【信息安全系列】Linux主机安全检查

#!/bin/bash

#################################################################
##                                                             ##
##    It was used for Linux OS Security configuration check    ##
##                                                             ##
#################################################################

##检查Linux主机是否开启了不必要的服务等；##
echo ‘###检查Linux主机是否开启了不必要的服务等；###‘
chkconfig --list|egrep "shell|login|exec|talk|ntalk|imap|pop-2|pop-3|finger|auth|Anancron|Cups|Gpm|Isdn|Kudzu|Pcmcia|Rhnsd|ipop2|ipop3"|grep -w "on"
##检查是否关闭R系列服务(rlogin、rsh、rexec等)##
echo ‘###检查是否关闭R系列服务(rlogin、rsh、rexec等)###‘
chkconfig --list|egrep "rexec|rlogin|rsh"|grep -w "on"
##检查用户口令策略是否符合安全要求##
echo ‘###检查用户口令策略是否符合安全要求###‘
function Calculate
{
  CREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "credit"|sed ‘s/^.*credit=//g‘|sed ‘s/\s.*$//g‘`
  DCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "dcredit"|sed ‘s/^.*dcredit=//g‘|sed ‘s/\s.*$//g‘`
  LCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "lcredit"|sed ‘s/^.*lcredit=//g‘|sed ‘s/\s.*$//g‘`
  UCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "ucredit"|sed ‘s/^.*ucredit=//g‘|sed ‘s/\s.*$//g‘`
  OCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "ocredit"|sed ‘s/^.*ocredit=//g‘|sed ‘s/\s.*$//g‘`
  MINCLASS=`cat $FILE|egrep -v "^#|^$"|grep -w "minclass"|sed ‘s/^.*minclass=//g‘|sed ‘s/\s.*$//g‘`
  MINLEN=`cat $FILE|grep -v "^#|^$"|grep "minlen"|sed ‘s/^.*minlen=//g‘|sed ‘s/\s.*$//g‘`
  COUNT=0
  for NO in $CREDIT $DCREDIT $LCREDIT $UCREDIT $OCREDIT
  do
     if ([[ $NO -lt 0 ]]);
     then COUNT=`expr $COUNT + 1`
     fi
  done
  if ([[ $MINCLASS -ge 2 ]] && [[ $MINLEN -ge 6 ]]);
     then echo "check reuslt:true"
          elif ([[ $COUNT -ge 2 ]] && [[ $MINLEN -ge 6 ]]);
          then echo "check reuslt:true"
      else echo "check reuslt:false"
  fi
  unset CREDIT DCREDIT LCREDIT UCREDIT OCREDIT MINCLASS MINLEN COUNT
}
if ([ -f /etc/redhat-release ] &&[ -f /etc/pam.d/system-auth ]);
then FILE=/etc/pam.d/system-auth
     cat $FILE |sed ‘/^#/d‘|sed ‘/^$/d‘
     Calculate
elif ([ -f /etc/SuSE-release ] && [ -f /etc/pam.d/passwd ]);
then FILE=/etc/pam.d/passwd
     cat $FILE|grep -v ‘^#‘|grep -v ‘^$‘
     Calculate
fi
if [ -f /etc/pam.d/login ];
then cat /etc/pam.d/login |sed ‘/^#/d‘|sed ‘/^$/d‘;
fi;
if [ -f /etc/pam.d/sshd ];
then cat /etc/pam.d/sshd |sed ‘/^#/d‘|sed ‘/^$/d‘;
fi
##检查FTP是否禁止匿名登录##
echo ‘###检查FTP是否禁止匿名登录###‘
grep anonymous /etc/ftpusers|grep -v ‘#‘
grep anonymous /etc/vsftpd/vsftpd.conf|grep -v ‘#‘
##检查SNMP是否修改默认通讯字符串##
echo ‘###检查SNMP是否修改默认通讯字符串###‘
chkconfig  --list snmpd
cat /etc/snmp/snmpd.conf|egrep "public|private"|grep -v ‘#‘
##检查操作系统帐号是否存在弱口令##
echo ‘###检查操作系统帐号是否存在弱口令###‘
cat /etc/shadow
##检查Unix系统是否启用信任主机方式，配置文件是否配置妥当##
echo ‘###检查Unix系统是否启用信任主机方式，配置文件是否配置妥当###‘
cat $HOME/.rhosts|grep "++"
cat /etc/hosts.equiv|grep "++"
##设备安全事件审计##
echo ‘###设备安全事件审计###‘
function Check_SYSLOGD
{
if [ -f  /etc/syslog.conf ];
   then SYSLOGCONF=/etc/syslog.conf;
else SYSLOGCONF=/etc/rsyslog.conf;
fi
cat $SYSLOGCONF |sed ‘/^#/d‘|sed ‘/^$/d‘|awk ‘($2!~/*/) && ($2!~/-/) {print $1"\t"$2}‘
}
function Check_SYSLOGNG
{
SYSLOGCONF=/etc/syslog-ng/syslog-ng.conf
for FILTER in `cat $SYSLOGCONF |grep "^log"|grep filter|cut -d\; -f2|cut -d\( -f2|cut -d\) -f1|sort|uniq`;do
    cat $SYSLOGCONF|grep "^filter $FILTER"
done
for DESTINATION in `cat $SYSLOGCONF |grep "^log"|awk -F\; ‘{print $1"\n"$2"\n"$3}‘|grep destination|cut -d\( -f2|cut -d\) -f1|sort|uniq`;do
    cat $SYSLOGCONF|grep "^destination $DESTINATION "
done
cat $SYSLOGCONF |grep "^log"
}
if [[ `ps -ef|egrep ‘(syslogd|syslog-ng)‘|grep -v "grep"|wc -l` != 0 ]];
   then if [[ `grep -sv "^#" /etc/sysconfig/syslog|grep SYSLOG_DAEMON|cut -d\" -f2` = "syslog-ng" ]];
           then Check_SYSLOGNG;
           else Check_SYSLOGD;
        fi;
   else echo "syslog is not running";
fi
##检测特定系统自带的与设备运行、维护等工作无关的账号是否被删除或锁定##
echo ‘###检测特定系统自带的与设备运行、维护等工作无关的账号是否被删除或锁定###‘
egrep -w "Adm|lp|sync|shutdown|halt|news|uucp|operator|games" /etc/shadow |awk -F: ‘($2!~"!") {print $1":"$2}‘
echo "result="`egrep -w "Adm|lp|sync|shutdown|halt|news|uucp|operator|games" /etc/shadow |awk -F: ‘($2!~"!") {print $1":"$2}‘|wc -l`
##限制密码文件的访问权限##
echo ‘###限制密码文件的访问权限###‘
        ls -l /etc/passwd /etc/shadow /etc/group | awk ‘{print $1":"$7":"$9}‘
##检查root是否可以直接登录##
echo ‘###检查root是否可以直接登录###‘
SSHSTATUS=`netstat -an |grep ":22\>"|wc -l`
if [ x"$SSHSTATUS" != "x0" ];
then  if [[ `grep "^PermitRootLogin no" /etc/ssh/sshd_config|wc -l` != 0 ]];
      then  grep "^PermitRootLogin no" /etc/ssh/sshd_config;
            echo "This device does not permit root to ssh login,check result:true";
      else  echo "This device permits root  to ssh login,check result:false" ;
      fi
else  echo "The ssh service of device is not running,check result:true";
fi
TELSTATUS=`netstat -an |grep ":23\>"|wc -l`
if [ x"$TELSTATUS" != "x0" ];
then  if ([ -f /etc/securetty ] && [ `grep -i "^pts" /etc/securetty|wc -l` = 0  ]);
       then  echo "This device does not permit root to telnet login,check result:true";
       else  echo "This device permits root to telnet login,check result:false";
      fi
else  echo "The telnet service of device is not running,check result:true" ;
fi
##检查SSH安全配置##
echo ‘###检查SSH安全配置###‘
        grep Protocol /etc/ssh/sshd_config|grep -v ‘^#‘
##检查终端超时退出时间##
echo ‘###检查终端超时退出时间###‘
cat /etc/profile |sed ‘/^#/d‘|sed ‘/^$/d‘|grep -i TMOUT
cat /etc/csh.cshrc |sed ‘/^#/d‘|sed ‘/^$/d‘|grep -i autologout
##检查补丁更新情况##
echo ‘###检查补丁更新情况###‘
uname -a
if [ -f /etc/SuSE-release ];
    then cat /etc/SuSE-release;
       elif [ -f /etc/redhat-release ];
          then cat /etc/redhat-release;echo " redhat patch check result:true";
fi