Linux-Security - Java人

#!/bin/bash
cat <<EOF
*************************************************************************************
***** linux Baseline check script
*************************************************************************************
***** Output results /tmp/linux_security.txt
*************************************************************************************
EOF
FILE_PATH="/tmp/linux_security.txt"
######### Check for system updates ##################
system_update_check(){
num=`yum check-update|grep 'updates'|wc -l`
if [ $num -gt 1 ];then
echo -e " Whether the system update passed :NO \n">>$FILE_PATH
else
echo -e " Whether the system update passed :YES \n">>$FILE_PATH
fi
}
############# Check swap Partition ##############
swap_check(){
swap_sizes=`free -m|grep 'Swap'|awk '{print $2}'`
if [ -z $swap_sizes ];then
echo -e " No, swap System partition \n">>$FILE_PATH
else
if [ $swap_sizes -lt 1000 ];then
echo -e "swap The partition setting is too small \n">>$FILE_PATH
else
echo -e "swap Partition check :YES \n">>$FILE_PATH
fi
fi
}
############# Check the necessary software #############
soft_install_check(){
num=`rpm -qa|egrep '^sysstat-|^man-|^wget-|^screen-|^ntp-'|wc -l`
if [ $num -lt 5 ];then
echo -e "sysstat,man,wget,screen,ntp Whether the installation passed or not :NO \n">>$FILE_PATH
else
echo -e "sysstat,man,wget,screen,ntp Whether the installation passed or not :YES \n">>$FILE_PATH
fi
}
############ Look at the clock time #############
clock_time_type(){
clock_type=`ls -l /etc/localtime |awk -F"/" '{print $8}'`
if [ -n "$clock_type" ];then
echo -e " The system time zone is :$clock_type \n">>$FILE_PATH
else
echo -e " Please check if the time zone is set \n">>$FILE_PATH
fi
}
##### Check the empty password ########
passwd_check(){
num=`awk -F":" '{if($2=="") print $1}' /etc/shadow|wc -l`
if [ $num -gt 0 ];then
echo -e " Check whether the empty password account passed :NO \n">>$FILE_PATH
else
echo -e " Check whether the empty password account passed :YES \n">>$FILE_PATH
fi
}
##### Check users uid Is it 0########
passwd_uid_check(){
num=`awk -F":" '{if($3=="0" && $1!="root") print $1}' /etc/passwd|wc -l`
if [ $num -gt 0 ];then
echo -e " Not root Account UID Check whether it passes :NO \n">>$FILE_PATH
else
echo -e " Not root Account UID Check whether it passes :YES \n">>$FILE_PATH
fi
}
######### Check umask############
user_umask_check(){
root_umask=`umask`
user_umask=`grep -A 1 '\$UID -gt 199' /etc/profile|grep 'umask'|awk '{print $2}'`
if [ $root_umask == "0022" ] && [ $user_umask == "002" ];then
echo -e " Account umask Check whether it passes :YES \n">>$FILE_PATH
else
echo -e " Account umask Check whether it passes :NO \n">>$FILE_PATH
fi
}
######## Check important file permissions ##########
file_lsattr_check(){
num=0
files=(/etc/passwd /etc/shadow)
for file in ${files[*]}
do
attr=`lsattr $file|awk '{print $1}'`
if [ $attr != "----i--------e-" ];then
num=$(($num+1))
fi
done
if [ $num -eq 0 ];then
echo -e " Whether important file settings pass :YES \n">>$FILE_PATH
else
echo -e " Whether important file settings pass :NO \n">>$FILE_PATH
fi
}
###########ssh Protocol and password authentication ################
ssh_config_check(){
echo -e " Check sshd_config The configuration file : \n">>$FILE_PATH
##### Check the item ######
check_items=(ListenAddress Protocol StrictModes MaxAuthTries MaxSessions PubkeyAuthentication PasswordAuthentication PermitEmptyPasswords X11Forwarding)
####### reference value #############
proposal_value=(" Refer to the actual situation " 2 yes 5 5 yes no no no)
i=0
for item in ${check_items[*]}
do
value=`grep $item /etc/ssh/sshd_config|grep -v '^#'|awk '{print $2}'`
echo "${check_items[$i]}:${value} recommended value :${proposal_value[$i]}">>$FILE_PATH
i=$(($i+1))
done
}
############ Firewall service status ####################
firewall_check(){
grep 'release 6' /etc/redhat-release >>/dev/null
if [ $? -eq 0 ];then
/etc/init.d/iptables status>>/dev/null
if [ $? -eq 0 ];then
echo -e " Whether the firewall status is passed :YES \n">>$FILE_PATH
else
echo -e " Whether the firewall status is passed :NO \n">>$FILE_PATH
fi
else
systemctl status firewalld.service >>/dev/null
if [ $? -eq 0 ];then
echo -e " Whether the firewall status is passed :YES \n">>$FILE_PATH
else
echo -e " Whether the firewall status is passed :NO \n">>$FILE_PATH
fi
fi
}
############ntp Service status ####################
ntp_check(){
grep 'release 6' /etc/redhat-release >>/dev/null
if [ $? -eq 0 ];then
/etc/init.d/ntpd status>>/dev/null
if [ $? -eq 0 ];then
echo -e "ntp Whether the status is passed or not :YES \n">>$FILE_PATH
else
echo -e "ntp Whether the status is passed or not :NO \n">>$FILE_PATH
fi
else
systemctl status ntpd.service >>/dev/null
if [ $? -eq 0 ];then
echo -e "ntp Whether the status is passed or not :YES \n">>$FILE_PATH
else
echo -e "ntp Whether the status is passed or not :NO \n">>$FILE_PATH
fi
fi
}
############auditd Service status ####################
auditd_check(){
grep 'release 6' /etc/redhat-release >>/dev/null
if [ $? -eq 0 ];then
/etc/init.d/auditd status>>/dev/null
if [ $? -eq 0 ];then
echo -e "auditd Whether the status is passed or not :YES \n">>$FILE_PATH
else
echo -e "auditd Whether the status is passed or not :NO \n">>$FILE_PATH
fi
else
systemctl status auditd.service >>/dev/null
if [ $? -eq 0 ];then
echo -e "auditd Whether the status is passed or not :YES \n">>$FILE_PATH
else
echo -e "auditd Whether the status is passed or not :NO \n">>$FILE_PATH
fi
fi
}
############# Check for unnecessary services ###############
service_check(){
echo " Check the system for redundant services ,centos6:acpid|ip6tables|netfs|postfix|udev-post">>$FILE_PATH
echo " Check the system for redundant services ,centos7:postfix.service tuned.service irqbalance.service">>$FILE_PATH
grep 'release 6' /etc/redhat-release >>/dev/null
if [ $? -eq 0 ];then
cent6_num=`chkconfig --list|egrep '3:on|3: Enable '|egrep 'acpid|ip6tables|netfs|postfix|udev-post'|wc -l`
if [ $cent6_num -eq 0 ];then
echo -e " Whether the redundant service of the system is shut down :YES \n">>$FILE_PATH
else
echo -e " Whether the redundant service of the system is shut down :NO \n">>$FILE_PATH
fi
else
cent7_num=`systemctl list-unit-files --type=service|grep 'enabled'|egrep 'postfix.service|tuned.service|irqbalance.service'|wc -l`
if [ $cent7_num -eq 0 ];then
echo -e " Whether the redundant service of the system is shut down :YES \n">>$FILE_PATH
else
echo -e " Whether the redundant service of the system is shut down :NO \n">>$FILE_PATH
fi
fi
}
############ Check the number of open files ##############
file_check(){
system_file_limit=`cat /proc/sys/fs/file-max`
#current_open_file=`lsof|wc -l`
user_file_limit=`ulimit -a|grep 'open files'|awk '{print $4}'`
echo " System open limit :$system_file_limit">>$FILE_PATH
echo " User process open limit :$user_file_limit">>$FILE_PATH
}
echo `date +%Y%m%d`>$FILE_PATH
system_update_check
swap_check
soft_install_check
clock_time_type
passwd_check
passwd_uid_check
user_umask_check
file_lsattr_check
ssh_config_check
firewall_check
ntp_check
auditd_check
service_check
file_check