系统入侵检测脚本

#!/bin/bash # ========================================== # 系统入侵检测脚本 # 用途：全面检测系统安全状态，发现异常和潜在入侵 # 使用方法：bash security_audit.sh # ========================================== LOG_FILE="/var/log/security_audit.log" REPORT_FILE="/tmp/security_report_$(date +%Y%m%d_%H%M%S).txt" mkdir -p "$(dirname "$LOG_FILE")" log_msg() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" "$REPORT_FILE" } section() { echo "" | tee -a "$REPORT_FILE" echo "==========================================" | tee -a "$REPORT_FILE" echo " $1" | tee -a "$REPORT_FILE" echo "==========================================" | tee -a "$REPORT_FILE" } RISK_COUNT=0 add_risk() { local level="$1" local desc="$2" RISK_COUNT=$((RISK_COUNT + 1)) case "$level" in high) echo " 🔴 [高危] $desc" | tee -a "$REPORT_FILE" ;; medium) echo " 🟡 [中危] $desc" | tee -a "$REPORT_FILE" ;; low) echo " 🔵 [低危] $desc" | tee -a "$REPORT_FILE" ;; esac } log_msg "系统安全审计报告" log_msg "主机: $(hostname)" log_msg "时间: $(date '+%Y-%m-%d %H:%M:%S')" log_msg "系统: $(uname -a)" # 1. 异常进程检测 section "1. 异常进程检测" echo " 所有运行进程:" | tee -a "$REPORT_FILE" ps aux --sort=-%cpu | head -15 | tee -a "$REPORT_FILE" # 检测挖矿进程特征 MINING_PROCS=$(ps aux | grep -iE "xmrig|minerd|cpuminer|stratum|monero|nicehash" | grep -v grep) if [ -n "$MINING_PROCS" ]; then add_risk high "发现疑似挖矿进程: $MINING_PROCS" fi # 检测异常高CPU进程 HIGH_CPU=$(ps aux --sort=-%cpu | awk 'NR>1 && $3>80 {print $2" "$11" ("$3"%)"}') if [ -n "$HIGH_CPU" ]; then echo " ⚠️ 高CPU进程:" | tee -a "$REPORT_FILE" echo "$HIGH_CPU" | while read line; do echo " $line" | tee -a "$REPORT_FILE" done fi # 2. 网络连接和端口检测 section "2. 网络连接和端口检测" echo " 监听端口:" | tee -a "$REPORT_FILE" if command -v ss >/dev/null 2>&1; then ss -tlnp 2>/dev/null | tee -a "$REPORT_FILE" else netstat -tlnp 2>/dev/null | tee -a "$REPORT_FILE" fi # 检测异常对外连接 echo "" | tee -a "$REPORT_FILE" echo " 对外连接数Top 10:" | tee -a "$REPORT_FILE" ss -tn 2>/dev/null | awk 'NR>1{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10 | tee -a "$REPORT_FILE" # 3. 用户账号检测 section "3. 用户账号检测" echo " 具有root权限的用户:" | tee -a "$REPORT_FILE" awk -F: '$3==0 {print " "$1" (UID=0)"}' /etc/passwd | tee -a "$REPORT_FILE" ROOT_USERS=$(awk -F: '$3==0 {print $1}' /etc/passwd | grep -v "^root$") if [ -n "$ROOT_USERS" ]; then add_risk high "发现非root用户具有UID=0权限: $ROOT_USERS" fi echo "" | tee -a "$REPORT_FILE" echo " 可登录用户(shell非nologin):" | tee -a "$REPORT_FILE" awk -F: '$7!~/nologin|false/ {print " "$1" ("$7")"}' /etc/passwd | tee -a "$REPORT_FILE" echo "" | tee -a "$REPORT_FILE" echo " sudoers用户:" | tee -a "$REPORT_FILE" grep -v "^#\|^$" /etc/sudoers 2>/dev/null | grep -E "ALL|sudo" | tee -a "$REPORT_FILE" # 4. SSH配置检测 section "4. SSH配置检测" if [ -f /etc/ssh/sshd_config ]; then PERMIT_ROOT=$(grep -i "^PermitRootLogin" /etc/ssh/sshd_config | awk '{print $2}') PASSWORD_AUTH=$(grep -i "^PasswordAuthentication" /etc/ssh/sshd_config | awk '{print $2}') echo " PermitRootLogin: ${PERMIT_ROOT:-默认(yes)}" | tee -a "$REPORT_FILE" echo " PasswordAuthentication: ${PASSWORD_AUTH:-默认(yes)}" | tee -a "$REPORT_FILE" if [ "$PERMIT_ROOT" = "yes" ] || [ -z "$PERMIT_ROOT" ]; then add_risk medium "SSH允许root直接登录，建议禁用" fi if [ "$PASSWORD_AUTH" = "yes" ] || [ -z "$PASSWORD_AUTH" ]; then add_risk low "SSH允许密码登录，建议改用密钥登录" fi fi # 5. 最近登录记录 section "5. 最近登录记录" echo " 最近10条登录记录:" | tee -a "$REPORT_FILE" last -n 10 2>/dev/null | tee -a "$REPORT_FILE" echo "" | tee -a "$REPORT_FILE" echo " 登录失败记录(最近):" | tee -a "$REPORT_FILE" lastb -n 10 2>/dev/null | tee -a "$REPORT_FILE" || echo " (无法读取，需要root权限)" | tee -a "$REPORT_FILE" # 6. SUID/SGID文件检测 section "6. SUID/SGID文件检测" echo " 所有SUID文件:" | tee -a "$REPORT_FILE" find / -perm -4000 -type f 2>/dev/null | head -30 | tee -a "$REPORT_FILE" # 检测异常SUID文件（非标准路径） ABNORMAL_SUID=$(find / -perm -4000 -type f 2>/dev/null | grep -vE "^(/usr/bin/|/bin/|/usr/sbin/|/sbin/|/usr/lib/)") if [ -n "$ABNORMAL_SUID" ]; then add_risk high "发现非标准路径的SUID文件: $ABNORMAL_SUID" fi # 7. 计划任务检测 section "7. 计划任务检测" echo " /etc/crontab:" | tee -a "$REPORT_FILE" cat /etc/crontab 2>/dev/null | grep -v "^#\|^$" | tee -a "$REPORT_FILE" echo "" | tee -a "$REPORT_FILE" echo " /etc/cron.d/:" | tee -a "$REPORT_FILE" ls -la /etc/cron.d/ 2>/dev/null | tee -a "$REPORT_FILE" echo "" | tee -a "$REPORT_FILE" echo " 用户crontab:" | tee -a "$REPORT_FILE" for user in $(cut -d: -f1 /etc/passwd); do crontab -u "$user" -l 2>/dev/null | grep -v "^#\|^$" | while read line; do echo " [$user] $line" | tee -a "$REPORT_FILE" done done # 8. 系统启动项检测 section "8. 系统启动项检测" echo " systemd服务(已启用):" | tee -a "$REPORT_FILE" systemctl list-unit-files --state=enabled 2>/dev/null | grep -v "^#\|^$" | head -30 | tee -a "$REPORT_FILE" # 总结 section "安全审计总结" if [ "$RISK_COUNT" -eq 0 ]; then echo " ✅ 未发现明显安全风险" | tee -a "$REPORT_FILE" else echo " ⚠️ 发现 $RISK_COUNT 个安全风险项，请及时处理" | tee -a "$REPORT_FILE" fi echo "" | tee -a "$REPORT_FILE" echo " 完整报告已保存到: $REPORT_FILE" echo " 日志文件: $LOG_FILE"

[{"name": "REPORT_FILE", "label": "\u62a5\u544a\u4fdd\u5b58\u8def\u5f84", "default": "/tmp/security_report.txt"}]