. print_info "# chkconfig --list"
    968. manual=$(($manual+1))
    969. print_manual_check
    970. check_point="其他配置-23:检查磁盘空间占用率"
    971. index=$(($index+1))
    972. print_check_point $index "$check_point"
    973. print_info "'检查磁盘空间占用率，建议不超过80%'"
    974. print_dot_line
    975. print_info "`df -h`"
    976. space=$(df -h | awk -F "[ %]+" 'NR!=1''{print $5}')
    977. flag=0
    978. for i in $space
    979. do
    980.   if [ $i -ge 80 ];then
    981.     flag=1
    982.     print_info "请使用命令手工检查磁盘空间占用率情况"
    983.   fi
    984. done
    985. if [ "$flag" -eq 1 ];then
    986.   manual=$(($manual+1))
    987.   print_manual_check
    988. else
    989.   pass=$(($pass+1))
    990.   print_pass
    991. fi
    992. print_summary $index $pass $fail $manual

    参考
    https://github.com/starnightcyber/Miscellaneous/blob/master/%E5%9F%BA%E7%BA%BF%E6%A3%80%E6%9F%A5%26%E5%8A%A0%E5%9B%BA/baseline_os.sh