Linux系统安全基线检查脚本

#!/bin/bash # ========================================== # Linux系统安全基线检查脚本 # 用途：检查系统安全配置，输出合规报告 # 使用方法：bash security_baseline_check.sh # ========================================== echo "========== 系统安全基线检查报告 ==========" echo "检查时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "主机名: $(hostname)" echo "" PASS=0 FAIL=0 WARN=0 check_pass() { echo " ✅ [PASS] $1" PASS=$((PASS+1)) } check_fail() { echo " ❌ [FAIL] $1" FAIL=$((FAIL+1)) } check_warn() { echo " ⚠️ [WARN] $1" WARN=$((WARN+1)) } # 1. 密码策略检查 echo "【1. 密码策略检查】" if [ -f /etc/login.defs ]; then PASS_MAX_DAYS=$(grep "^PASS_MAX_DAYS" /etc/login.defs | awk '{print $2}') if [ "$PASS_MAX_DAYS" -le 90 ] 2>/dev/null; then check_pass "密码最大有效期: ${PASS_MAX_DAYS}天 (≤90天)" else check_fail "密码最大有效期: ${PASS_MAX_DAYS}天 (>90天，建议≤90天)" fi PASS_MIN_LEN=$(grep "^PASS_MIN_LEN" /etc/login.defs | awk '{print $2}') if [ "$PASS_MIN_LEN" -ge 8 ] 2>/dev/null; then check_pass "密码最小长度: ${PASS_MIN_LEN}位 (≥8位)" else check_fail "密码最小长度: ${PASS_MIN_LEN}位 (<8位，建议≥8位)" fi else check_warn "未找到/etc/login.defs文件" fi echo "" # 2. 用户权限检查 echo "【2. 用户权限检查】" ROOT_UID_USERS=$(awk -F: '$3==0 {print $1}' /etc/passwd) ROOT_COUNT=$(echo "$ROOT_UID_USERS" | wc -l) if [ "$ROOT_COUNT" -eq 1 ]; then check_pass "UID=0的用户只有root" else check_fail "发现多个UID=0的用户: $ROOT_UID_USERS" fi # 检查空密码用户 EMPTY_PASS=$(awk -F: '($2=="") {print $1}' /etc/shadow 2>/dev/null) if [ -z "$EMPTY_PASS" ]; then check_pass "无空密码用户" else check_fail "发现空密码用户: $EMPTY_PASS" fi echo "" # 3. 服务端口检查 echo "【3. 监听端口检查】" LISTEN_PORTS=$(ss -tlnp 2>/dev/null | grep LISTEN | awk '{print $4}' | awk -F: '{print $NF}' | sort -n | uniq) echo " 当前监听端口: $(echo $LISTEN_PORTS | tr ' ' ' ')" DANGEROUS_PORTS="23 21 512 513 514" for port in $DANGEROUS_PORTS; do if echo "$LISTEN_PORTS" | grep -q "^$port$"; then check_fail "危险端口 $port 处于监听状态" fi done check_pass "已完成端口安全检查" echo "" # 4. SSH配置检查 echo "【4. SSH安全配置检查】" if [ -f /etc/ssh/sshd_config ]; then PERMIT_ROOT_LOGIN=$(grep -i "^PermitRootLogin" /etc/ssh/sshd_config | awk '{print $2}') if [ "$PERMIT_ROOT_LOGIN" = "no" ]; then check_pass "禁止root远程登录" else check_warn "root远程登录设置: $PERMIT_ROOT_LOGIN (建议设置为no)" fi PASSWORD_AUTH=$(grep -i "^PasswordAuthentication" /etc/ssh/sshd_config | awk '{print $2}') if [ "$PASSWORD_AUTH" = "no" ]; then check_pass "禁止密码登录（仅密钥登录）" else check_warn "密码登录已启用 (高安全环境建议禁用，仅用密钥)" fi else check_warn "未找到sshd_config文件" fi echo "" # 5. 文件权限检查 echo "【5. 关键文件权限检查】" CRITICAL_FILES="/etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/sudoers" for file in $CRITICAL_FILES; do if [ -f "$file" ]; then PERMS=$(stat -c "%a" "$file" 2>/dev/null) case "$file" in /etc/shadow|/etc/gshadow) if [ "$PERMS" -le 640 ] 2>/dev/null; then check_pass "$file 权限: $PERMS" else check_fail "$file 权限: $PERMS (建议≤640)" fi ;; *) if [ "$PERMS" -le 644 ] 2>/dev/null; then check_pass "$file 权限: $PERMS" else check_fail "$file 权限: $PERMS (建议≤644)" fi ;; esac fi done echo "" # 6. 防火墙检查 echo "【6. 防火墙状态检查】" if systemctl is-active --quiet firewalld 2>/dev/null; then check_pass "firewalld防火墙已启用" elif systemctl is-active --quiet iptables 2>/dev/null; then check_pass "iptables防火墙已启用" elif command -v ufw &>/dev/null && ufw status | grep -q "active"; then check_pass "ufw防火墙已启用" else check_warn "未检测到运行中的防火墙" fi echo "" # 汇总 echo "========== 检查汇总 ==========" echo " ✅ 通过: $PASS" echo " ❌ 失败: $FAIL" echo " ⚠️ 警告: $WARN" echo "" if [ "$FAIL" -gt 0 ]; then echo "🔴 存在 $FAIL 项安全风险，请及时修复" else echo "🟢 未发现严重安全风险" fi echo "========== 检查完成 =========="

[]