1 #!/bin/bash
2
3 #name: safe_check.sh
4 #Author: lipc
5 #Date: 2019-11-30
6 #Version: 1.0
7 #Notes: 此脚本用来做系统的安全巡检
8
9 read key
10
11 echo "警告：本脚本只是一个检查的操作，未对服务器做任何修改，管理员可以根据此报告进行相应的设置。"
12
13
14 echo ---------------------------------------主机安全检查-----------------------
15
16 echo "系统版本"
17
18 uname -a
19
20 echo --------------------------------------------------------------------------
21
22 echo "本机的ip地址是："
23
24 ifconfig | grep --color "\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}"
25
26 echo --------------------------------------------------------------------------
27
28 awk -F":" ‘{if($2!~/^!|^*/){print "("$1")" " 是一个未被锁定的账户，请管理员检查是否需要锁定它或者删除它。"}}‘ /etc/shadow
29
30 echo --------------------------------------------------------------------------
31
32 more /etc/login.defs | grep -E "PASS_MAX_DAYS" | grep -v "#" |awk -F‘ ‘ ‘{if($2!=90){print "/etc/login.defs里面的"$1 "设置的是"$2"天，请管理员改成90天。"}}‘
33
34 echo --------------------------------------------------------------------------
35
36 more /etc/login.defs | grep -E "PASS_MIN_LEN" | grep -v "#" |awk -F‘ ‘ ‘{if($2!=6){print "/etc/login.defs里面的"$1 "设置的是"$2"个字符，请管理员改成6个字符。"}}‘
37
38 echo --------------------------------------------------------------------------
39
40 more /etc/login.defs | grep -E "PASS_WARN_AGE" | grep -v "#" |awk -F‘ ‘ ‘{if($2!=10){print "/etc/login.defs里面的"$1 "设置的是"$2"天，请管理员将口令到期警告天数改成10天。"}}‘
41
42 echo --------------------------------------------------------------------------
43
44 grep TMOUT /etc/profile /etc/bashrc > /dev/null|| echo "未设置登录超时限制，请设置之，设置方法：在/etc/profile或者/etc/bashrc里面添加TMOUT=600参数"
45
46 echo --------------------------------------------------------------------------
47
48 if ps -elf |grep xinet |grep -v "grep xinet";then
49
50 echo "xinetd 服务正在运行，请检查是否可以把xinnetd服务关闭"
51
52 else
53
54 echo "xinetd 服务未开启"
55
56 fi
57
58 echo --------------------------------------------------------------------------
59
60 echo "查看系统密码文件修改时间"
61
62 ls -ltr /etc/passwd
63
64 echo --------------------------------------------------------------------------
65
66 echo "查看是否开启了ssh服务"
67
68 if service sshd status | grep -E "listening on|active \(running\)"; then
69
70 echo "SSH服务已开启"
71
72 else
73
74 echo "SSH服务未开启"
75
76 fi
77
78 echo --------------------------------------------------------------------------
79
80 echo "查看是否开启了TELNET服务"
81
82 if more /etc/xinetd.d/telnetd 2>&1|grep -E "disable=no"; then
83
84 echo "TELNET服务已开启 "
85
86 else
87
88 echo "TELNET服务未开启 "
89
90 fi
91
92 echo --------------------------------------------------------------------------
93
94 echo "查看系统SSH远程访问设置策略(host.deny拒绝列表)"
95
96 if more /etc/hosts.deny | grep -E "sshd: ";more /etc/hosts.deny | grep -E "sshd"; then
97
98 echo "远程访问策略已设置 "
99
100 else
101
102 echo "远程访问策略未设置 "
103
104 fi
105
106 echo --------------------------------------------------------------------------
107
108 echo "查看系统SSH远程访问设置策略(hosts.allow允许列表)"
109
110 if more /etc/hosts.allow | grep -E "sshd: ";more /etc/hosts.allow | grep -E "sshd"; then
111
112 echo "远程访问策略已设置 "
113
114 else
115
116 echo "远程访问策略未设置 "
117
118 fi
119
120 echo "当hosts.allow和 host.deny相冲突时，以hosts.allow设置为准。"
121
122 echo -------------------------------------------------------------------------
123
124 echo "查看shell是否设置超时锁定策略"
125
126 if more /etc/profile | grep -E "TIMEOUT= "; then
127
128 echo "系统设置了超时锁定策略 "
129
130 else
131
132 echo "未设置超时锁定策略 "
133
134 fi
135
136 echo -------------------------------------------------------------------------
137
138 echo "查看syslog日志审计服务是否开启"
139
140 if service syslog status | egrep " active \(running";then
141
142 echo "syslog服务已开启"
143
144 else
145
146 echo "syslog服务未开启，建议通过service syslog start开启日志审计功能"
147
148 fi
149
150 echo -------------------------------------------------------------------------
151
152 echo "查看syslog日志是否开启外发"
153
154 if more /etc/rsyslog.conf | egrep "@...\.|@..\.|@.\.|\*.\* @...\.|\*\.\* @..\.|\*\.\* @.\.";then
155
156 echo "客户端syslog日志已开启外发"
157
158 else
159
160 echo "客户端syslog日志未开启外发"
161
162 fi
163
164 echo -------------------------------------------------------------------------
165
166 echo "查看passwd文件中有哪些特权用户"
167
168 awk -F: ‘$3==0 {print $1}‘ /etc/passwd
169
170 echo ------------------------------------------------------------------------
171
172 echo "查看系统中是否存在空口令账户"
173
174 awk -F: ‘($2=="!!") {print $1}‘ /etc/shadow
175
176 echo "该结果不适用于Ubuntu系统"
177
178 echo ------------------------------------------------------------------------
179
180 echo "查看系统中root用户外连情况"
181
182 lsof -u root |egrep "ESTABLISHED|SYN_SENT|LISTENING"
183
184 echo -------重要文件权限检查中------------------------------------------------
185
186 file1=`ls -l /etc/passwd | awk ‘{print $1}‘`
187 if [ $file1 = "-rw-r--r--." ];then
188 echo " [ √ ] /etc/passwd文件权限为644，符合要求"
189 else
190 echo " [ X ] /etc/passwd文件权限为[$file1.],不符合要求"
191 fi
192
193 file2=`ls -l /etc/shadow | awk ‘{print $1}‘`
194 if [ $file2 = "-rw-r--r--." ] || [ $file2 = "----------." ];then
195 echo " [ √ ] /etc/shadow文件权限为400或000，符合要求"
196 else
197 echo " [ X ] /etc/shadow文件权限为${file2},不符合要求"
198 fi
199
200 file3=`ls -l /etc/group | awk ‘{print $1}‘`
201 if [ $file3 = "-rw-r--r--." ];then
202 echo " [ √ ] /etc/group文件权限为644，符合要求"
203 else
204 echo " [ X ] /etc/group文件权限为$file3，不符合要求"
205 fi
206
207 file4=`ls -l /etc/securetty | awk ‘{print $1}‘`
208 if [ $file4 = "-rw-------." ];then
209 echo " [ √ ] /etc/security文件权限为600，符合要求"
210 else
211 echo " [ X ] /etc/security文件权限不为600，不符合要求，建议设置权限为600"
212 fi
213
214 file5=`ls -l /etc/services | awk ‘{print $1}‘`
215 if [ $file5 = "-rw-r--r--." ];then
216 echo " [ √ ] /etc/services文件权限为644，符合要求"
217 else
218 echo " [ X ] /etc/services文件权限不为644，不符合要求，建议设置权限为644"
219 fi
220
221 file6=`ls -l /etc/xinetd.conf | awk ‘{print $1}‘`
222 if [ !-f $file6 ];then
223 echo " [ √ ] /etc/xinetd.conf文件不存在,暂略此项"
224 else
225 if [ $file6 = "-rw-------." ];then
226 echo " [ √ ] /etc/xinetd.conf文件权限为600，符合要求"
227 else
228 echo " [ X ] /etc/xinetd.conf文件权限不为600，不符合要求，建议设置权限为600"
229 fi
230 fi
231
232 file7=`ls -l /etc/grub.conf | awk ‘{print $1}‘`
233 if [ $file7 = "-rw-------." ];then
234 echo " [ √ ] /etc/grub.conf文件权限为600，符合要求"
235 else
236 echo " [ X ] /etc/grub.conf文件权限为$file7，不符合要求，建议设置权限为600"
237 fi
238
239 file8=`ls -l /etc/lilo.conf | awk ‘{print $1}‘`
240 if [ -f /etc/lilo.conf ];then
241 if [ $file8 = "-rw-------" ];then
242 echo " [ √ ] /etc/lilo.conf文件权限为600，符合要求"
243 else
244 echo " [ X ] /etc/lilo.conf文件权限不为600，不符合要求，建议设置权限为600"
245 fi
246 else
247 echo " [ √ ] /etc/lilo.conf文件不存在,暂略此项"
248 fi
249
250 echo ------------------------------------------------------------------------
251
252
253 echo ----------------------------状态解释------------------------------
254
255 echo "ESTABLISHED的意思是建立连接。表示两台机器正在通信。"
256
257 echo "LISTENING的"
258
259 echo "SYN_SENT状态表示请求连接"
260
261 echo ------------------------------------------------------------------------
262
263 echo "查看系统中root用户TCP连接情况"
264
265 lsof -u root |egrep "TCP"
266
267 echo ------------------------------------------------------------------------
268
269 echo "查看系统中存在哪些非系统默认用户"
270
271 echo "root:x:“该值大于500为新创建用户，小于或等于500为系统初始用户”"
272
273 more /etc/passwd |awk -F ":" ‘{if($3>500){print "/etc/passwd里面的"$1 "的值为"$3"，请管理员确认该账户是否正常。"}}‘
274
275 echo ------------------------------------------------------------------------
276
277 echo "检查系统守护进程"
278
279 more /etc/xinetd.d/rsync | grep -v "^#"
280
281 echo ------------------------------------------------------------------------
282
283 echo "检查系统是否存在入侵行为"
284
285 more /var/log/secure |grep refused
286
287 echo ------------------------------------------------------------------------
288
289 echo "-----------------------检查系统是否存在PHP脚本后门---------------------"
290
291 if find / -type f -name *.php | xargs egrep -l "mysql_query\($query, $dbconn\)|专用网马|udf.dll|class PHPzip\{|ZIP压缩程序 荒野无灯修改版|$writabledb|AnonymousUserName|eval\(|Root_CSS\(\)|黑狼PHP木马|eval\(gzuncompress\(base64_decode|if\(empty\($_SESSION|$shellname|$work_dir |PHP木马|Array\("$filename"| eval\($_POST\[|class packdir|disk_total_space|wscript.shell|cmd.exe|shell.application|documents and settings|system32|serv-u|提权|phpspy|后门" |sort -n|uniq -c |sort -rn 1>/dev/null 2>&1;then
292
293 echo "检测到PHP脚本后门"
294
295 find / -type f -name *.php | xargs egrep -l "mysql_query\($query, $dbconn\)|专用网马|udf.dll|class PHPzip\{|ZIP压缩程序 荒野无灯修改版|$writabledb|AnonymousUserName|eval\(|Root_CSS\(\)|黑狼PHP木马|eval\(gzuncompress\(base64_decode|if\(empty\($_SESSION|$shellname|$work_dir |PHP木马|Array\("$filename"| eval\($_POST\[|class packdir|disk_total_space|wscript.shell|cmd.exe|shell.application|documents and settings|system32|serv-u|提权|phpspy|后门" |sort -n|uniq -c |sort -rn
296
297 find / -type f -name *.php | xargs egrep -l "mysql_query\($query, $dbconn\)|专用网马|udf.dll|class PHPzip\{|ZIP压缩程序 荒野无灯修改版|$writabledb|AnonymousUserName|eval\(|Root_CSS\(\)|黑狼PHP木马|eval\(gzuncompress\(base64_decode|if\(empty\($_SESSION|$shellname|$work_dir |PHP木马|Array\("$filename"| eval\($_POST\[|class packdir|disk_total_space|wscript.shell|cmd.exe|shell.application|documents and settings|system32|serv-u|提权|phpspy|后门" |sort -n|uniq -c |sort -rn |awk ‘{print $2}‘ | xargs -I{} cp {} /tmp/
298
299 echo "后门样本已拷贝到/tmp/目录"
300
301 else
302
303 echo "未检测到PHP脚本后门"
304
305 fi
306
307 echo ------------------------------------------------------------------------
308
309 echo "-----------------------检查系统是否存在JSP脚本后门---------------------"
310
311 find / -type f -name *.jsp | xargs egrep -l "InputStreamReader\(this.is\)|W_SESSION_ATTRIBUTE|strFileManag|getHostAddress|wscript.shell|gethostbyname|cmd.exe|documents and settings|system32|serv-u|提权|jspspy|后门" |sort -n|uniq -c |sort -rn 2>&1
312
313 find / -type f -name *.jsp | xargs egrep -l "InputStreamReader\(this.is\)|W_SESSION_ATTRIBUTE|strFileManag|getHostAddress|wscript.shell|gethostbyname|cmd.exe|documents and settings|system32|serv-u|提权|jspspy|后门" |sort -n|uniq -c |sort -rn| awk ‘{print $2}‘ | xargs -I{} cp {} /tmp/ 2>&1
314
315 echo ------------------------------------------------------------------------
316
317 echo "----------------------检查系统是否存在HTML恶意代码---------------------"
318
319 if find / -type f -name *.html | xargs egrep -l "WriteData|svchost.exe|DropPath|wsh.Run|WindowBomb|a1.createInstance|CurrentVersion|myEncString|DropFileName|a = prototype;|204.351.440.495.232.315.444.550.64.330" 1>/dev/null 2>&1;then
320
321 echo "发现HTML恶意代码"
322
323 find / -type f -name *.html | xargs egrep -l "WriteData|svchost.exe|DropPath|wsh.Run|WindowBomb|a1.createInstance|CurrentVersion|myEncString|DropFileName|a = prototype;|204.351.440.495.232.315.444.550.64.330" |sort -n|uniq -c |sort -rn
324
325 find / -type f -name *.html | xargs egrep -l "WriteData|svchost.exe|DropPath|wsh.Run|WindowBomb|a1.createInstance|CurrentVersion|myEncString|DropFileName|a = prototype;|204.351.440.495.232.315.444.550.64.330" |sort -n|uniq -c |sort -rn| awk ‘{print $2}‘ | xargs -I{} cp {} /tmp/
326
327 echo "后门样本已拷贝到/tmp/目录"
328
329 else
330
331 echo "未检测到HTML恶意代码"
332
333 fi
334
335 echo "----------------------检查系统是否存在perl恶意程序----------------------"
336
337 if find / -type f -name *.pl | xargs egrep -l "SHELLPASSWORD|shcmd|backdoor|setsockopt|IO::Socket::INET;" 1>/dev/null 2>&1;then
338
339 echo "发现perl恶意程序"
340
341 find / -type f -name *.pl | xargs egrep -l "SHELLPASSWORD|shcmd|backdoor|setsockopt|IO::Socket::INET;"|sort -n|uniq -c |sort -rn
342
343 find / -type f -name *.pl | xargs egrep -l "SHELLPASSWORD|shcmd|backdoor|setsockopt|IO::Socket::INET;"|sort -n|uniq -c |sort -rn| awk ‘{print $2}‘ | xargs -I{} cp {} /tmp/
344
345 echo "可疑样本已拷贝到/tmp/目录"
346
347 else
348
349 echo "未检测到perl恶意程序"
350
351 fi
352
353 echo "----------------------检查系统是否存在Python恶意程序----------------------"
354
355 find / -type f -name *.py | xargs egrep -l "execCmd|cat /etc/issue|getAppProc|exploitdb" |sort -n|uniq -c |sort -rn
356
357 find / -type f -name *.py | xargs egrep -l "execCmd|cat /etc/issue|getAppProc|exploitdb" |sort -n|uniq -c |sort -rn| awk ‘{print $2}‘ | xargs -I{} cp {} /tmp/
358
359 echo ------------------------------------------------------------------------
360
361 echo "-----------------------检查系统是否存在恶意程序---------------------"
362
363 find / -type f -perm -111 |xargs egrep "UpdateProcessER12CUpdateGatesE6C|CmdMsg\.cpp|MiniHttpHelper.cpp|y4‘r3 1uCky k1d\!|[email protected]@GLIBC_2.0|initfini.c|ptmalloc_unlock_all2|_IO_wide_data_2|[email protected]@GLIBC_2.0|[email protected]@GLIBC_2.0|[email protected]@GLIBC_2.0|[email protected]@GLIBC_2.2.5|WwW.SoQoR.NeT|2.6.17-2.6.24.1.c|Local Root Exploit|[email protected]@GLIBC_2.0|syscall\(\__NR\_vmsplice,|Linux vmsplice Local Root Exploit|It looks like the exploit failed|getting root shell" 2>/dev/null
364
365 echo ------------------------------------------------------------------------
366
367 echo "检查网络连接和监听端口"
368
369 netstat -an
370
371 echo "--------------------------路由表、网络连接、接口信息--------------"
372
373 netstat -rn
374
375 echo "------------------------查看网卡详细信息--------------------------"
376
377 ifconfig -a
378
379 echo ------------------------------------------------------------------------
380
381 echo "查看正常情况下登录到本机的所有用户的历史记录"
382
383 last
384
385 echo ------------------------------------------------------------------------
386
387 echo -----------内核文件dump配置检查中---------------------------------------
388
389 echo "检查系统中core文件是否开启"
390
391 cat /etc/security/limits.conf | grep -v ^# | grep core
392 if [ $? = 0 ];then
393 #soft=`cat /etc/security/limits.conf| grep -V ^# | grep core | awk {print $2}`
394 soft=`cat /etc/security/limits.conf| grep -v ‘^#‘ | awk ‘{print $2}‘` &> /dev/null
395 for i in $soft
396 do
397 if [ $i = "soft" ];then
398 echo -e " [ √ ] 内核文件dump配置检查[*\tsoft\tcore\t0]已经设置"
399 fi
400 if [ $i = "hard" ];then
401 echo -e " [ √ ] 内核文件dump配置检查[*\thard\tcore\t0]已经设置"
402 fi
403 done
404 else
405 echo -e " [ X ] 没有设置core，建议在/etc/security/limits.conf中添加[*\tsoft\tcore\t0]和[*\thard\tcore\t0]"
406 fi
407
408 ulimit -c
409
410 echo "core是unix系统的内核。当你的程序出现内存越界的时候,操作系统会中止你的进程,并将当前内存状态倒出到core文件中,以便进一步分析，如果返回结果为0，则是关闭了此功能，系统不会生成core文件"
411
412 echo ------------------------------------------------------------------------
413
414 echo "检查系统中关键文件修改时间"
415
416 ls -ltr /bin/ls /bin/login /etc/passwd /bin/ps /usr/bin/top /etc/shadow|awk ‘{print "文件名："$8" ""最后修改时间："$6" "$7}‘
417
418 echo "ls文件：是存储ls命令的功能函数，被删除以后，就无法执行ls命令，黑客可利用篡改ls文件来执行后门或其他程序。
419
420 login文件：login是控制用户登录的文件，一旦被篡改或删除，系统将无法切换用户或登陆用户
421
422 user/bin/passwd是一个命令，可以为用户添加、更改密码，但是，用户的密码并不保存在/etc/passwd当中，而是保存在了/etc/shadow当中
423
424 etc/passwd是一个文件，主要是保存用户信息。
425
426 sbin/portmap是文件转换服务，缺少该文件后，无法使用磁盘挂载、转换类型等功能。
427
428 bin/ps 进程查看命令功能支持文件，文件损坏或被更改后，无法正常使用ps命令。
429
430 usr/bin/top top命令支持文件，是Linux下常用的性能分析工具,能够实时显示系统中各个进程的资源占用状况。
431
432 etc/shadow shadow 是 /etc/passwd 的影子文件，密码存放在该文件当中，并且只有root用户可读。"
433
434 echo --------------------------------------------------------------------------
435
436 echo "-------------------查看系统日志文件是否存在--------------------"
437
438 log=/var/log/syslog
439
440 log2=/var/log/messages
441
442 if [ -e "$log" ]; then
443
444 echo "syslog日志文件存在！ "
445
446 else
447
448 echo "/var/log/syslog日志文件不存在！ "
449
450 fi
451
452 if [ -e "$log2" ]; then
453
454 echo "/var/log/messages日志文件存在！ "
455
456 else
457
458 echo "/var/log/messages日志文件不存在！ "
459
460 fi
461
462 echo --------------------------------------------------------------------------
463
464 echo "检查系统文件完整性2(MD5检查)"
465
466 echo "该项会获取部分关键文件的MD5值并入库，默认保存在/etc/md5db中"
467
468 echo "如果第一次执行，则会提示md5sum: /sbin/portmap: 没有那个文件或目录"
469
470 echo "第二次重复检查时，则会对MD5DB中的MD5值进行匹配，来判断文件是否被更改过"
471
472 file="/etc/md5db"
473
474 if [ -e "$file" ]; then md5sum -c /etc/md5db 2>&1;
475
476 else
477
478 md5sum /etc/passwd >>/etc/md5db
479
480 md5sum /etc/shadow >>/etc/md5db
481
482 md5sum /etc/group >>/etc/md5db
483
484 md5sum /usr/bin/passwd >>/etc/md5db
485
486 md5sum /sbin/portmap>>/etc/md5db
487
488 md5sum /bin/login >>/etc/md5db
489
490 md5sum /bin/ls >>/etc/md5db
491
492 md5sum /bin/ps >>/etc/md5db
493
494 md5sum /usr/bin/top >>/etc/md5db;
495
496 fi
497
498 echo ----------------------------------------------------------------------
499
500 echo "------------------------主机性能检查--------------------------------"
501
502 echo "CPU检查"
503
504 dmesg | grep -i cpu
505
506 echo -----------------------------------------------------------------------
507
508 more /proc/cpuinfo
509
510 echo -----------------------------------------------------------------------
511
512 echo "内存状态检查"
513
514 vmstat 2 5
515
516 echo -----------------------------------------------------------------------
517
518 more /proc/meminfo
519
520 echo -----------------------------------------------------------------------
521
522 free -m
523
524 echo -----------------------------------------------------------------------
525
526 echo "文件系统使用情况"
527
528 df -h
529
530 echo -----------------------------------------------------------------------
531
532 echo "网卡使用情况"
533
534 lspci -tv
535
536 echo ----------------------------------------------------------------------
537
538 echo "查看僵尸进程"
539
540 ps -ef | grep zombie
541
542 echo ----------------------------------------------------------------------
543
544 echo "耗CPU最多的进程"
545
546 ps auxf |sort -nr -k 3 |head -5
547
548 echo ----------------------------------------------------------------------
549
550 echo "耗内存最多的进程"
551
552 ps auxf |sort -nr -k 4 |head -5
553
554 echo ----------------------------------------------------------------------
555
556 echo ---------------------------------------------------------------------
557
558
559 echo ---------------------------------------------------------------------
原文地址：https://www.cnblogs.com/Leonardo-li/p/12112461.html
时间： 2024-09-05 08:06:01