安全检查脚本#

#!/bin/bash

# 安全检查脚本
# 功能：检查系统安全状态
# 作者：System Admin
# 日期：2026-01-01

set -euo pipefail

# 配置变量
LOG_FILE="/var/log/security_check.log"
REPORT_FILE="/tmp/security_check_report.txt"
ALERT_EMAIL="admin@example.com"

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# 日志函数
log() {
    local level=$1
    shift
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] [$level] $@" | tee -a "$LOG_FILE"
}

log_info() {
    log "INFO" "$@"
}

log_error() {
    log "ERROR" "$@"
}

log_warning() {
    log "WARNING" "$@"
}

# 检查用户安全
check_user_security() {
    log_info "检查用户安全"
    
    echo "用户安全检查"
    echo "=========="
    
    # 检查空密码用户
    local empty_password=$(awk -F: '($2 == "") {print $1}' /etc/shadow)
    if [ -n "$empty_password" ]; then
        log_error "发现空密码用户: $empty_password"
        echo "空密码用户: $empty_password"
    else
        log_info "没有空密码用户"
        echo "空密码用户: 无"
    fi
    
    # 检查UID为0的用户
    local root_users=$(awk -F: '($3 == 0) {print $1}' /etc/passwd)
    if [ -n "$root_users" ]; then
        log_warning "UID为0的用户: $root_users"
        echo "UID为0的用户: $root_users"
    else
        log_info "没有UID为0的用户"
        echo "UID为0的用户: 无"
    fi
    
    # 检查sudo用户
    local sudo_users=$(grep -v "^#" /etc/sudoers | grep -v "^$" | awk '{print $1}' | sort -u)
    echo "sudo用户: $sudo_users"
    
    # 检查最近登录的用户
    echo ""
    echo "最近登录的用户:"
    last -n 10 | head -10
}

# 检查文件权限
check_file_permissions() {
    log_info "检查文件权限"
    
    echo ""
    echo "文件权限检查"
    echo "=========="
    
    # 检查全局可写文件
    echo "全局可写文件:"
    find / -type f -perm -0002 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null | head -20
    
    # 检查SUID文件
    echo ""
    echo "SUID文件:"
    find / -type f -perm -4000 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null
    
    # 检查SGID文件
    echo ""
    echo "SGID文件:"
    find / -type f -perm -2000 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null
    
    # 检查重要文件权限
    echo ""
    echo "重要文件权限:"
    ls -l /etc/passwd /etc/shadow /etc/group /etc/sudoers
}

# 检查服务安全
check_service_security() {
    log_info "检查服务安全"
    
    echo ""
    echo "服务安全检查"
    echo "=========="
    
    # 检查运行中的服务
    echo "运行中的服务:"
    systemctl list-units --type=service --state=running | grep -v "systemd"
    
    # 检查开放端口
    echo ""
    echo "开放端口:"
    netstat -tuln | grep LISTEN
    
    # 检查SSH配置
    echo ""
    echo "SSH配置:"
    if [ -f "/etc/ssh/sshd_config" ]; then
        grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config
    fi
    
    # 检查防火墙状态
    echo ""
    echo "防火墙状态:"
    if command -v ufw &> /dev/null; then
        ufw status
    elif command -v firewall-cmd &> /dev/null; then
        firewall-cmd --state
    fi
}

# 检查网络安全
check_network_security() {
    log_info "检查网络安全"
    
    echo ""
    echo "网络安全检查"
    echo "=========="
    
    # 检查网络连接
    echo "活动网络连接:"
    netstat -an | grep ESTABLISHED | head -20
    
    # 检查监听端口
    echo ""
    echo "监听端口:"
    netstat -tuln | grep LISTEN
    
    # 检查网络接口
    echo ""
    echo "网络接口:"
    ip addr show
    
    # 检查路由表
    echo ""
    echo "路由表:"
    ip route show
}

# 检查系统更新
check_system_updates() {
    log_info "检查系统更新"
    
    echo ""
    echo "系统更新检查"
    echo "=========="
    
    # 检查可用更新
    if command -v apt-get &> /dev/null; then
        echo "可用更新:"
        apt list --upgradable 2>/dev/null | head -20
    elif command -v yum &> /dev/null; then
        echo "可用更新:"
        yum check-update 2>/dev/null | head -20
    fi
    
    # 检查内核版本
    echo ""
    echo "内核版本: $(uname -r)"
    
    # 检查系统版本
    echo "系统版本: $(cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d '\"')"
}

# 检查日志安全
check_log_security() {
    log_info "检查日志安全"
    
    echo ""
    echo "日志安全检查"
    echo "=========="
    
    # 检查认证日志
    echo "最近的认证失败:"
    grep "Failed password" /var/log/auth.log 2>/dev/null | tail -10 || \
    grep "Failed password" /var/log/secure 2>/dev/null | tail -10
    
    # 检查sudo日志
    echo ""
    echo "最近的sudo使用:"
    grep sudo /var/log/auth.log 2>/dev/null | tail -10 || \
    grep sudo /var/log/secure 2>/dev/null | tail -10
    
    # 检查系统日志错误
    echo ""
    echo "最近的系统错误:"
    journalctl -p err -n 10 --no-pager
}

# 检查进程安全
check_process_security() {
    log_info "检查进程安全"
    
    echo ""
    echo "进程安全检查"
    echo "=========="
    
    # 检查可疑进程
    echo "可疑进程:"
    ps aux | grep -E "(nc|netcat|telnet|ftp)" | grep -v grep
    
    # 检查网络连接的进程
    echo ""
    echo "网络连接的进程:"
    netstat -tulnp | grep LISTEN
    
    # 检查僵尸进程
    echo ""
    echo "僵尸进程:"
    ps aux | awk '{print $8}' | grep -c Z || echo "0"
    
    # 检查高CPU使用进程
    echo ""
    echo "高CPU使用进程:"
    ps aux --sort=-%cpu | head -10
}

# 检查磁盘安全
check_disk_security() {
    log_info "检查磁盘安全"
    
    echo ""
    echo "磁盘安全检查"
    echo "=========="
    
    # 检查磁盘使用
    echo "磁盘使用:"
    df -h
    
    # 检查inode使用
    echo ""
    echo "inode使用:"
    df -i
    
    # 检查大文件
    echo ""
    echo "大文件:"
    find / -type f -size +100M 2>/dev/null | head -20
}

# 检查密码策略
check_password_policy() {
    log_info "检查密码策略"
    
    echo ""
    echo "密码策略检查"
    echo "=========="
    
    # 检查密码复杂度
    if [ -f "/etc/pam.d/common-password" ]; then
        echo "密码复杂度配置:"
        grep "pam_pwquality.so" /etc/pam.d/common-password || \
        grep "pam_cracklib.so" /etc/pam.d/common-password
    fi
    
    # 检查密码过期策略
    echo ""
    echo "密码过期策略:"
    grep -E "PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE" /etc/login.defs
    
    # 检查账户锁定策略
    echo ""
    echo "账户锁定策略:"
    grep -E "FAILLOG_ENAB|FAIL_DELAY" /etc/login.defs
}

# 检查SSH安全
check_ssh_security() {
    log_info "检查SSH安全"
    
    echo ""
    echo "SSH安全检查"
    echo "=========="
    
    if [ ! -f "/etc/ssh/sshd_config" ]; then
        echo "SSH配置文件不存在"
        return
    fi
    
    # 检查SSH配置
    echo "SSH配置:"
    grep -E "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|Port|Protocol|X11Forwarding)" /etc/ssh/sshd_config
    
    # 检查SSH密钥
    echo ""
    echo "SSH密钥:"
    ls -la ~/.ssh/ 2>/dev/null || echo "没有SSH密钥"
    
    # 检查SSH登录历史
    echo ""
    echo "SSH登录历史:"
    grep "sshd" /var/log/auth.log 2>/dev/null | tail -10 || \
    grep "sshd" /var/log/secure 2>/dev/null | tail -10
}

# 生成安全报告
generate_security_report() {
    log_info "生成安全报告"
    
    {
        echo "安全检查报告"
        echo "=========="
        echo "检查时间: $(date)"
        echo "主机名: $(hostname)"
        echo "操作系统: $(cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d '\"')"
        echo "内核版本: $(uname -r)"
        echo ""
        
        check_user_security
        check_file_permissions
        check_service_security
        check_network_security
        check_system_updates
        check_log_security
        check_process_security
        check_disk_security
        check_password_policy
        check_ssh_security
        
        echo ""
        echo "检查完成"
        echo "========"
        echo "报告生成时间: $(date)"
    } > "$REPORT_FILE"
    
    log_info "安全报告已生成: $REPORT_FILE"
}

# 发送安全告警
send_security_alert() {
    local message=$1
    
    log_error "发送安全告警: $message"
    
    # 发送邮件告警
    if command -v mail &> /dev/null; then
        echo "$message" | mail -s "安全告警" "$ALERT_EMAIL"
    fi
    
    # 记录到系统日志
    logger -p auth.warning "Security Alert: $message"
}

# 执行完整安全检查
run_full_security_check() {
    log_info "开始完整安全检查"
    
    local issues=0
    
    # 执行各项检查
    check_user_security
    check_file_permissions
    check_service_security
    check_network_security
    check_system_updates
    check_log_security
    check_process_security
    check_disk_security
    check_password_policy
    check_ssh_security
    
    # 生成报告
    generate_security_report
    
    # 检查是否有安全问题
    if grep -q "ERROR\|WARNING" "$REPORT_FILE"; then
        issues=$(grep -c "ERROR\|WARNING" "$REPORT_FILE")
        send_security_alert "发现 $issues 个安全问题"
        return 1
    fi
    
    log_info "安全检查完成，没有发现安全问题"
    return 0
}

# 显示帮助
show_help() {
    echo "用法: $0 [选项] [检查项]"
    echo ""
    echo "选项:"
    echo "  -r <文件>        报告文件（默认: /tmp/security_check_report.txt）"
    echo "  -e <邮箱>        告警邮箱"
    echo "  -h               显示帮助信息"
    echo ""
    echo "检查项:"
    echo "  all               执行完整检查（默认）"
    echo "  user              检查用户安全"
    echo "  file              检查文件权限"
    echo "  service           检查服务安全"
    echo "  network           检查网络安全"
    echo "  update            检查系统更新"
    echo "  log               检查日志安全"
    echo "  process           检查进程安全"
    echo "  disk              检查磁盘安全"
    echo "  password          检查密码策略"
    echo "  ssh               检查SSH安全"
    echo ""
    echo "示例:"
    echo "  $0"
    echo "  $0 all"
    echo "  $0 user"
    echo "  $0 service"
}

# 主函数
main() {
    # 解析选项
    while getopts "r:e:h" opt; do
        case $opt in
            r)
                REPORT_FILE="$OPTARG"
                log_info "报告文件: $REPORT_FILE"
                ;;
            e)
                ALERT_EMAIL="$OPTARG"
                log_info "告警邮箱: $ALERT_EMAIL"
                ;;
            h)
                show_help
                exit 0
                ;;
            *)
                log_error "无效选项: $opt"
                show_help
                exit 1
                ;;
        esac
    done
    
    shift $((OPTIND - 1))
    
    # 检查检查项
    local check_item=${1:-all}
    
    # 执行检查
    case $check_item in
        all)
            run_full_security_check
            ;;
        user)
            check_user_security
            ;;
        file)
            check_file_permissions
            ;;
        service)
            check_service_security
            ;;
        network)
            check_network_security
            ;;
        update)
            check_system_updates
            ;;
        log)
            check_log_security
            ;;
        process)
            check_process_security
            ;;
        disk)
            check_disk_security
            ;;
        password)
            check_password_policy
            ;;
        ssh)
            check_ssh_security
            ;;
        *)
            log_error "无效的检查项: $check_item"
            show_help
            exit 1
            ;;
    esac
}

# 执行主函数
main "$@"