Shell批量登陆和执行安全基线检查脚本

摘要

*本文原创作者:nothing100,本文属FreeBuf原创奖励计划,未经许可禁止转载

前言

由于没有相关自动化安全检查基线设备,为了方便自己工作,写了个shell脚本,批量登陆、执行、提取远程服务器数据。

脚本说明

1.将本目录所有文件都放入到一台自己的本地linux主机同一目录下

2.将服务器IP、普通账号、普通账号密码、root密码依次按以下格式写入到hosts.txt中(注意“~”作为hosts.txt的分隔符):

192.168.1.81~user~123456~nothing

192.168.1.10~user~123456~nothing

192.168.1.11~user~123456~nothing

3.执行sh login.sh,脚本将自动批量上传checklinux.sh到服务器/tmp目录下,并且自动执行和自动上传结果到本地linux主机上

4.最后将服务器上传的脚本和结果自动删除

(注意:本脚本适用于linux系统)

主脚本login.sh(用于批量调用put.exp、sh.exp、get.exp、del.exp无交互脚本)

#!/bin/bash #version 2.0 #author by 網菔務卐 cat <<EOF ************************************************************************************* *****使用说明:                                                                    **  *****   1.由于安全方面root可能无法远程登陆,所以本程序是先登陆普通用户在su到root用户 最后使用root执行login.sh脚本实现无交互批量登陆                                     **  *****   2.使用普通用户上传须可对/tmp目录读写执行权限                               ** *****   3.远程服务器执行检查脚本和输出结果都在/tmp目录下面                         ** *****   4.远程服务器执行完脚本后将会上传到本地/tmp目录下                           ** *****   5.远程服务器将会自动删除checklinux.sh和输出结果                            ** ************************************************************************************* EOF for i in `cat hosts.txt` do   #远程IP地址   ipadd=`echo $i | awk -F "[~]" '{print $1}'`   #普通用户   username=`echo $i | awk -F "[~]" '{print $2}'`   #普通用户密码   userpasswd=`echo $i | awk -F "[~]" '{print $3}'`   #root用户密码   rootpasswd=`echo $i | awk -F "[~]" '{print $4}'`   #传checklinux   expect put.exp $ipadd $username $userpasswd    #登陆执行checklinux   expect sh.exp $ipadd $username $userpasswd $rootpasswd    #从远程拿取结果   expect get.exp $ipadd $username $userpasswd    #删除远程结果和脚本   expect del.exp $ipadd $username $userpasswd $rootpasswd done 

checklinux.sh安全检查脚本

#!/bin/bash #version 2.0 #author by 網菔務卐  cat <<EOF ************************************************************************************* *****    linux基线检查脚本           ***** ************************************************************************************* *****    linux基线配置规范设计    ***** *****    输出结果/tmp/${ipadd}_out.txt     ***** ************************************************************************************* EOF  echo "***************************" echo "账号策略检查中..." echo "***************************" ipadd=`ifconfig -a | grep Bcast | awk -F "[ :]+" '{print $4}'` passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'` passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'` passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'` passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`  if [ $passmax -le 90 -a $passmax -gt 0];then   echo "口令生存周期为${passmax}天,符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令生存周期为${passmax}天,不符合要求,建议设置不大于90天" >> /tmp/${ipadd}_out.txt fi  if [ $passmin -ge 6 ];then   echo "口令更改最小时间间隔为${passmin}天,符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令更改最小时间间隔为${passmin}天,不符合要求,建议设置大于等于6天" >> /tmp/${ipadd}_out.txt fi  if [ $passlen -ge 8 ];then   echo "口令最小长度为${passlen},符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令最小长度为${passlen},不符合要求,建议设置最小长度大于等于8" >> /tmp/${ipadd}_out.txt fi  if [ $passage -ge 30 -a $passage -lt $passmax ];then   echo "口令过期警告时间天数为${passage},符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令过期警告时间天数为${passage},不符合要求,建议设置大于等于30并小于口令生存周期" >> /tmp/${ipadd}_out.txt fi  echo "***************************" echo "账号是否会主动注销检查中..." echo "***************************" cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'  if [ $? -eq 0 ];then   TMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'`   if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];then     echo "账号超时时间${TMOUT}秒,符合要求" >> /tmp/${ipadd}_out.txt   else     echo "账号超时时间${TMOUT}秒,不符合要求,建议设置小于600秒" >> /tmp/${ipadd}_out.txt   fi else   echo "账号超时不存在自动注销,不符合要求,建议设置小于600秒" >> /tmp/${ipadd}_out.txt  fi  #grub和lilo密码是否设置检查 cat /etc/grub.conf | grep password 2> /dev/null if [ $? -eq 0 ];then   echo "已设置grub密码,符合要求" >> /tmp/${ipadd}_out.txt else   echo "没有设置grub密码,不符合要求,建议设置grub密码" >> /tmp/${ipadd}_out.txt fi  cat /etc/lilo.conf | grep password 2> /dev/null if [ $? -eq 0 ];then   echo "已设置lilo密码,符合要求" >> /tmp/${ipadd}_out.txt else   echo "没有设置lilo密码,不符合要求,建议设置lilo密码" >> /tmp/${ipadd}_out.txt fi  #查找非root账号UID为0的账号 UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd` flag=0 for i in $UIDS do   if [ $i = 0 ];then     echo "存在非root账号的账号UID为0,不符合要求" >> /tmp/${ipadd}_out.txt   else     flag=1   fi done if [ $flag = 1 ];then   echo "不存在非root账号的账号UID为0,符合要求" >> /tmp/${ipadd}_out.txt fi  #检查umask设置 umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'` umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'` umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'` flags=0 for i in $umask1 do   if [ $i = "027" ];then     echo "/etc/profile文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done if [ $flags = 1 ];then   echo "/etc/profile文件中所所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi    flags=0 for i in $umask2 do   if [ $i = "027" ];then     echo "/etc/csh.cshrc文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done   if [ $flags = 1 ];then   echo "/etc/csh.cshrc文件中所所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi   flags=0 for i in $umask3 do   if [ $i = "027" ];then     echo "/etc/bashrc文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done if [ $flags = 1 ];then   echo "/etc/bashrc文件中所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi     echo "***************************" echo "检查重要文件权限中..." echo "***************************"  file1=`ls -l /etc/passwd | awk '{print $1}'` file2=`ls -l /etc/shadow | awk '{print $1}'` file3=`ls -l /etc/group | awk '{print $1}'` file4=`ls -l /etc/securetty | awk '{print $1}'` file5=`ls -l /etc/services | awk '{print $1}'` file6=`ls -l /etc/xinetd.conf | awk '{print $1}'` file7=`ls -l /etc/grub.conf | awk '{print $1}'` file8=`ls -l /etc/lilo.conf | awk '{print $1}'`  if [ $file1 = "-rw-r--r--" ];then   echo "/etc/passwd文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/passwd文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file2 = "-r--------" ];then   echo "/etc/shadow文件权限为400,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/shadow文件权限不为400,不符合要求,建议设置权限为400" >> /tmp/${ipadd}_out.txt fi  if [ $file3 = "-rw-r--r--" ];then   echo "/etc/group文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/group文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file4 = "-rw-------" ];then   echo "/etc/security文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/security文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ $file5 = "-rw-r--r--" ];then   echo "/etc/services文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/services文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file6 = "-rw-------" ];then   echo "/etc/xinetd.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/xinetd.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ $file7 = "-rw-------" ];then   echo "/etc/grub.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/grub.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ -f /etc/lilo.conf ];then   if [ $file8 = "-rw-------" ];then     echo "/etc/lilo.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt   else     echo "/etc/lilo.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt   fi    else   echo "/etc/lilo.conf文件夹不存在" fi  cat /etc/security/limits.conf | grep -V ^# | grep core if [ $? -eq 0 ];then   soft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`   for i in $soft   do     if [ $i = "soft" ];then       echo "* soft core 0 已经设置" >> /tmp/${ipadd}_out.txt     fi     if [ $i = "hard" ];then       echo "* hard core 0 已经设置" >> /tmp/${ipadd}_out.txt     fi   done else    echo "没有设置core,建议在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> /tmp/${ipadd}_out.txt fi   echo "***************************" echo "检查ssh配置文件中..." echo "***************************" cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no" if [ $? -eq 0 ];then   echo "已经设置远程root不能登陆,符合要求" >> /tmp/${ipadd}_out.txt else   echo "不已经设置远程root不能登陆,不符合要求,建议/etc/ssh/sshd_config添加PermitRootLogin no" >> /tmp/${ipadd}_out.txt fi  #检查telnet是否开启 telnetd=`cat /etc/xinetd.d/telnet | grep disable | awk '{print $3}'` if [ $telnetd = "yes" ];then   echo "检测到telnet服务开启,不符合要求,建议关闭telnet" >> /tmp/${ipadd}_out.txt fi  Protocol=`cat /etc/ssh/sshd_config | grep -v ^# | grep Protocol | awk '{print $2}'` if [ $Protocol = 2 ];then   echo "openssh使用ssh2协议,符合要求" >> /tmp/${ipadd}_out.txt fi if [ $Protocol = 1 ];then   echo "openssh使用ssh1协议,不符合要求" >> /tmp/${ipadd}_out.txt fi  #检查保留历时命令条数 HISTSIZE=`cat /etc/profile|grep HISTSIZE|head -1|awk -F[=] '{print $2}'` if [ $HISTSIZE -eq 5 ];then   echo "保留历时命令条数为$HISTSIZE,符合要求" >> /tmp/${ipadd}_out.txt else   echo "保留历时命令条数为$HISTSIZE,不符合要求,建议/etc/profile的HISTSIZE设置为5" >> /tmp/${ipadd}_out.txt fi  #检查重要文件的属性 flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/passwd | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/passwd文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/passwd文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/passwd文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/passwd被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/shadow | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/shadow文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/shadow文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/shadow文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/shadow被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/gshadow | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/gshadow文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/gshadow文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/gshadow文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/gshadow被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/group | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/group文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/group文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/group文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/group被删除或修改" >> /tmp/${ipadd}_out.txt fi   #检查snmp默认团体口令public、private if [ -f /etc/snmp/snmpd.conf ];then   public=`cat /etc/snmp/snmpd.conf | grep public | grep -v ^# | awk '{print $4}'`   private=`cat /etc/snmp/snmpd.conf | grep private | grep -v ^# | awk '{print $4}'`   if [ $public = "public" ];then     echo "发现snmp服务存在默认团体名public,不符合要求" >> /tmp/${ipadd}_out.txt   fi   if [[ $private = "private" ]];then     echo "发现snmp服务存在默认团体名private,不符合要求" >> /tmp/${ipadd}_out.txt   fi else   echo "snmp服务配置文件不存在,可能没有运行snmp服务"  fi  #检查主机信任关系 rhosts=`find / -name .rhosts` rhosts2=`find / -name hosts.equiv` for i in $rhosts do   if [ -f $i ];then   echo "找到信任主机关系,请查看${i}文件,请自行判断是否属于正常业务需求,建议删除信任IP" >> /tmp/${ipadd}_out.txt   fi  done  #检查日志审核功能是否开启 service auditd status if [ $? = 0 ];then   echo "系统日志审核功能已开启,符合要求" >> /tmp/${ipadd}_out.txt fi if [ $? = 3 ];then   echo "系统日志审核功能已关闭,不符合要求,建议service auditd start开启" >> /tmp/${ipadd}_out.txt fi  #检查磁盘动态空间,是否大于等于80% space=`df -h | awk -F "[ %]+" 'NR!=1{print $5}'` for i in $space do   if [ $i -ge 80 ];then     echo "警告!磁盘存储容量大于80%,建议扩充磁盘容量或者删除垃圾文件" >> /tmp/${ipadd}_out.txt   fi done  echo "***************************" echo "*** 检查完毕      ***" echo "***************************"  

put.exp上传checklinux.sh脚本到远程服务器/tmp目录下

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set timeout 10 spawn scp checklinux.sh $username@$ipadd:/tmp/ expect {   "yes/no" {send "yes/r";exp_continue}   "password" {send "$userpasswd/r"} } expect eof 

sh.exp 批量远程登陆和执行,将结果放到/tmp目录下

#!/usr/bin/expect set ipaddr [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set rootpasswd [lindex $argv 3] set timeout 10 spawn ssh $username@$ipaddr   expect {   "yse/no" {send "yes/r";exp_continue}   "*password*" {send "$userpasswd/r";exp_continue}   "*from*" {send "su - root/r"} } expect "Password" send "$rootpasswd/r" expect "*]#" send "chmod 777 /tmp/checklinux.sh/r" send "sh /tmp/checklinux.sh/r" send "exit/r" send "exit/r" interact  

get.exp批量获取远程结果放到本地/tmp目录

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set timeout 10 spawn scp $username@$ipadd:/tmp/*${ipadd}* /tmp/ expect {   "password" {send "$userpasswd/r"} } expect eof

del.exp批量远程删除上传的脚本和结果

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set rootpasswd [lindex $argv 3] set timeout 10 spawn ssh $username@$ipadd expect {   "password" {send "$userpasswd/r";exp_continue}   "*from*" {send "su - root/r";exp_continue}   "*assword*" {send "$rootpasswd/r";exp_continue}   "*]#" {send "rm -f /tmp/*${ipadd}*.txt /tmp/checklinux.sh/r"} } expect eof 

下载链接:http://pan.baidu.com/s/1pLau2fT 密码:ts3z

*本文原创作者:nothing100,本文属FreeBuf原创奖励计划,未经许可禁止转载

广告也精彩

*本文原创作者:nothing100,本文属FreeBuf原创奖励计划,未经许可禁止转载

前言

由于没有相关自动化安全检查基线设备,为了方便自己工作,写了个shell脚本,批量登陆、执行、提取远程服务器数据。

脚本说明

1.将本目录所有文件都放入到一台自己的本地linux主机同一目录下

2.将服务器IP、普通账号、普通账号密码、root密码依次按以下格式写入到hosts.txt中(注意“~”作为hosts.txt的分隔符):

192.168.1.81~user~123456~nothing

192.168.1.10~user~123456~nothing

192.168.1.11~user~123456~nothing

3.执行sh login.sh,脚本将自动批量上传checklinux.sh到服务器/tmp目录下,并且自动执行和自动上传结果到本地linux主机上

4.最后将服务器上传的脚本和结果自动删除

(注意:本脚本适用于linux系统)

主脚本login.sh(用于批量调用put.exp、sh.exp、get.exp、del.exp无交互脚本)

#!/bin/bash #version 2.0 #author by 網菔務卐 cat <<EOF ************************************************************************************* *****使用说明:                                                                    **  *****   1.由于安全方面root可能无法远程登陆,所以本程序是先登陆普通用户在su到root用户 最后使用root执行login.sh脚本实现无交互批量登陆                                     **  *****   2.使用普通用户上传须可对/tmp目录读写执行权限                               ** *****   3.远程服务器执行检查脚本和输出结果都在/tmp目录下面                         ** *****   4.远程服务器执行完脚本后将会上传到本地/tmp目录下                           ** *****   5.远程服务器将会自动删除checklinux.sh和输出结果                            ** ************************************************************************************* EOF for i in `cat hosts.txt` do   #远程IP地址   ipadd=`echo $i | awk -F "[~]" '{print $1}'`   #普通用户   username=`echo $i | awk -F "[~]" '{print $2}'`   #普通用户密码   userpasswd=`echo $i | awk -F "[~]" '{print $3}'`   #root用户密码   rootpasswd=`echo $i | awk -F "[~]" '{print $4}'`   #传checklinux   expect put.exp $ipadd $username $userpasswd    #登陆执行checklinux   expect sh.exp $ipadd $username $userpasswd $rootpasswd    #从远程拿取结果   expect get.exp $ipadd $username $userpasswd    #删除远程结果和脚本   expect del.exp $ipadd $username $userpasswd $rootpasswd done 

checklinux.sh安全检查脚本

#!/bin/bash #version 2.0 #author by 網菔務卐  cat <<EOF ************************************************************************************* *****    linux基线检查脚本           ***** ************************************************************************************* *****    linux基线配置规范设计    ***** *****    输出结果/tmp/${ipadd}_out.txt     ***** ************************************************************************************* EOF  echo "***************************" echo "账号策略检查中..." echo "***************************" ipadd=`ifconfig -a | grep Bcast | awk -F "[ :]+" '{print $4}'` passmax=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v ^# | awk '{print $2}'` passmin=`cat /etc/login.defs | grep PASS_MIN_DAYS | grep -v ^# | awk '{print $2}'` passlen=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v ^# | awk '{print $2}'` passage=`cat /etc/login.defs | grep PASS_WARN_AGE | grep -v ^# | awk '{print $2}'`  if [ $passmax -le 90 -a $passmax -gt 0];then   echo "口令生存周期为${passmax}天,符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令生存周期为${passmax}天,不符合要求,建议设置不大于90天" >> /tmp/${ipadd}_out.txt fi  if [ $passmin -ge 6 ];then   echo "口令更改最小时间间隔为${passmin}天,符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令更改最小时间间隔为${passmin}天,不符合要求,建议设置大于等于6天" >> /tmp/${ipadd}_out.txt fi  if [ $passlen -ge 8 ];then   echo "口令最小长度为${passlen},符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令最小长度为${passlen},不符合要求,建议设置最小长度大于等于8" >> /tmp/${ipadd}_out.txt fi  if [ $passage -ge 30 -a $passage -lt $passmax ];then   echo "口令过期警告时间天数为${passage},符合要求" >> /tmp/${ipadd}_out.txt else   echo "口令过期警告时间天数为${passage},不符合要求,建议设置大于等于30并小于口令生存周期" >> /tmp/${ipadd}_out.txt fi  echo "***************************" echo "账号是否会主动注销检查中..." echo "***************************" cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'  if [ $? -eq 0 ];then   TMOUT=`cat /etc/profile | grep TMOUT | awk -F[=] '{print $2}'`   if [ $TMOUT -le 600 -a $TMOUT -ge 10 ];then     echo "账号超时时间${TMOUT}秒,符合要求" >> /tmp/${ipadd}_out.txt   else     echo "账号超时时间${TMOUT}秒,不符合要求,建议设置小于600秒" >> /tmp/${ipadd}_out.txt   fi else   echo "账号超时不存在自动注销,不符合要求,建议设置小于600秒" >> /tmp/${ipadd}_out.txt  fi  #grub和lilo密码是否设置检查 cat /etc/grub.conf | grep password 2> /dev/null if [ $? -eq 0 ];then   echo "已设置grub密码,符合要求" >> /tmp/${ipadd}_out.txt else   echo "没有设置grub密码,不符合要求,建议设置grub密码" >> /tmp/${ipadd}_out.txt fi  cat /etc/lilo.conf | grep password 2> /dev/null if [ $? -eq 0 ];then   echo "已设置lilo密码,符合要求" >> /tmp/${ipadd}_out.txt else   echo "没有设置lilo密码,不符合要求,建议设置lilo密码" >> /tmp/${ipadd}_out.txt fi  #查找非root账号UID为0的账号 UIDS=`awk -F[:] 'NR!=1{print $3}' /etc/passwd` flag=0 for i in $UIDS do   if [ $i = 0 ];then     echo "存在非root账号的账号UID为0,不符合要求" >> /tmp/${ipadd}_out.txt   else     flag=1   fi done if [ $flag = 1 ];then   echo "不存在非root账号的账号UID为0,符合要求" >> /tmp/${ipadd}_out.txt fi  #检查umask设置 umask1=`cat /etc/profile | grep umask | grep -v ^# | awk '{print $2}'` umask2=`cat /etc/csh.cshrc | grep umask | grep -v ^# | awk '{print $2}'` umask3=`cat /etc/bashrc | grep umask | grep -v ^# | awk 'NR!=1{print $2}'` flags=0 for i in $umask1 do   if [ $i = "027" ];then     echo "/etc/profile文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done if [ $flags = 1 ];then   echo "/etc/profile文件中所所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi    flags=0 for i in $umask2 do   if [ $i = "027" ];then     echo "/etc/csh.cshrc文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done   if [ $flags = 1 ];then   echo "/etc/csh.cshrc文件中所所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi   flags=0 for i in $umask3 do   if [ $i = "027" ];then     echo "/etc/bashrc文件中所设置的umask为${i},符合要求" >> /tmp/${ipadd}_out.txt   else     flags=1   fi done if [ $flags = 1 ];then   echo "/etc/bashrc文件中所设置的umask为${i},不符合要求,建议设置为027" >> /tmp/${ipadd}_out.txt fi     echo "***************************" echo "检查重要文件权限中..." echo "***************************"  file1=`ls -l /etc/passwd | awk '{print $1}'` file2=`ls -l /etc/shadow | awk '{print $1}'` file3=`ls -l /etc/group | awk '{print $1}'` file4=`ls -l /etc/securetty | awk '{print $1}'` file5=`ls -l /etc/services | awk '{print $1}'` file6=`ls -l /etc/xinetd.conf | awk '{print $1}'` file7=`ls -l /etc/grub.conf | awk '{print $1}'` file8=`ls -l /etc/lilo.conf | awk '{print $1}'`  if [ $file1 = "-rw-r--r--" ];then   echo "/etc/passwd文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/passwd文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file2 = "-r--------" ];then   echo "/etc/shadow文件权限为400,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/shadow文件权限不为400,不符合要求,建议设置权限为400" >> /tmp/${ipadd}_out.txt fi  if [ $file3 = "-rw-r--r--" ];then   echo "/etc/group文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/group文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file4 = "-rw-------" ];then   echo "/etc/security文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/security文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ $file5 = "-rw-r--r--" ];then   echo "/etc/services文件权限为644,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/services文件权限不为644,不符合要求,建议设置权限为644" >> /tmp/${ipadd}_out.txt fi  if [ $file6 = "-rw-------" ];then   echo "/etc/xinetd.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/xinetd.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ $file7 = "-rw-------" ];then   echo "/etc/grub.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt else   echo "/etc/grub.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt fi  if [ -f /etc/lilo.conf ];then   if [ $file8 = "-rw-------" ];then     echo "/etc/lilo.conf文件权限为600,符合要求" >> /tmp/${ipadd}_out.txt   else     echo "/etc/lilo.conf文件权限不为600,不符合要求,建议设置权限为600" >> /tmp/${ipadd}_out.txt   fi    else   echo "/etc/lilo.conf文件夹不存在" fi  cat /etc/security/limits.conf | grep -V ^# | grep core if [ $? -eq 0 ];then   soft=`cat /etc/security/limits.conf | grep -V ^# | grep core | awk {print $2}`   for i in $soft   do     if [ $i = "soft" ];then       echo "* soft core 0 已经设置" >> /tmp/${ipadd}_out.txt     fi     if [ $i = "hard" ];then       echo "* hard core 0 已经设置" >> /tmp/${ipadd}_out.txt     fi   done else    echo "没有设置core,建议在/etc/security/limits.conf中添加* soft core 0和* hard core 0" >> /tmp/${ipadd}_out.txt fi   echo "***************************" echo "检查ssh配置文件中..." echo "***************************" cat /etc/ssh/sshd_config | grep -v ^# |grep "PermitRootLogin no" if [ $? -eq 0 ];then   echo "已经设置远程root不能登陆,符合要求" >> /tmp/${ipadd}_out.txt else   echo "不已经设置远程root不能登陆,不符合要求,建议/etc/ssh/sshd_config添加PermitRootLogin no" >> /tmp/${ipadd}_out.txt fi  #检查telnet是否开启 telnetd=`cat /etc/xinetd.d/telnet | grep disable | awk '{print $3}'` if [ $telnetd = "yes" ];then   echo "检测到telnet服务开启,不符合要求,建议关闭telnet" >> /tmp/${ipadd}_out.txt fi  Protocol=`cat /etc/ssh/sshd_config | grep -v ^# | grep Protocol | awk '{print $2}'` if [ $Protocol = 2 ];then   echo "openssh使用ssh2协议,符合要求" >> /tmp/${ipadd}_out.txt fi if [ $Protocol = 1 ];then   echo "openssh使用ssh1协议,不符合要求" >> /tmp/${ipadd}_out.txt fi  #检查保留历时命令条数 HISTSIZE=`cat /etc/profile|grep HISTSIZE|head -1|awk -F[=] '{print $2}'` if [ $HISTSIZE -eq 5 ];then   echo "保留历时命令条数为$HISTSIZE,符合要求" >> /tmp/${ipadd}_out.txt else   echo "保留历时命令条数为$HISTSIZE,不符合要求,建议/etc/profile的HISTSIZE设置为5" >> /tmp/${ipadd}_out.txt fi  #检查重要文件的属性 flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/passwd | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/passwd文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/passwd文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/passwd文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/passwd被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/shadow | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/shadow文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/shadow文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/shadow文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/shadow被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/gshadow | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/gshadow文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/gshadow文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/gshadow文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/gshadow被删除或修改" >> /tmp/${ipadd}_out.txt fi  flag=0 for ((x=1;x<=15;x++)) do   apend=`lsattr /etc/group | cut -c $x`   if [ $apend = "i" ];then     echo "/etc/group文件存在i安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi   if [ $apend = "a" ];then     echo "/etc/group文件存在a安全属性" >> /tmp/${ipadd}_out.txt     flag=1   fi done if [ $flag = 0 ];then   echo "/etc/group文件不存在相关安全属性,建议使用chattr +i或chattr +a防止/etc/group被删除或修改" >> /tmp/${ipadd}_out.txt fi   #检查snmp默认团体口令public、private if [ -f /etc/snmp/snmpd.conf ];then   public=`cat /etc/snmp/snmpd.conf | grep public | grep -v ^# | awk '{print $4}'`   private=`cat /etc/snmp/snmpd.conf | grep private | grep -v ^# | awk '{print $4}'`   if [ $public = "public" ];then     echo "发现snmp服务存在默认团体名public,不符合要求" >> /tmp/${ipadd}_out.txt   fi   if [[ $private = "private" ]];then     echo "发现snmp服务存在默认团体名private,不符合要求" >> /tmp/${ipadd}_out.txt   fi else   echo "snmp服务配置文件不存在,可能没有运行snmp服务"  fi  #检查主机信任关系 rhosts=`find / -name .rhosts` rhosts2=`find / -name hosts.equiv` for i in $rhosts do   if [ -f $i ];then   echo "找到信任主机关系,请查看${i}文件,请自行判断是否属于正常业务需求,建议删除信任IP" >> /tmp/${ipadd}_out.txt   fi  done  #检查日志审核功能是否开启 service auditd status if [ $? = 0 ];then   echo "系统日志审核功能已开启,符合要求" >> /tmp/${ipadd}_out.txt fi if [ $? = 3 ];then   echo "系统日志审核功能已关闭,不符合要求,建议service auditd start开启" >> /tmp/${ipadd}_out.txt fi  #检查磁盘动态空间,是否大于等于80% space=`df -h | awk -F "[ %]+" 'NR!=1{print $5}'` for i in $space do   if [ $i -ge 80 ];then     echo "警告!磁盘存储容量大于80%,建议扩充磁盘容量或者删除垃圾文件" >> /tmp/${ipadd}_out.txt   fi done  echo "***************************" echo "*** 检查完毕      ***" echo "***************************"  

put.exp上传checklinux.sh脚本到远程服务器/tmp目录下

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set timeout 10 spawn scp checklinux.sh $username@$ipadd:/tmp/ expect {   "yes/no" {send "yes/r";exp_continue}   "password" {send "$userpasswd/r"} } expect eof 

sh.exp 批量远程登陆和执行,将结果放到/tmp目录下

#!/usr/bin/expect set ipaddr [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set rootpasswd [lindex $argv 3] set timeout 10 spawn ssh $username@$ipaddr   expect {   "yse/no" {send "yes/r";exp_continue}   "*password*" {send "$userpasswd/r";exp_continue}   "*from*" {send "su - root/r"} } expect "Password" send "$rootpasswd/r" expect "*]#" send "chmod 777 /tmp/checklinux.sh/r" send "sh /tmp/checklinux.sh/r" send "exit/r" send "exit/r" interact  

get.exp批量获取远程结果放到本地/tmp目录

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set timeout 10 spawn scp $username@$ipadd:/tmp/*${ipadd}* /tmp/ expect {   "password" {send "$userpasswd/r"} } expect eof

del.exp批量远程删除上传的脚本和结果

#!/usr/bin/expect set ipadd [lindex $argv 0] set username [lindex $argv 1] set userpasswd [lindex $argv 2] set rootpasswd [lindex $argv 3] set timeout 10 spawn ssh $username@$ipadd expect {   "password" {send "$userpasswd/r";exp_continue}   "*from*" {send "su - root/r";exp_continue}   "*assword*" {send "$rootpasswd/r";exp_continue}   "*]#" {send "rm -f /tmp/*${ipadd}*.txt /tmp/checklinux.sh/r"} } expect eof 

下载链接:http://pan.baidu.com/s/1pLau2fT 密码:ts3z

*本文原创作者:nothing100,本文属FreeBuf原创奖励计划,未经许可禁止转载

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: