#!/bin/bash #version 2.0cat <<EOF ************************************************************************************* ***** linux基線檢查腳本 ***** ************************************************************************************* ***** linux基線配置規范設計 ***** ***** 輸出結果/tmp/${ipadd}_out.txt ***** ************************************************************************************* EOFecho "***************************" echo "賬號策略檢查中..." echo "***************************" ipadd=`ifconfig -a | grep Bcast | awk -F "[ :]+" '{print $4}'` passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'` passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'` passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'` passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`if [ $passmax -le 90 -a $passmax -gt 0];thenecho "口令生存周期為${passmax}天，符合要求" >> /tmp/${ipadd}_out.txt elseecho "口令生存周期為${passmax}天，不符合要求,建議設置不大于90天" >> /tmp/${ipadd}_out.txt fiif [ $passmin -ge 6 ];thenecho "口令更改最小時間間隔為${passmin}天，符合要求" >> /tmp/${ipadd}_out.txt elseecho "口令更改最小時間間隔為${passmin}天，不符合要求，建議設置大于等于6天" >> /tmp/${ipadd}_out.txt fiif [ $passlen -ge 8 ];thenecho "口令最小長度為${passlen},符合要求" >> /tmp/${ipadd}_out.txt elseecho "口令最小長度為${passlen},不符合要求，建議設置最小長度大于等于8" >> /tmp/${ipadd}_out.txt fiif [ $passage -ge 30 -a $passage -lt $passmax ];thenecho "口令過期警告時間天數為${passage},符合要求" >> /tmp/${ipadd}_out.txt elseecho "口令過期警告時間天數為${passage},不符合要求，建議設置大于等于30并小于口令生存周期" >> /tmp/${ipadd}_out.txt fiecho "***************************" echo "賬號是否會主動注銷檢查中..." echo "***************************" cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}' if [ $? -eq 0 ];thenTMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'`if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];thenecho "賬號超時時間${TMOUT}秒,符合要求" >> /tmp/${ipadd}_out.txtelseecho "賬號超時時間${TMOUT}秒,不符合要求，建議設置小于600秒" >> /tmp/${ipadd}_out.txtfi elseecho "賬號超時不存在自動注銷,不符合要求，建議設置小于600秒" >> /tmp/${ipadd}_out.txt fi#grub和lilo密碼是否設置檢查 cat /etc/grub.conf | grep password 2> /dev/null if [ $? -eq 0 ];thenecho "已設置grub密碼,符合要求" >> /tmp/${ipadd}_out.txt elseecho "沒有設置grub密碼，不符合要求,建議設置grub密碼" >> /tmp/${ipadd}_out.txt ficat /etc/lilo.conf | grep password 2> /dev/null if [ $? -eq 0 ];thenecho "已設置lilo密碼,符合要求" >> /tmp/${ipadd}_out.txt elseecho "沒有設置lilo密碼，不符合要求,建議設置lilo密碼" >> /tmp/${ipadd}_out.txt fi#查找非root賬號UID為0的賬號 UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd` flag=0 for i in $UIDS doif [ $i = 0 ];thenecho "存在非root賬號的賬號UID為0，不符合要求" >> /tmp/${ipadd}_out.txtelseflag=1fi done if [ $flag = 1 ];thenecho "不存在非root賬號的賬號UID為0，符合要求" >> /tmp/${ipadd}_out.txt fi#檢查umask設置 umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'` umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'` umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'` flags=0 for i in $umask1 doif [ $i = "027" ];thenecho "/etc/profile文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi done if [ $flags = 1 ];thenecho "/etc/profile文件中所所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt fi flags=0 for i in $umask2 doif [ $i = "027" ];thenecho "/etc/csh.cshrc文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi done if [ $flags = 1 ];thenecho "/etc/csh.cshrc文件中所所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt fiflags=0 for i in $umask3 doif [ $i = "027" ];thenecho "/etc/bashrc文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi done if [ $flags = 1 ];thenecho "/etc/bashrc文件中所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt fiecho "***************************" echo "檢查重要文件權限中..." echo "***************************"file1=`ls -l /etc/passwd | awk '{print $1}'` file2=`ls -l /etc/shadow | awk '{print $1}'` file3=`ls -l /etc/group | awk '{print $1}'` file4=`ls -l /etc/securetty | awk '{print $1}'` file5=`ls -l /etc/services | awk '{print $1}'` file6=`ls -l /etc/xinetd.conf | awk '{print $1}'` file7=`ls -l /etc/grub.conf | awk '{print $1}'` file8=`ls -l /etc/lilo.conf | awk '{print $1}'`if [ $file1 = "-rw-r--r--" ];thenecho "/etc/passwd文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/passwd文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt fiif [ $file2 = "-r--------" ];thenecho "/etc/shadow文件權限為400，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/shadow文件權限不為400，不符合要求，建議設置權限為400" >> /tmp/${ipadd}_out.txt fiif [ $file3 = "-rw-r--r--" ];thenecho "/etc/group文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/group文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt fiif [ $file4 = "-rw-------" ];thenecho "/etc/security文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/security文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt fiif [ $file5 = "-rw-r--r--" ];thenecho "/etc/services文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/services文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt fiif [ $file6 = "-rw-------" ];thenecho "/etc/xinetd.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/xinetd.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt fiif [ $file7 = "-rw-------" ];thenecho "/etc/grub.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt elseecho "/etc/grub.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt fiif [ -f /etc/lilo.conf ];thenif [ $file8 = "-rw-------" ];thenecho "/etc/lilo.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txtelseecho "/etc/lilo.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txtfielseecho "/etc/lilo.conf文件夾不存在" ficat /etc/security/limits.conf | grep -V ^# | grep core if [ $? -eq 0 ];thensoft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`for i in $softdoif [ $i = "soft" ];thenecho "* soft core 0 已經設置" >> /tmp/${ipadd}_out.txtfiif [ $i = "hard" ];thenecho "* hard core 0 已經設置" >> /tmp/${ipadd}_out.txtfidone else echo "沒有設置core，建議在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> /tmp/${ipadd}_out.txt fiecho "***************************" echo "檢查ssh配置文件中..." echo "***************************" cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no" if [ $? -eq 0 ];thenecho "已經設置遠程root不能登陸，符合要求" >> /tmp/${ipadd}_out.txt elseecho "不已經設置遠程root不能登陸，不符合要求，建議/etc/ssh/sshd_config添加PermitRootLogin no" >> /tmp/${ipadd}_out.txt fi#檢查telnet是否開啟 telnetd=`cat /etc/xinetd.d/telnet | grep disable | awk '{print $3}'` if [ $telnetd = "yes" ];thenecho "檢測到telnet服務開啟，不符合要求，建議關閉telnet" >> /tmp/${ipadd}_out.txt fiProtocol=`cat /etc/ssh/sshd_config | grep -v ^# | grep Protocol | awk '{print $2}'` if [ $Protocol = 2 ];thenecho "openssh使用ssh2協議，符合要求" >> /tmp/${ipadd}_out.txt fi if [ $Protocol = 1 ];thenecho "openssh使用ssh1協議，不符合要求" >> /tmp/${ipadd}_out.txt fi#檢查保留歷時命令條數 HISTSIZE=`cat /etc/profile|grep HISTSIZE|head -1|awk -F[=] '{print $2}'` if [ $HISTSIZE -eq 5 ];thenecho "保留歷時命令條數為$HISTSIZE,符合要求" >> /tmp/${ipadd}_out.txt elseecho "保留歷時命令條數為$HISTSIZE,不符合要求，建議/etc/profile的HISTSIZE設置為5" >> /tmp/${ipadd}_out.txt fi#檢查重要文件的屬性 flag=0 for ((x=1;x<=15;x++)) doapend=`lsattr /etc/passwd | cut -c $x`if [ $apend = "i" ];thenecho "/etc/passwd文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/passwd文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi done if [ $flag = 0 ];thenecho "/etc/passwd文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/passwd被刪除或修改" >> /tmp/${ipadd}_out.txt fiflag=0 for ((x=1;x<=15;x++)) doapend=`lsattr /etc/shadow | cut -c $x`if [ $apend = "i" ];thenecho "/etc/shadow文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/shadow文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi done if [ $flag = 0 ];thenecho "/etc/shadow文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/shadow被刪除或修改" >> /tmp/${ipadd}_out.txt fiflag=0 for ((x=1;x<=15;x++)) doapend=`lsattr /etc/gshadow | cut -c $x`if [ $apend = "i" ];thenecho "/etc/gshadow文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/gshadow文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi done if [ $flag = 0 ];thenecho "/etc/gshadow文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/gshadow被刪除或修改" >> /tmp/${ipadd}_out.txt fiflag=0 for ((x=1;x<=15;x++)) doapend=`lsattr /etc/group | cut -c $x`if [ $apend = "i" ];thenecho "/etc/group文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/group文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi done if [ $flag = 0 ];thenecho "/etc/group文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/group被刪除或修改" >> /tmp/${ipadd}_out.txt fi#檢查snmp默認團體口令public、private if [ -f /etc/snmp/snmpd.conf ];thenpublic=`cat /etc/snmp/snmpd.conf | grep public | grep -v ^# | awk '{print $4}'`private=`cat /etc/snmp/snmpd.conf | grep private | grep -v ^# | awk '{print $4}'`if [ $public = "public" ];thenecho "發現snmp服務存在默認團體名public,不符合要求" >> /tmp/${ipadd}_out.txtfiif [[ $private = "private" ]];thenecho "發現snmp服務存在默認團體名private,不符合要求" >> /tmp/${ipadd}_out.txtfi elseecho "snmp服務配置文件不存在，可能沒有運行snmp服務" fi#檢查主機信任關系 rhosts=`find / -name .rhosts` rhosts2=`find / -name hosts.equiv` for i in $rhosts doif [ -f $i ];thenecho "找到信任主機關系，請查看${i}文件,請自行判斷是否屬于正常業務需求，建議刪除信任IP" >> /tmp/${ipadd}_out.txtfi done#檢查日志審核功能是否開啟 service auditd status if [ $? = 0 ];thenecho "系統日志審核功能已開啟，符合要求" >> /tmp/${ipadd}_out.txt fi if [ $? = 3 ];thenecho "系統日志審核功能已關閉，不符合要求，建議service auditd start開啟" >> /tmp/${ipadd}_out.txt fi#檢查磁盤動態空間，是否大于等于80% space=`df -h | awk -F "[ %]+" 'NR!=1{print $5}'` for i in $space doif [ $i -ge 80 ];thenecho "警告！磁盤存儲容量大于80%,建議擴充磁盤容量或者刪除垃圾文件" >> /tmp/${ipadd}_out.txtfi doneecho "***************************" echo "*** 檢查完畢 ***" echo "***************************"

總結

以上是生活随笔為你收集整理的linux基线核查脚本的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。