104 lines
5.0 KiB
Bash
104 lines
5.0 KiB
Bash
#!/bin/bash
|
||
# 服务器安全体检（只读，不做任何修改）
|
||
echo "################ 1. 账号与提权 ################"
|
||
echo "--- UID 0 账号（应只有 root）---"
|
||
awk -F: '$3==0{print " " $1}' /etc/passwd
|
||
echo "--- 可登录 shell 的账号 ---"
|
||
grep -E "/(bash|sh|zsh)$" /etc/passwd | awk -F: '{print " " $1 " (uid=" $3 ")"}'
|
||
echo "--- 空密码账号（应为空）---"
|
||
awk -F: '($2==""){print " !! " $1}' /etc/shadow 2>/dev/null || echo " (无法读取)"
|
||
echo "--- /home 目录（按修改时间）---"
|
||
ls -lt /home/ 2>/dev/null | head -6
|
||
echo "--- sudoers 非默认条目 ---"
|
||
grep -rhE "^[[:space:]]*[^#[:space:]]" /etc/sudoers /etc/sudoers.d/ 2>/dev/null | grep -vE "^Defaults|^root[[:space:]]|^%wheel|^#|^$" | sed 's/^/ /' || echo " (仅默认)"
|
||
|
||
echo
|
||
echo "################ 2. 全部 SSH 授权公钥 ################"
|
||
find / -xdev -name authorized_keys -path "*ssh*" 2>/dev/null | while read f; do
|
||
echo "--- $f ---"
|
||
awk 'NF>=3{print " " $3 " [" substr($1,1,20) "...]"}' "$f"
|
||
done
|
||
|
||
echo
|
||
echo "################ 3. sshd 生效配置 ################"
|
||
sshd -T 2>/dev/null | grep -iE "^port |^permitrootlogin|^passwordauthentication|^pubkeyauthentication|^authorizedkeysfile|^permitemptypasswords|^allowusers|^x11forwarding" | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "################ 4. 最近登录记录 ################"
|
||
echo "--- 成功登录（最近）---"
|
||
last -n 12 2>/dev/null | head -14 | sed 's/^/ /'
|
||
echo "--- 失败登录尝试（最近，需 root）---"
|
||
lastb -n 8 2>/dev/null | head -10 | sed 's/^/ /' || echo " (无 btmp 记录)"
|
||
|
||
echo
|
||
echo "################ 5. 定时任务持久化 ################"
|
||
for u in root xxcool; do
|
||
echo "--- crontab[$u] ---"
|
||
crontab -u $u -l 2>/dev/null | grep -vE "^#|^$" | sed 's/^/ /' || echo " (空)"
|
||
done
|
||
echo "--- /var/spool/cron 下的用户 ---"; ls /var/spool/cron/ 2>/dev/null | sed 's/^/ /'
|
||
echo "--- /etc/cron.d 文件 ---"; ls /etc/cron.d/ 2>/dev/null | sed 's/^/ /'
|
||
echo "--- 周期目录内容 ---"; ls /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly 2>/dev/null | grep -v ":" | sed 's/^/ /'
|
||
echo "--- systemd timers ---"; systemctl list-timers --all --no-pager 2>/dev/null | head -6 | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "################ 6. 劫持/预加载类后门 ################"
|
||
echo "--- /etc/ld.so.preload ---"
|
||
[ -s /etc/ld.so.preload ] && cat /etc/ld.so.preload | sed 's/^/ !! /' || echo " (空/不存在 = 正常)"
|
||
echo "--- /etc/rc.local ---"
|
||
[ -s /etc/rc.local ] && grep -vE "^#|^$" /etc/rc.local | sed 's/^/ /' || echo " (空 = 正常)"
|
||
echo "--- shell 配置中的下载/反弹特征（curl|wget|/dev/tcp|base64|bash -i）---"
|
||
HITS=$(grep -rnE "curl[^|]*(sh|base64)|wget[^|]*\.sh|/dev/tcp/|bash -i" /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /etc/profile.d/ /etc/profile /etc/bashrc 2>/dev/null | grep -vE "server-monitor")
|
||
[ -n "$HITS" ] && echo "$HITS" | sed 's/^/ !! /' || echo " (无明显特征)"
|
||
echo "--- /etc/hosts（DNS 劫持检查）---"
|
||
grep -vE "^#|^$" /etc/hosts | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "################ 7. 进程 TOP（CPU） ################"
|
||
ps aux --sort=-%cpu | head -10 | awk '{printf " %-8s %5s%% %5s%% %s\n", $1, $3, $4, $11" "$12}' | head -10
|
||
|
||
echo
|
||
echo "################ 8. 监听端口（对外） ################"
|
||
ss -tulnp 2>/dev/null | awk 'NR==1{print " "$0} $1=="tcp"||$1=="udp"{print " "$0}' | head -22
|
||
|
||
echo
|
||
echo "################ 9. 对外连接（ESTABLISHED） ################"
|
||
ss -tnp state established 2>/dev/null | head -15 | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "################ 10. 临时目录可疑文件 ################"
|
||
find /tmp /var/tmp /dev/shm -maxdepth 2 -type f 2>/dev/null | head -12 | sed 's/^/ /'
|
||
echo " (以上应仅为正常的临时文件)"
|
||
|
||
echo
|
||
echo "################ 11. 系统关键目录近期改动的文件（近 30 天） ################"
|
||
find /usr/bin /usr/sbin /bin /sbin /etc/init.d /etc/systemd/system -newermt "-30 days" -type f 2>/dev/null | head -18 | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "################ 12. SUID 文件（非标准位置需警惕） ################"
|
||
find /tmp /var/tmp /dev/shm /home -perm -4000 -type f 2>/dev/null | head -8 | sed 's/^/ !! /'
|
||
echo " (以上为空 = 正常)"
|
||
|
||
echo
|
||
echo "################ 13. Docker 容器 ################"
|
||
docker ps -a --format " {{.Names}} | {{.Image}} | {{.Status}}" 2>/dev/null
|
||
echo "--- 特权/危险配置容器 ---"
|
||
for c in $(docker ps -q 2>/dev/null); do
|
||
docker inspect -f ' {{.Name}} privileged={{.HostConfig.Privileged}} netmode={{.HostConfig.NetworkMode}} pid={{.HostConfig.PidMode}}' "$c" 2>/dev/null
|
||
done
|
||
echo "--- 本地镜像列表 ---"
|
||
docker images --format " {{.Repository}}:{{.Tag}}" 2>/dev/null | head -14
|
||
|
||
echo
|
||
echo "################ 14. 内核模块 ################"
|
||
lsmod 2>/dev/null | awk 'NR>1{print " "$1}' | head -20
|
||
|
||
echo
|
||
echo "################ 15. 云安全 agent 状态 ################"
|
||
for s in yunjing barad_agent sgagent tat_agent; do
|
||
st=$(systemctl is-active $s 2>/dev/null)
|
||
echo " $s: ${st:-未安装/未知}"
|
||
done
|
||
echo
|
||
echo "################ 体检结束 ################"
|