2. #!/bin/bash
    3. echo "Linux安全检查与应急响应工具"
    4. echo "Version:1.3"
    5. echo "Author:Daily"
    6. echo "Date:2020-11-11"
    8. dos2unix buying.sh
    9. date=$(date +%Y%m%d-%H%M%S)
    11. ipadd=$(ifconfig -a | grep -w inet | grep -v 127.0.0.1 | awk 'NR==1{print $2}')
    13. check_file="/tmp/buying_${ipadd}_${date}/check_file/"
    14. danger_file="/tmp/buying_${ipadd}_${date}/danger_file.txt"
    15. log_file="/tmp/buying_${ipadd}_${date}/log/"
    16. rm -rf $check_file
    17. rm -rf $danger_file
    18. rm -rf log_file
    19. mkdir /tmp/buying_${ipadd}_${date}/
    20. echo "检查发现危险项,请注意:" > ${danger_file}
    21. mkdir $check_file
    22. echo "" >> $danger_file
    23. mkdir $log_file
    24. cd $check_file
    26. if [ $(whoami) != "root" ];then
    27.     echo "安全检查必须使用root账号,否则某些项无法检查"
    28.     exit 1
    29. fi
    32. saveresult="tee -a checkresult.txt"
    33. echo "[0.1]正在检查IP地址....." && "$saveresult"  
    35. echo -------------0.IP及版本-------------------
    36. echo -------------0.1IP地址-------------------
    37. echo "[0.1]正在检查IP地址....." | $saveresult
    38. ip=$(ifconfig -a | grep -w inet | awk '{print $2}')
    39. if [ -n "$ip" ];then
    40.     (echo "[*]本机IP地址信息:" && echo "$ip")  | $saveresult
    41. else
    42.     echo "[!!!]本机未配置IP地址" | $saveresult
    43. fi
    44. printf "\n" | $saveresult
    48. echo ------------12历史命令--------------------------
    49. echo ------------12.1系统操作历史命令---------------
    50. echo ------------12.1.1系统操作历史命令---------------
    51. echo "[12.1.1]正在检查操作系统历史命令....." | $saveresult
    52. history=$(more /root/.bash_history)
    53. if [ -n "$history" ];then
    54.     (echo "[*]操作系统历史命令如下:" && echo "$history") | $saveresult
    55. else
    56.     echo "[!!!]未发现历史命令,请检查是否记录及已被清除" | $saveresult
    57. fi
    58. printf "\n" | $saveresult
    61. echo ------------2.网络连接---------------------
    62. echo "[2.1]正在检查网络连接情况....." | $saveresult
    63. netstat=$(netstat -anlp | grep ESTABLISHED)
    64. netstatnum=$(netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}')
    65. if [ -n "$netstat" ];then
    66.     (echo "[*]网络连接情况:" && echo "$netstat") | $saveresult
    67.     if [ -n "$netstatnum" ];then
    68.         (echo "[*]各个状态的数量如下:" && echo "$netstatnum") | $saveresult
    69.     fi
    70. else
    71.     echo "[*]未发现网络连接" | $saveresult
    72. fi
    73. printf "\n" | $saveresult
    76. echo ------------20.2CPU分析-----------------
    77. echo ------------20.2.1CPU情况-----------------
    78. echo "[20.2.1]正在检查CPU相关信息....." | $saveresult
    79. (echo "CPU硬件信息如下:" && more /proc/cpuinfo ) | $saveresult
    80. (echo "CPU使用情况如下:" && ps -aux | sort -nr -k 3 | awk  '{print $1,$2,$3,$NF}') | $saveresult
    81. printf "\n" | $saveresult
    82. echo ------------20.2.2占用CPU前5进程-----------------
    83. echo "[20.2.2]正在检查占用CPU前5资源的进程....." | $saveresult
    84. (echo "占用CPU资源前5进程：" && ps -aux | sort -nr -k 3 | head -5)  | $saveresult
    85. printf "\n" | $saveresult
    86. echo ------------20.2.3占用CPU较大进程-----------------
    87. echo "[20.2.3]正在检查占用CPU较大的进程....." | $saveresult
    88. pscpu=$(ps -aux | sort -nr -k 3 | head -5 | awk '{if($3>=20) print $0}')
    89. if [ -n "$pscpu" ];then
    90.     echo "[!!!]以下进程占用的CPU超过20%:" && echo "UID         PID   PPID  C STIME TTY          TIME CMD" 
    91.     echo "$pscpu" | tee -a 20.2.3_pscpu.txt | tee -a $danger_file | $saveresult
    92. else
    93.     echo "[*]未发现进程占用资源超过20%" | $saveresult
    94. fi
    95. printf "\n" | $saveresult
    98. echo ------------7.进程分析--------------------
    99. echo ------------7.1系统进程--------------------
    100. echo "[7.1]正在检查进程....." | $saveresult
    101. ps=$(ps -aux)
    102. if [ -n "$ps" ];then
    103.     (echo "[*]系统进程如下:" && echo "$ps") | $saveresult
    104. else
    105.     echo "[*]未发现系统进程" | $saveresult
    106. fi
    107. printf "\n" | $saveresult
    109. echo "[7.2]正在检查守护进程....." | $saveresult
    110. if [ -e /etc/xinetd.d/rsync ];then
    111.     (echo "[*]系统守护进程:" && more /etc/xinetd.d/rsync | grep -v "^#") | $saveresult
    112. else
    113.     echo "[*]未发现守护进程" | $saveresult
    114. fi
    115. printf "\n" | $saveresult
    118. echo ------------9.运行服务----------------------
    119. echo "[9.1]正在检查运行服务....." | $saveresult
    120. services=$(systemctl | grep -E "\.service.*running" | awk -F. '{print $1}')
    121. if [ -n "$services" ];then
    122.     (echo "[*]以下服务正在运行：" && echo "$services") | $saveresult
    123. else
    124.     echo "[!!!]未发现正在运行的服务！" | $saveresult
    125. fi
    126. printf "\n" | $saveresult
    129. echo -------------4.启动项-----------------------
    130. echo -------------4.1 用户自定义启动项-----------------------
    131. echo "[4.1]正在检查用户自定义启动项....." | $saveresult
    132. chkconfig=$(chkconfig --list | grep -E ":on|启用" | awk '{print $1}')
    133. if [ -n "$chkconfig" ];then
    134.     (echo "[*]用户自定义启动项:" && echo "$chkconfig") | $saveresult
    135. else
    136.     echo "[!!!]未发现用户自定义启动项" | $saveresult
    137. fi
    138. printf "\n" | $saveresult
    140. echo -------------4.2 系统自启动项-----------------------
    141. echo "[4.2]正在检查系统自启动项....." | $saveresult
    142. systemchkconfig=$(systemctl list-unit-files | grep enabled | awk '{print $1}')
    143. if [ -n "$systemchkconfig" ];then
    144.     (echo "[*]系统自启动项如下:" && echo "$systemchkconfig")  | $saveresult
    145. else
    146.     echo "[*]未发现系统自启动项" | $saveresult
    147. fi
    148. printf "\n" | $saveresult
    150. echo -------------4.3 危险启动项-----------------------
    151. echo "[4.3]正在检查危险启动项....." | $saveresult
    152. dangerstarup=$(chkconfig --list | grep -E ":on|启用" | awk '{print $1}' | grep -E "\.(sh|per|py)$")
    153. if [ -n "$dangerstarup" ];then
    154.     (echo "[!!!]发现危险启动项:" && echo "$dangerstarup") | tee -a $danger_file | $saveresult
    155. else
    156.     echo "[*]未发现危险启动项" | $saveresult
    157. fi
    158. printf "\n" | $saveresult
    160. echo ------------5.查看定时任务-------------------
    161. echo ------------5.1系统定时任务分析-------------------
    162. echo ------------5.1.1查看系统定时任务-------------------
    163. echo "[5.1.1]正在分析系统定时任务....." | $saveresult
    164. syscrontab=$(more /etc/crontab | grep -v "# run-parts" | grep run-parts)
    165. if [ -n "$syscrontab" ];then
    166.     (echo "[!!!]发现存在系统定时任务:" && more /etc/crontab ) | tee -a $danger_file | $saveresult
    167. else
    168.     echo "[*]未发现系统定时任务" | $saveresult
    169. fi
    170. printf "\n" | $saveresult
    172. # if [ $? -eq 0 ]表示上面命令执行成功;执行成功输出的是0；失败非0
    173. #ifconfig  echo $? 返回0，表示执行成功
    174. # if [ $? != 0 ]表示上面命令执行失败
    176. echo ------------5.1.2分析系统可疑定时任务-------------------
    177. echo "[5.1.2]正在分析系统可疑任务....." | $saveresult
    178. dangersyscron=$(egrep "((chmod|useradd|groupadd|chattr)|((wget|curl)*\.(sh|pl|py)$))"  /etc/cron*/* /var/spool/cron/*)
    179. if [ $? -eq 0 ];then
    180.     (echo "[!!!]发现下面的定时任务可疑,请注意！！！" && echo "$dangersyscron") | tee -a $danger_file | $saveresult
    181. else
    182.     echo "[*]未发现可疑系统定时任务" | $saveresult
    183. fi
    184. printf "\n" | $saveresult
    186. echo ------------5.2分析用户定时任务-------------------
    187. echo ------------5.2.1查看用户定时任务-------------------
    188. echo "[5.2.1]正在查看用户定时任务....." | $saveresult
    189. crontab=$(crontab -l)
    190. if [ $? -eq 0 ];then
    191.     (echo "[!!!]发现用户定时任务如下:" && echo "$crontab") | $saveresult
    192. else
    193.     echo "[*]未发现用户定时任务"  | $saveresult
    194. fi
    195. printf "\n" | $saveresult
    197. echo ------------5.2.2查看可疑用户定时任务-------------------
    198. echo "[5.2.2]正在分析可疑用户定时任务....." | $saveresult
    199. danger_crontab=$(crontab -l | egrep "((chmod|useradd|groupadd|chattr)|((wget|curl).*\.(sh|pl|py)))")
    200. if [ $? -eq 0 ];then
    201.     (echo "[!!!]发现可疑定时任务,请注意！！！" && echo "$danger_crontab") | tee -a $danger_file | $saveresult
    202. else
    203.     echo "[*]未发现可疑定时任务" | $saveresult
    204. fi
    205. printf "\n" | $saveresult
    210. echo ------------6 最近24小时内变动的文件---------------------
    211. #查看最近24小时内有改变的文件
    212. (find / -mtime 0 | grep -E "\.(py|sh|per|pl|php|asp|jsp)$") | tee -a $danger_file | $saveresult
    213. printf "\n" | $saveresult
    216. echo ------------7 日志分析------------------------------
    217. echo ------------7.1 查看日志配置与打包-------------------
    218. echo ------------7.1.1 查看日志配置----------------------
    219. echo "[7.1.1]正在查看日志配置....." | $saveresult
    220. logconf=$(more /etc/rsyslog.conf | egrep -v "#|^$")
    221. if [ -n "$logconf" ];then
    222.     (echo "[*]日志配置如下:" && echo "$logconf") | $saveresult
    223. else
    224.     echo "[!!!]未发现日志配置文件" | tee -a $danger_file | $saveresult
    225. fi
    226. printf "\n" | $saveresult
    227. echo ------------7.1.2日志是否存在---------------
    228. echo "[7.1.2]正在分析日志文件是否存在....." | $saveresult
    229. logs=$(ls -l /var/log/)
    230. if [ -n "$logs" ];then
    231.     echo "[*]日志文件存在" | $saveresult
    232. else
    233.     echo "[!!!]日志文件不存在,请分析是否被清除！" | tee -a $danger_file | $saveresult
    234. fi
    235. printf "\n" | $saveresult
    236. echo ------------7.1.3 日志审核是否开启---------------
    237. echo "[7.1.3]正在分析日志审核是否开启....." | $saveresult
    238. service auditd status | grep running
    239. if [ $? -eq 0 ];then
    240.     echo "[*]系统日志审核功能已开启,符合要求" | $saveresult
    241. else
    242.     echo "[!!!]系统日志审核功能已关闭,不符合要求,建议开启日志审核。可使用以下命令开启:service auditd start" | tee -a $danger_file | $saveresult
    243. fi
    244. printf "\n" | $saveresult
    245. echo ------------7.1.4 打包日志---------------
    246. echo "[7.1.4]正在打包日志......" | $saveresult
    247. zip -r ${log_file}system_log.zip /var/log/
    248. if [ $? -eq 0 ];then
    249.     echo "[*]日志打包成功" | $saveresult
    250. else
    251.     echo "[!!!]日志打包失败,请工人导出日志" | tee -a $danger_file | $saveresult
    252. fi
    253. printf "\n" | $saveresult
    256. echo ------------7.3message日志分析---------------
    257. echo ------------7.3.1传输文件--------------------
    258. #下面命令仅显示传输的文件名,并会将相同文件名的去重
    259. #more /var/log/message* | grep "ZMODEM:.*BPS" | awk -F '[]/]' '{print $0}' | sort | uniq
    260. echo "[7.3.1]正在检查传输文件....." | $saveresult
    261. zmodem=$(more /var/log/message* | grep "ZMODEM:.*BPS")
    262. if [ -n "$zmodem" ];then
    263.     (echo "[!!!]传输文件情况:" && echo "$zmodem") | tee -a $danger_file | $saveresult
    264. else
    265.     echo "[*]日志中未发现传输文件" | $saveresult
    266. fi
    267. printf "\n" | $saveresult
    270. echo ------------7.4cron日志分析---------------
    271. echo ------------7.4.1定时下载-----------------
    272. echo "[7.4.1]正在分析定时下载....." | $saveresult
    273. cron_download=$(more /var/log/cron* | grep "wget|curl")
    274. if [ -n "$cron_download" ];then
    275.     (echo "[!!!]定时下载情况:" && echo "$cron_download") | tee -a $danger_file | $saveresult
    276. else
    277.     echo "[*]未发现定时下载情况" | $saveresult
    278. fi
    279. printf "\n" | $saveresult
    281. echo ------------7.4.2定时执行脚本-----------------
    282. echo "[7.4.2]正在分析定时执行脚本....." | $saveresult
    283. cron_shell=$(more /var/log/cron* | grep -E "\.py$|\.sh$|\.pl$") 
    284. if [ -n "$cron_shell" ];then
    285.     (echo "[!!!]发现定时执行脚本:" && echo "$cron_download") | tee -a $danger_file | $saveresult
    286. else
    287.     echo "[*]未发现定时下载脚本" | $saveresult
    288. fi
    289. printf "\n" | $saveresult
    292. echo ------------8sshd配置文件--------------------
    293. echo ------------8.1sshd配置----------------------
    294. echo "[13.5.1]正在检查sshd配置....." | $saveresult
    295. sshdconfig=$(more /etc/ssh/sshd_config | egrep -v "#|^$")
    296. if [ -n "$sshdconfig" ];then
    297.     (echo "[*]sshd配置文件如下:" && echo "$sshdconfig") | $saveresult
    298. else
    299.     echo "[！]未发现sshd配置文件" | $saveresult
    300. fi
    301. printf "\n" | $saveresult