linux各版本基線檢查指令碼(centos6、centos7、ubuntu系列)
阿新 • • 發佈：2018-11-27
以下是centos7基線檢查指令碼：
1 #!/bin/bash 2 #version v1.0 by pensar 3 #作業系統linux 配置規範--centos7 4 cat <<EOF 5 *************************************************************** 6 linux安全配置檢查指令碼: 7 1. 輸出結果在/tmp/check/目錄下檢視 8 2.檢查範圍及檢查項(共計4大類，33項) 9 *日誌審計配置*： 10 [1]檢查Cron任務授權centos 7基線檢查11 [2]檢查是否對syslog登入事件記錄 12 [3]檢查是否對rsyslog.conf配置稽核 13 [4]檢查系統日誌讀寫許可權 14 [5]檢查是否對遠端日誌伺服器配置 15 *系統檔案管理*： 16 [1]檢查是否對登入超時時間配置 17 [2]檢查系統磁碟狀態 18 [3]檢查是否禁止匿名FTP訪問 19 [4]檢查是否修改FTP banner 資訊 20 [5]檢查是否關閉不必要的服務 21 [6]檢查系統core dump狀態 22 [7]檢查系統補丁23 *使用者賬號配置*： 24 [1]檢查是否存在無用賬號 25 [2]檢查不同使用者是否共享賬號 26 [3]檢查是否刪除或鎖定無用賬號 27 [4]檢查是否存在無用使用者組 28 [5]檢查是否指定使用者組成員使用su命令 29 [6]檢查密碼長度及複雜度策略 30 [7]檢查是否對使用者遠端登入進行限制 31 [8]檢查是否配置加密協議 32 [9]檢查是否配置密碼的生存期 33 [10]檢查使用者預設訪問許可權 34 [11]檢查passwd group檔案安全許可權 35 [12]檢查是否存在除root之外UID為0的使用者 36 [13]檢查是否配置環境變數 37 [14]檢查是否對遠端連線的安全性進行配置 38 [15]檢查是否對使用者的umask進行配置 39 [16]檢查是否對重要目錄和檔案的許可權進行設定 40 [17]檢查是否存在未授權的suid/sgid檔案 41 [18]檢查是否存在異常隱含檔案 42 *網路通訊配置*： 43 [1]檢查是否對基本網路服務進行配置 44 [2]檢查是否開啟NFS服務 45 [3]檢查常規網路服務是否執行正常 46 *************************************************************** 47 EOF 48 mkdir /tmp/check 49 str1=`/sbin/ifconfig -a | grep inet | grep -v 127.0.0.1 | grep -v inet6 | awk '{print $2}' | tr -d "addr:" | head -n 1` 50 str=`date +%Y%m%d%H%M`_"$str1" 51 52 echo "----**日誌審計配置**----" >> /tmp/check/${str}_out.txt 53 echo "[1] 檢查Cron任務授權" >> /tmp/check/${str}_out.txt 54 if [ -e /etc/cron.deny ] && [ -e /etc/at.deny ];then 55 CRON_DENY=`ls -l /etc/cron.deny | awk '{print $1}'` 56 AT_DENY=`ls -l /etc/at.deny | awk '{print $1}'` 57 echo "/etc/cron.deny檔案授權情況為：${CRON_DENY:1:9}" >> /tmp/check/${str}_out.txt 58 echo "/etc/at.deny檔案授權情況為：${AT_DENY:1:9}" >> /tmp/check/${str}_out.txt 59 echo "{'Check_point':'檢查Cron任務授權','Check_result':{'/etc/cron.deny檔案授權情況為':'${CRON_DENY:1:9}','/etc/at.deny檔案授權情況為':'${AT_DENY:1:9}'}}" >> /tmp/check/${str}_dict.txt 60 CRON=`cat /etc/rsyslog.conf | grep "cron.\*"` 61 echo "/etc/rsyslog.conf的配置情況為：${CRON}" >> /tmp/check/${str}_out.txt 62 else 63 echo "未找到/etc/cron.deny和/etc/at.deny配置檔案" >> /tmp/check/${str}_out.txt 64 fi 65 66 echo "----------------------------" >> /tmp/check/${str}_out.txt 67 echo "[2]檢查是否對syslog登入事件記錄" >> /tmp/check/${str}_out.txt 68 if [ -e /etc/syslog.conf ];then 69 Clog=`cat /etc/syslog.conf | grep /var/log/secure | grep -E "authpriv\.\*"` 70 echo "/etc/syslog.conf的配置為：${Clog}" >> /tmp/check/${str}_out.txt 71 else 72 echo "未找到/etc/syslog.conf配置檔案" >> /tmp/check/${str}_out.txt 73 fi 74 75 echo "----------------------------" >> /tmp/check/${str}_out.txt 76 echo "[3]檢查是否對rsyslog.conf配置稽核" >> /tmp/check/${str}_out.txt 77 if [ -e /etc/rsyslog.conf ];then 78 LOG=`cat /etc/rsyslog.conf | grep @loghost` 79 echo "rsyslog.conf檔案的配置為${LOG}" >> /tmp/check/${str}_out.txt 80 else 81 echo "未找到/etc/rsyslog.conf配置檔案" >> /tmp/check/${str}_out.txt 82 fi 83 84 echo "----------------------------" >> /tmp/check/${str}_out.txt 85 echo "[4]檢查系統日誌讀寫許可權" >> /tmp/check/${str}_out.txt 86 if [ -e /var/log/messages ];then 87 MESSAGES=`ls -l /var/log/messages | awk '{print $1}'` 88 echo "/var/log/messages的檔案許可權為：${MESSAGES:1:9}" >> /tmp/check/${str}_out.txt 89 else 90 echo "未找到/var/log/messages的檔案" >> /tmp/check/${str}_out.txt 91 fi 92 if [ -e /var/log/secure ];then 93 SECURE=`ls -l /var/log/secure | awk '{print $1}'` 94 echo "/var/log/secure 的檔案許可權為：${SECURE:1:9}" >> /tmp/check/${str}_out.txt 95 else 96 echo "未找到/var/log/secure的檔案" >> /tmp/check/${str}_out.txt 97 fi 98 99 if [ -e /var/log/maillog ];then 100 MAILLOG=`ls -l /var/log/maillog | awk '{print $1}'` 101 echo "/var/log/maillog 的檔案許可權為：${MAILLOG:1:9}" >> /tmp/check/${str}_out.txt 102 else 103 echo "未找到/var/log/maillog的檔案" >> /tmp/check/${str}_out.txt 104 fi 105 106 if [ -e /var/log/cron ];then 107 CRON=`ls -l /var/log/cron | awk '{print $1}'` 108 echo "/var/log/cron 的檔案許可權為：${CRON:1:9}" >> /tmp/check/${str}_out.txt 109 else 110 echo "未找到/var/log/cron的檔案" >> /tmp/check/${str}_out.txt 111 fi 112 if [ -e /var/log/spooler ];then 113 SPOOLER=`ls -l /var/log/spooler | awk '{print $1}'` 114 echo "/var/log/spooler 的檔案許可權為：${SPOOLER:1:9}" >> /tmp/check/${str}_out.txt 115 else 116 echo "未找到/var/log/spooler的檔案" >> /tmp/check/${str}_out.txt 117 fi 118 119 if [ -e /var/log/boot/log ];then 120 LOG=`ls -l /var/log/boot/log | awk '{print $1}'` 121 echo "/var/log/boot/log 的檔案許可權為：${LOG:1:9}" >> /tmp/check/${str}_out.txt 122 else 123 echo "未找到/var/log/boot/log的檔案" >> /tmp/check/${str}_out.txt 124 fi 125 126 echo "----------------------------" >> /tmp/check/${str}_out.txt 127 echo "[5]檢查是否對遠端日誌伺服器配置" >> /tmp/check/${str}_out.txt 128 if [ -e /etc/rsyslog.conf ];then 129 RSYS=`cat /etc/rsyslog.conf | grep "@${str1}" | grep $'\t' | grep \.\*` 130 echo "遠端日誌伺服器配置情況為：${RSYS}" >> /tmp/check/${str}_out.txt 131 else 132 echo "未找到/etc/rsyslog.conf配置檔案" >> /tmp/check/${str}_out.txt 133 fi 134 echo "----------------------------" >> /tmp/check/${str}_out.txt 135 echo "" 136 echo "----**系統檔案管理**----" >> /tmp/check/${str}_out.txt 137 echo "[1]檢查是否對登入超時時間配置" >> /tmp/check/${str}_out.txt 138 if [ -e /etc/profile ] && [ -e /etc/bashrc ]; then 139 TMOUT=`cat /etc/profile | grep HISTTIMEFORMAT | grep TMOUT` 140 if [ -n ${TMOUT} ]; then 141 echo "/etc/profile的超時時間設定情況為：${TMOUT}" >> /tmp/check/${str}_out.txt 142 FORMAT=`cat /etc/bashrc | grep export | grep HISTTIMEFORMAT` 143 if [ -n ${FORMAT} ];then 144 echo "/etc/bashrc的設定為${FORMAT}" >> /tmp/check/${str}_out.txt 145 else 146 echo "/etc/bashrc不存在對應配置" >> /tmp/check/${str}_out.txt 147 fi 148 else 149 echo "/etc/profile檔案不存在對應配置" >> /tmp/check/${str}_out.txt 150 fi 151 else 152 echo "不存在/etc/profile檔案以及/etc/bashrc檔案" >> /tmp/check/${str}_out.txt 153 fi 154 155 156 echo "----------------------------" >> /tmp/check/${str}_out.txt 157 echo "[2]檢查系統磁碟狀態" >> /tmp/check/${str}_out.txt 158 DF=`df -h | awk 'NR!=1{print $5}' | awk -F[\%] '{print $1}'` 159 for i in $DF 160 do 161 if [ $i -ge 80 ];then 162 flag=1 163 else 164 flag=0 165 fi 166 done 167 if [ $flag = 1 ];then 168 echo "系統磁碟使用率大於80%" >> /tmp/check/${str}_out.txt 169 else [ $flag = 0 ] 170 echo "系統磁碟狀態小於80%" >> /tmp/check/${str}_out.txt 171 fi 172 173 echo "----------------------------" >> /tmp/check/${str}_out.txt 174 echo "[3]檢查是否禁止匿名FTP訪問" >> /tmp/check/${str}_out.txt 175 if [ -e /etc/vsftpd.conf ];then 176 cat /etc/vsftpd.conf | grep "anonymous_enable=NO" 177 if [ $? -eq 0 ]; then 178 echo "/etc/vsftpd.conf檔案有設定：anonymous_enable=NO" >> /tmp/check/${str}_out.txt 179 else 180 echo "不符合規範，需編輯/etc/vsftpd.conf檔案，設定：anonymous_enable=NO" >> /tmp/check/${str}_out.txt 181 fi 182 else 183 echo "未找到/etc/vsftpd.conf檔案" >> /tmp/check/${str}_out.txt 184 fi 185 186 echo "----------------------------" >> /tmp/check/${str}_out.txt 187 echo "[4]檢查是否修改FTP banner 資訊" >> /tmp/check/${str}_out.txt 188 if [ -e /etc/vsftpd.d/vsftpd.conf ];then 189 BANNER=`cat /etc/vsftpd.d/vsftpd.conf | grep ftpd_banner | grep -F[=] awk '{print $1}'` 190 if [ -n ${BANNER} ];then 191 echo "banner資訊為${BANNER}" >> /tmp/check/${str}_out.txt 192 else 193 echo "未設定banner資訊" >> /tmp/check/${str}_out.txt 194 fi 195 else 196 echo "未找到/etc/vsftpd.d/vsftpd.conf檔案" >> /tmp/check/${str}_out.txt 197 fi 198 199 if [ -e /etc/ftpaccess ];then 200 cat /etc/ftpaccess | grep "banner /path/to/ftpbanner" 201 if [ -e -eq 0 ];then 202 echo "/etc/ftpaccess檔案中已經設定banner路徑" >> /tmp/check/${str}_out.txt 203 else 204 echo "/etc/ftpaccess檔案中未設定banner路徑" >> /tmp/check/${str}_out.txt 205 fi 206 else 207 echo "不存在/etc/ftpaccess檔案" >> /tmp/check/${str}_out.txt 208 fi 209 210 echo "----------------------------" >> /tmp/check/${str}_out.txt 211 echo "[5]檢查是否關閉不必要的服務" >> /tmp/check/${str}_out.txt 212 SERVICE=`ps -ef` 213 echo "系統服務情況為${SERVICE}" >> /tmp/check/${str}_out.txt 214 SER_LIST=`systemctl list-units -all --type=service` 215 echo "服務有${SER_LIST}" >> /tmp/check/${str}_out.txt 216 if [ -e /etc/xinetd.conf ];then 217 echo "在/etc/xinetd.conf檔案中禁止不必要的基本網路服務" >> /tmp/check/${str}_out.txt 218 else 219 echo "未找到/etc/xinetd.conf檔案" >> /tmp/check/${str}_out.txt 220 fi 221 222 223 echo "----------------------------" >> /tmp/check/${str}_out.txt 224 echo "[6]檢查系統core dump狀態" >> /tmp/check/${str}_out.txt 225 if [ -e /etc/security/limits.conf ];then 226 cat /etc/security/limits.conf | grep \* | grep soft | grep core | grep 0 227 if [ $? -eq 0 ];then 228 cat /etc/security/limits.conf | grep \* | grep hard | grep core | grep 0 229 if [ $? -eq 0 ];then 230 echo "/etc/security/limits.conf符合安全配置" >> /tmp/check/${str}_out.txt 231 else 232 echo "/etc/security/limits.conf未安裝規範進行設定" >> /tmp/check/${str}_out.txt 233 fi 234 else 235 echo "/etc/security/limits.conf未安裝規範進行設定" >> /tmp/check/${str}_out.txt 236 fi 237 else 238 echo "未找到/etc/security/limits.conf配置檔案" >> /tmp/check/${str}_out.txt 239 fi 240 241 echo "----------------------------" >> /tmp/check/${str}_out.txt 242 echo "[7]檢查系統補丁" >> /tmp/check/${str}_out.txt 243 OS=`uname -a` 244 echo "系統版本情況為${OS}" >> /tmp/check/${str}_out.txt 245 246 247 248 echo "----**使用者賬號配置**----" >> /tmp/check/${str}_out.txt 249 echo "[1]檢查是否存在無用賬號" >> /tmp/check/${str}_out.txt 250 passwd=`ls -l /etc/passwd | awk '{print $1}'` 251 if [ "${passwd:1:9}" = "rw-r--r--" ]; then 252 echo "/etc/passwd檔案許可權為644，符合規範" >> /tmp/check/${str}_out.txt 253 else 254 echo "/etc/passwd檔案許可權為${passwd:1:9}，不符合規範" >> /tmp/check/${str}_out.txt 255 fi 256 PASSWD_U=`cat /etc/passwd | awk -F[:] '{print $1}'` 257 echo "檢視是否存在無用賬號：${PASSWD_U}" >> /tmp/check/${str}_out.txt 258 259 260 echo "----------------------------" >> /tmp/check/${str}_out.txt 261 echo "[2]檢查不同使用者是否共享賬號" >> /tmp/check/${str}_out.txt 262 PASS=`cat /etc/passwd | awk -F[:] '{print $1}'` 263 echo "cat /etc/passwd結果為${PASS}" >> /tmp/check/${str}_out.txt 264 #檢視所有賬號，與管理員確認是否有共享賬號 265 266 echo "----------------------------" >> /tmp/check/${str}_out.txt 267 echo "[3]檢查是否刪除或鎖定無用賬號" >> /tmp/check/${str}_out.txt 268 NOlogin=`cat /etc/passwd | grep nologin | awk -F[:] '{print $1}'` 269 echo "shell域中為nologin的賬戶有${NOlogin}" >> /tmp/check/${str}_out.txt 270 271 272 echo "----------------------------" >> /tmp/check/${str}_out.txt 273 echo "[4]檢查是否存在無用使用者組" >> /tmp/check/${str}_out.txt 274 GROUP=`ls -l /etc/group | awk '{print $1}'` 275 echo "/etc/group檔案許可權為${GROUP}" >> /tmp/check/${str}_out.txt 276 GROUP_U=`cat /etc/group | awk -F[:] '{print $1}'` 277 echo "/etc/group使用者組有${GROUP}" >> /tmp/check/${str}_out.txt 278 279 280 echo "----------------------------" >> /tmp/check/${str}_out.txt 281 echo "[5]檢查是否指定使用者組成員使用su命令" >> /tmp/check/${str}_out.txt 282 if [ -e /etc/pam.d/su ];then 283 SUFFI=`cat /etc/pam.d/su | grep auth | grep sufficient | grep pam_rootok.so` 284 REQUIRED=`cat /etc/pam.d/su | grep auth | grep required | grep group=` 285 echo "是否指定使用者組成員情況為${SUFFI}\n${REQUIRED}" >> /tmp/check/${str}_out.txt 286 else 287 echo "未找到/etc/pam.d/su配置檔案" >> /tmp/check/${str}_out.txt 288 fi 289 290 291 292 echo "----------------------------" >> /tmp/check/${str}_out.txt 293 echo "[6]檢查密碼長度及複雜度策略" >> /tmp/check/${str}_out.txt 294 if [ -e /etc/pam.d/system-auth ];then 295 passComplexity=`cat /etc/pam.d/system-auth | grep "pam_pwquality.so"` 296 passucredit=`cat /etc/pam.d/system-auth | grep "pam_pwquality.so" | grep -e ucredit | awk '{print $4}'` 297 passlcredit=`cat /etc/pam.d/system-auth | grep "pam_pwquality.so" | grep -e lcredit | awk '{print $5}'` 298 passdcredit=`cat /etc/pam.d/system-auth | grep "pam_pwquality.so" | grep -e dcredit | awk '{print $6}'` 299 passocredit=`cat /etc/pam.d/system-auth | grep "pam_pwquality.so" | grep -e ocredit | awk '{print $7}'` 300 echo "密碼複雜度策略為：${passComplexity}" >> /tmp/check/${str}_out.txt 301 echo "密碼複雜度策略中設定的大寫字母個數為：${passucredit}" >> /tmp/check/${str}_out.txt 302 echo "密碼複雜度策略中設定的小寫字母個數為：${passlcredit}" >> /tmp/check/${str}_out.txt 303 echo "密碼複雜度策略中設定的數字個數為：${passdcredit}" >> /tmp/check/${str}_out.txt 304 echo "密碼複雜度策略中設定的特殊字元個數為：${passocredit}" >> /tmp/check/${str}_out.txt 305 else 306 ehco "不存在/etc/pam.d/system-auth檔案" >> /tmp/check/${str}_out.txt 307 fi 308 309 echo "----------------------------" >> /tmp/check/${str}_out.txt 310 echo "[7]檢查是否對使用者遠端登入進行限制" >> /tmp/check/${str}_out.txt 311 cat /etc/securetty | grep "#" | grep tty 312 if [ $? -eq 0 ];then 313 echo "註釋掉所有tty裝置" >> /tmp/check/${str}_out.txt 314 else 315 echo "未註釋掉所有tty裝置" >> /tmp/check/${str}_out.txt 316 fi 317 318 RootLogin=`cat /etc/ssh/sshd_config | grep PermitRootLogin | awk '{print $2}'` 319 if [ "${RootLogin}" == "yes" ];then 320 echo "/etc/ssh/sshd_config中PermitRootLogin配置為yes" >> /tmp/check/${str}_out.txt 321 else [ "${RootLogin}" == "no" ] 322 echo "/etc/ssh/sshd_config中PermitRootLogin配置為no" >> /tmp/check/${str}_out.txt 323 fi 324 325 326 327 echo "----------------------------" >> /tmp/check/${str}_out.txt 328 echo "[8]檢查是否配置加密協議" >> /tmp/check/${str}_out.txt 329 SSH=`ps -elf | grep ssh` 330 echo "ssh服務狀態為${SSH}" >> /tmp/check/${str}_out.txt 331 if [ -e /etc/ssh/sshd_config ];then 332 cat /etc/ssh/sshd_config | grep "Host*" | grep "Protocol 2" 333 if [ $? -eq 0 ];then 334 echo "/etc/ssh/sshd_config檔案符合安全配置" >> /tmp/check/${str}_out.txt 335 else 336 echo "/etc/ssh/sshd_config檔案中未找到相應配置" >> /tmp/check/${str}_out.txt 337 fi 338 else 339 echo "未找到/etc/ssh/sshd_config檔案" >> /tmp/check/${str}_out.txt 340 fi 341 342 343 echo "----------------------------" >> /tmp/check/${str}_out.txt 344 echo "[9]檢查是否配置密碼的生存期" >> /tmp/check/${str}_out.txt 345 if [ -e /etc/login.defs ];then 346 passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'` 347 passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'` 348 passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'` 349 passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'` 350 echo "口令生存週期天數為： ${passmax}" >> /tmp/check/${str}_out.txt 351 echo "口令更改最小時間間隔為天數為：${passmin}" >> /tmp/check/${str}_out.txt 352 echo "口令最小長度天數為：${passlen}" >> /tmp/check/${str}_out.txt 353 echo "口令過期告警時間天數為：${passage}" >> /tmp/check/${str}_out.txt 354 else 355 echo "未找到/etc/login.defs配置檔案" >> /tmp/check/${str}_out.txt 356 fi 357 358 echo "----------------------------" >> /tmp/check/${str}_out.txt 359 echo "[10]檢查使用者預設訪問許可權" >> /tmp/check/${str}_out.txt 360 fileumask=`cat /etc/login.defs | grep -i umask | awk '{print $2}'` 361 if [ -n $fileumask ]; then 362 echo "/etc/login.defs檔案的umask的值為：${fileumask}" >> /tmp/check/${str}_out.txt 363 else 364 echo "/etc/login.defs檔案未配置umask值" >> /tmp/check/${str}_out.txt 365 fi 366 367 368 echo "----------------------------" >> /tmp/check/${str}_out.txt 369 echo "[11]檢查passwd group檔案安全許可權" >> /tmp/check/${str}_out.txt 370 371 grep ^+: /etc/passwd /etc/shadow /etc/group 372 if [ $? -eq 0 ];then 373 echo "低於安全要求" >> /tmp/check/${str}_out.txt 374 else 375 echo "符合安全要求" >> /tmp/check/${str}_out.txt 376 fi 377 passwd=`ls -l /etc/passwd | awk '{print $1}'` 378 echo "/etc/passwd檔案許可權為${passwd:1:9}" >> /tmp/check/${str}_out.txt 379 ETC_group=`ls -l /etc/group | awk '{print $1}'` 380 echo "/etc/group檔案許可權為${passwd:1:9}" >> /tmp/check/${str}_out.txt 381 382 igroup=`lsattr /etc/group | grep i` 383 if [ "$igroup" = "i" ]; then 384 echo "/etc/group檔案存在i屬性檔案" >> /tmp/check/${str}_out.txt 385 else 386 echo "/etc/group檔案不存在i檔案屬性" >> /tmp/check/${str}_out.txt 387 fi 388 ipasswd=`lsattr /etc/passwd | grep i` 389 if [ "$igshadow" = "i" ]; then 390 echo "/etc/passwd存在i屬性檔案" >> /tmp/check/${str}_out.txt 391 else 392 echo "/etc/passwd不存在i檔案屬性" >> /tmp/check/${str}_out.txt 393 fi 394 395 396 echo "----------------------------" >> /tmp/check/${str}_out.txt 397 echo "[12]檢查是否存在除root之外UID為0的使用者" >> /tmp/check/${str}_out.txt 398 uids=`awk -F[:] 'NR!=1{print $3}' /etc/passwd` #NR!=1意思的除了第一行不顯示。1代表具體的行數 399 flag=0 400 for i in $uids 401 do 402 if [ $i = 0 ]; then 403 echo "存在非root賬號的賬號UID為0，不符合要求" >> /tmp/check/${str}_out.txt 404 else 405 flag=1 406 fi 407 done 408 if [ $flag = 1 ]; then 409 echo "不存在非root賬號的UID為0，符合要求" >> /tmp/check/${str}_out.txt 410 fi 411 412 413 414 echo "----------------------------" >> /tmp/check/${str}_out.txt 415 echo "[13]檢查是否配置環境變數" >> /tmp/check/${str}_out.txt 416 echo $PATH | egrep '(^|:)(\.|:|$)' 417 if [ $? -eq 0 ];then 418 echo "檢查是否包含父目錄，低於安全要求" >> /tmp/check/${str}_out.txt 419 else 420 echo "檢查是否包含父目錄，符合安全要求" >> /tmp/check/${str}_out.txt 421 fi 422 423 echo "----------------------------" >> /tmp/check/${str}_out.txt 424 echo "[14]檢查是否對遠端連線的安全性進行配置" >> /tmp/check/${str}_out.txt 425 filerhosts=`find / -maxdepth 3 -type f -name .rhosts 2>/dev/null` 426 if [ -n "$filerhosts" ]; then 427 echo "rhosts檔案路徑為：${filerhosts}" >> /tmp/check/${str}_out.txt 428 else 429 echo "未找到.rhosts檔案" >> /tmp/check/${str}_out.txt 430 fi 431 432 fileequiv=`find / -maxdepth 2 -name hosts.equiv 2>/dev/null` 433 if [ -n "$fileequiv" ]; then 434 echo "hosts.equiv檔案路徑為：${fileequiv}" >> /tmp/check/${str}_out.txt 435 else 436 echo "未找到hosts.equiv檔案" >> /tmp/check/${str}_out.txt 437 fi 438 filenetrc=`find / -maxdepth 3 -name .netrc 2>/dev/null` 439 if [ -n "$filenetrc" ]; then 440 echo "netrc檔案路徑為：${filenetrc}" >> /tmp/check/${str}_out.txt 441 else 442 echo "未找到.netrc檔案" >> /tmp/check/${str}_out.txt 443 fi 444 445 echo "----------------------------" >> /tmp/check/${str}_out.txt 446 echo "[15]檢查是否對使用者的umask進行配置" >> /tmp/check/${str}_out.txt 447 if [ -e /etc/profile ];then 448 PROFILE1=`cat /etc/profile | grep -i umask | grep -v '#' | head -n 1 | awk '{print $2}'` 449 PROFILE2=`cat /etc/profile | grep -i umask | grep -v '#' | tail -1 | awk '{print $2}'` 450 if [ -n "$PROFILE" ]; then 451 echo "在/etc/profile檔案中umask的值為：${PROFILE}和${PROFILE1}" >> /tmp/check/${str}_out.txt 452 else 453 echo "在/etc/profile檔案中未找到umask值" >> /tmp/check/${str}_out.txt 454 fi 455 fi 456 457 csh=`cat /etc/csh.login | grep -i umask` 458 if [ -n "$csh" ]; then 459 echo "在/etc/csh.login檔案中umask的內容為：${csh}" >> /tmp/check/${str}_out.txt 460 else 461 echo "在/etc/csh.login檔案中未找到umask值" >> /tmp/check/${str}_out.txt 462 fi 463 464 cshrc1=`cat /etc/csh.cshrc | grep -i umask | grep -v '#' | head -n 1 | awk '{print $2}'` 465 cshrc2=`cat /etc/csh.cshrc | grep -i umask | grep -v '#' | tail -1 | awk '{print $2}'` 466 if [ -n "$cshrc" ]; then 467 echo "在/etc/csh.cshrc檔案中umask的值為：${cshrc1}和${cshrc2}" >> /tmp/check/${str}_out.txt 468 else 469 echo "在/etc/csh.login檔案中未找到umask值" >> /tmp/check/${str}_out.txt 470 fi 471 472 if [ -e /etc/bashrc ];then 473 bashrc1=`cat /etc/bashrc | grep -i umask | grep -v '#' | head -n 1 | awk '{print $2}'` 474 bashrc2=`cat /etc/bashrc | grep -i umask | grep -v '#' | tail -1 | awk '{print $2}'` 475 if [ -n "$bashrc1" ] && [ -n "$bashrc2" ]; then 476 echo "在/etc/bashrc檔案中umask內容為：${bashrc1}和${bashrc2}" >> /tmp/check/${str}_out.txt 477 else 478 echo "在/etc/bashrc檔案中未找到umask值" >> /tmp/check/${str}_out.txt 479 fi 480 fi 481 482 echo "----------------------------" >> /tmp/check/${str}_out.txt 483 echo "[16]檢查是否對重要目錄和檔案的許可權進行設定" >> /tmp/check/${str}_out.txt 484 etc=`ls -l / | grep etc | awk '{print $1}'` 485 if [ "${etc:1:9}" = "rwxr-x---" ]; then 486 echo "/etc/許可權為750，符合規範" >> /tmp/check/${str}_out.txt 487 else 488 echo "/etc/檔案許可權為${etc:1:9}，不符合規範" >> /tmp/check/${str}_out.txt 489 fi 490 491 Shadow=`ls -l /etc/shadow | awk '{print $1}'` 492 if [ "${shadow:1:9}" = "rw-------" ]; then 493 echo "/etc/shadow檔案許可權為600，符合規範" >> /tmp/check/${str}_out.txt 494 else 495 echo "/etc/shadow檔案許可權為${Shadow:1:9}，不符合規範" >> /tmp/check/${str}_out.txt 496 fi 497 498 Passwd=`ls -l /etc | grep passwd | awk '{print $1}'` 499 if [ "${passwd:1:9}" = "rw-r--r--" ]; then 500 echo "/etc/passwd檔案許可權為644，符合規範" >> /tmp/check/${str}_out.txt 501 else 502 echo "/etc/passwd檔案許可權為${Passwd:1:9}，不符合規範" >> /tmp/check/${str}_out.txt 503 fi 504 505 Group=`ls -l /etc | grep group | awk '{print $1}'` 506 if [ "${Group:1:9}" = "rw-r--r--" ]; then 507 echo "/etc/passwd檔案許可權為644，符合規範" >> /tmp/check/${str}_out.txt 508 else 509 echo "/etc/passwd檔案許可權為${Group:1:9}，不符合規範" >> /tmp/check/${str}_out.txt 510 fi 511 512 513 echo "----------------------------" >> /tmp/check/${str}_out.txt 514 echo "[17]檢查是否存在未授權的suid/sgid檔案" >> /tmp/check/${str}_out.txt 515 for PART in `grep -v ^# /etc/fstab | awk '($6 != "0") {print "/./"$2 }'`; do 516 RESULT=`find $PART -type f -xdev \( -perm -04000 -o -perm -02000 \) -print` 517 if [ -n $RESULT ];then 518 flag=1 519 else 520 flag=0 521 fi 522 done 523 if [ $flag -eq 0 ];then 524 echo "返回值為空，符合規範" >> /tmp/check/${str}_out.txt 525 else [ $flag -eq 1 ] 526 echo "返回值不為空，不符合規範" >> /tmp/check/${str}_out.txt 527 fi 528 529 echo "----------------------------" >> /tmp/check/${str}_out.txt 530 echo "[18]檢查是否存在異常隱含檔案" >> /tmp/check/${str}_out.txt 531 find / -name ".. *" -print 532 HIDDEN=`find / -name ".. *" -print; find / -name "...*" -print | cat -v` 533 if [ -n ${XINETD} ];then 534 echo "隱藏檔案有${HIDDEN}" >> /tmp/check/${str}_out.txt 535 else 536 echo "沒有隱藏檔案" >> /tmp/check/${str}_out.txt 537 fi 538 539 echo "----**網路通訊配置**----" >> /tmp/check/${str}_out.txt 540 echo "[1]檢查是否對基本網路服務進行配置" >> /tmp/check/${str}_out.txt 541 XINETD=`ls -l /etc/xinetd.d` 542 echo "/etc/xinetd.d目錄中的包含的基本的網路服務的配置檔案為${XINETD}" >> /tmp/check/${str}_out.txt 543 544 echo "----------------------------" >> /tmp/check/${str}_out.txt 545 echo "[2]檢查是否開啟NFS服務" >> /tmp/check/${str}_out.txt 546 systemctl status nfs 547 if [ $? -eq 0 ];then 548 echo "已開啟nfs服務" >> /tmp/check/${str}_out.txt 549 else [ $? -eq 3 ] 550 echo "未開啟nfs服務" >> /tmp/check/${str}_out.txt 551 fi 552 553 echo "----------------------------" >> /tmp/check/${str}_out.txt 554 echo "[3]檢查常規網路服務是否執行正常" >> /tmp/check/${str}_out.txt 555 #若無telnet命令 556 telnet localhost 80 557 if [ $? -eq 0 ];then 558 echo "80服務正常執行" >> /tmp/check/${str}_out.txt 559 telnet localhost 25 560 if [ $? -eq 0 ];then 561 echo "25服務正常執行" >> /tmp/check/${str}_out.txt 562 fi 563 telnet localhost 110 564 if [ $? -eq 0 ];then 565 echo "110服務正常執行" >> /tmp/check/${str}_out.txt 566 fi 567 telnet localhost 143 568 if [ $? -eq 0 ];then 569 echo "143服務正常執行" >> /tmp/check/${str}_out.txt 570 fi 571 telnet localhost 443 572 if [ $? -eq 0 ];then 573 echo "443服務正常執行" >> /tmp/check/${str}_out.txt 574 fi 575 telnet localhost 21 576 if [ $? -eq 0 ];then 577 echo "21服務正常執行" >> /tmp/check/${str}_out.txt 578 fi 579 else 580 echo "系統未安裝telnet命令" >> /tmp/check/${str}_out.txt 581 fi