#!/bin/bash
#version 2.0cat <<EOF
*************************************************************************************
*****				linux基線檢查腳本	  	     		*****
*************************************************************************************
*****				linux基線配置規范設計				*****
*****				輸出結果/tmp/${ipadd}_out.txt					*****
*************************************************************************************
EOFecho "***************************"
echo "賬號策略檢查中..."
echo "***************************"
ipadd=`ifconfig -a | grep Bcast | awk -F "[ :]+" '{print $4}'`
passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'`
passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'`
passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'`
passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`if [ $passmax -le 90 -a $passmax -gt 0];thenecho "口令生存周期為${passmax}天，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "口令生存周期為${passmax}天，不符合要求,建議設置不大于90天" >> /tmp/${ipadd}_out.txt
fiif [ $passmin -ge 6 ];thenecho "口令更改最小時間間隔為${passmin}天，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "口令更改最小時間間隔為${passmin}天，不符合要求，建議設置大于等于6天" >> /tmp/${ipadd}_out.txt
fiif [ $passlen -ge 8 ];thenecho "口令最小長度為${passlen},符合要求" >> /tmp/${ipadd}_out.txt
elseecho "口令最小長度為${passlen},不符合要求，建議設置最小長度大于等于8" >> /tmp/${ipadd}_out.txt
fiif [ $passage -ge 30 -a $passage -lt $passmax ];thenecho "口令過期警告時間天數為${passage},符合要求" >> /tmp/${ipadd}_out.txt
elseecho "口令過期警告時間天數為${passage},不符合要求，建議設置大于等于30并小于口令生存周期" >> /tmp/${ipadd}_out.txt
fiecho "***************************"
echo "賬號是否會主動注銷檢查中..."
echo "***************************"
cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}' 
if [ $? -eq 0 ];thenTMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'`if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];thenecho "賬號超時時間${TMOUT}秒,符合要求" >> /tmp/${ipadd}_out.txtelseecho "賬號超時時間${TMOUT}秒,不符合要求，建議設置小于600秒" >> /tmp/${ipadd}_out.txtfi
elseecho "賬號超時不存在自動注銷,不符合要求，建議設置小于600秒" >> /tmp/${ipadd}_out.txt 
fi#grub和lilo密碼是否設置檢查
cat /etc/grub.conf | grep password 2> /dev/null
if [ $? -eq 0 ];thenecho "已設置grub密碼,符合要求" >> /tmp/${ipadd}_out.txt
elseecho "沒有設置grub密碼，不符合要求,建議設置grub密碼" >> /tmp/${ipadd}_out.txt
ficat /etc/lilo.conf | grep password 2> /dev/null
if [ $? -eq 0 ];thenecho "已設置lilo密碼,符合要求" >> /tmp/${ipadd}_out.txt
elseecho "沒有設置lilo密碼，不符合要求,建議設置lilo密碼" >> /tmp/${ipadd}_out.txt
fi#查找非root賬號UID為0的賬號
UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd`
flag=0
for i in $UIDS
doif [ $i = 0 ];thenecho "存在非root賬號的賬號UID為0，不符合要求" >> /tmp/${ipadd}_out.txtelseflag=1fi
done
if [ $flag = 1 ];thenecho "不存在非root賬號的賬號UID為0，符合要求" >> /tmp/${ipadd}_out.txt
fi#檢查umask設置
umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'`
umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'`
umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'`
flags=0
for i in $umask1
doif [ $i = "027" ];thenecho "/etc/profile文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi
done
if [ $flags = 1 ];thenecho "/etc/profile文件中所所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt
fi flags=0
for i in $umask2
doif [ $i = "027" ];thenecho "/etc/csh.cshrc文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi
done  
if [ $flags = 1 ];thenecho "/etc/csh.cshrc文件中所所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt
fiflags=0
for i in $umask3
doif [ $i = "027" ];thenecho "/etc/bashrc文件中所設置的umask為${i},符合要求" >> /tmp/${ipadd}_out.txtelseflags=1fi
done
if [ $flags = 1 ];thenecho "/etc/bashrc文件中所設置的umask為${i},不符合要求，建議設置為027" >> /tmp/${ipadd}_out.txt
fiecho "***************************"
echo "檢查重要文件權限中..."
echo "***************************"file1=`ls -l /etc/passwd | awk '{print $1}'`
file2=`ls -l /etc/shadow | awk '{print $1}'`
file3=`ls -l /etc/group | awk '{print $1}'`
file4=`ls -l /etc/securetty | awk '{print $1}'`
file5=`ls -l /etc/services | awk '{print $1}'`
file6=`ls -l /etc/xinetd.conf | awk '{print $1}'`
file7=`ls -l /etc/grub.conf | awk '{print $1}'`
file8=`ls -l /etc/lilo.conf | awk '{print $1}'`if [ $file1 = "-rw-r--r--" ];thenecho "/etc/passwd文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/passwd文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt
fiif [ $file2 = "-r--------" ];thenecho "/etc/shadow文件權限為400，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/shadow文件權限不為400，不符合要求，建議設置權限為400" >> /tmp/${ipadd}_out.txt
fiif [ $file3 = "-rw-r--r--" ];thenecho "/etc/group文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/group文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt
fiif [ $file4 = "-rw-------" ];thenecho "/etc/security文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/security文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt
fiif [ $file5 = "-rw-r--r--" ];thenecho "/etc/services文件權限為644，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/services文件權限不為644，不符合要求，建議設置權限為644" >> /tmp/${ipadd}_out.txt
fiif [ $file6 = "-rw-------" ];thenecho "/etc/xinetd.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/xinetd.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt
fiif [ $file7 = "-rw-------" ];thenecho "/etc/grub.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "/etc/grub.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txt
fiif [ -f /etc/lilo.conf ];thenif [ $file8 = "-rw-------" ];thenecho "/etc/lilo.conf文件權限為600，符合要求" >> /tmp/${ipadd}_out.txtelseecho "/etc/lilo.conf文件權限不為600，不符合要求，建議設置權限為600" >> /tmp/${ipadd}_out.txtfielseecho "/etc/lilo.conf文件夾不存在"
ficat /etc/security/limits.conf | grep -V ^# | grep core
if [ $? -eq 0 ];thensoft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`for i in $softdoif [ $i = "soft" ];thenecho "* soft core 0 已經設置" >> /tmp/${ipadd}_out.txtfiif [ $i = "hard" ];thenecho "* hard core 0 已經設置" >> /tmp/${ipadd}_out.txtfidone
else echo "沒有設置core，建議在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> /tmp/${ipadd}_out.txt
fiecho "***************************"
echo "檢查ssh配置文件中..."
echo "***************************"
cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no"
if [ $? -eq 0 ];thenecho "已經設置遠程root不能登陸，符合要求" >> /tmp/${ipadd}_out.txt
elseecho "不已經設置遠程root不能登陸，不符合要求，建議/etc/ssh/sshd_config添加PermitRootLogin no" >> /tmp/${ipadd}_out.txt
fi#檢查telnet是否開啟
telnetd=`cat /etc/xinetd.d/telnet | grep disable | awk '{print $3}'`
if [ $telnetd = "yes" ];thenecho "檢測到telnet服務開啟，不符合要求，建議關閉telnet" >> /tmp/${ipadd}_out.txt
fiProtocol=`cat /etc/ssh/sshd_config | grep -v ^# | grep Protocol | awk '{print $2}'`
if [ $Protocol = 2 ];thenecho "openssh使用ssh2協議，符合要求" >> /tmp/${ipadd}_out.txt
fi
if [ $Protocol = 1 ];thenecho "openssh使用ssh1協議，不符合要求" >> /tmp/${ipadd}_out.txt
fi#檢查保留歷時命令條數
HISTSIZE=`cat /etc/profile|grep HISTSIZE|head -1|awk -F[=] '{print $2}'`
if [ $HISTSIZE -eq 5 ];thenecho "保留歷時命令條數為$HISTSIZE,符合要求" >> /tmp/${ipadd}_out.txt
elseecho "保留歷時命令條數為$HISTSIZE,不符合要求，建議/etc/profile的HISTSIZE設置為5" >> /tmp/${ipadd}_out.txt
fi#檢查重要文件的屬性
flag=0
for ((x=1;x<=15;x++))
doapend=`lsattr /etc/passwd | cut -c $x`if [ $apend = "i" ];thenecho "/etc/passwd文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/passwd文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi
done
if [ $flag = 0 ];thenecho "/etc/passwd文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/passwd被刪除或修改" >> /tmp/${ipadd}_out.txt
fiflag=0
for ((x=1;x<=15;x++))
doapend=`lsattr /etc/shadow | cut -c $x`if [ $apend = "i" ];thenecho "/etc/shadow文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/shadow文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi
done
if [ $flag = 0 ];thenecho "/etc/shadow文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/shadow被刪除或修改" >> /tmp/${ipadd}_out.txt
fiflag=0
for ((x=1;x<=15;x++))
doapend=`lsattr /etc/gshadow | cut -c $x`if [ $apend = "i" ];thenecho "/etc/gshadow文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/gshadow文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi
done
if [ $flag = 0 ];thenecho "/etc/gshadow文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/gshadow被刪除或修改" >> /tmp/${ipadd}_out.txt
fiflag=0
for ((x=1;x<=15;x++))
doapend=`lsattr /etc/group | cut -c $x`if [ $apend = "i" ];thenecho "/etc/group文件存在i安全屬性" >> /tmp/${ipadd}_out.txtflag=1fiif [ $apend = "a" ];thenecho "/etc/group文件存在a安全屬性" >> /tmp/${ipadd}_out.txtflag=1fi
done
if [ $flag = 0 ];thenecho "/etc/group文件不存在相關安全屬性，建議使用chattr +i或chattr +a防止/etc/group被刪除或修改" >> /tmp/${ipadd}_out.txt
fi#檢查snmp默認團體口令public、private
if [ -f /etc/snmp/snmpd.conf ];thenpublic=`cat /etc/snmp/snmpd.conf | grep public | grep -v ^# | awk '{print $4}'`private=`cat /etc/snmp/snmpd.conf | grep private | grep -v ^# | awk '{print $4}'`if [ $public = "public" ];thenecho "發現snmp服務存在默認團體名public,不符合要求" >> /tmp/${ipadd}_out.txtfiif [[ $private = "private" ]];thenecho "發現snmp服務存在默認團體名private,不符合要求" >> /tmp/${ipadd}_out.txtfi
elseecho "snmp服務配置文件不存在，可能沒有運行snmp服務" 
fi#檢查主機信任關系
rhosts=`find / -name .rhosts`
rhosts2=`find / -name hosts.equiv`
for i in $rhosts
doif [ -f $i ];thenecho "找到信任主機關系，請查看${i}文件,請自行判斷是否屬于正常業務需求，建議刪除信任IP" >> /tmp/${ipadd}_out.txtfi 
done#檢查日志審核功能是否開啟
service auditd status
if [ $? = 0 ];thenecho "系統日志審核功能已開啟，符合要求" >> /tmp/${ipadd}_out.txt
fi
if [ $? = 3 ];thenecho "系統日志審核功能已關閉，不符合要求，建議service auditd start開啟" >> /tmp/${ipadd}_out.txt
fi#檢查磁盤動態空間，是否大于等于80%
space=`df -h | awk -F "[ %]+" 'NR!=1{print $5}'`
for i in $space
doif [ $i -ge 80 ];thenecho "警告！磁盤存儲容量大于80%,建議擴充磁盤容量或者刪除垃圾文件" >> /tmp/${ipadd}_out.txtfi
doneecho "***************************"
echo "***	檢查完畢      ***"
echo "***************************"