File: //usr/local/edr/var/baseline/template_1.sh
#!/bin/bash
if [ -z $1 ];
then
exit
fi
REPAIR=$2
RESULT=5625
SYSTEM_VERSION=`cat /etc/redhat-release | sed -r 's/.* ([0-9]+)\..*/\1/'`
WHICHSYSTEM=
if [ -f /etc/os-release ]
then
WHICHSYSTEM=`cat /etc/os-release | grep "PRETTY_NAME" | awk '{print $1}' | awk -F '="' '{print $2}'`
elif [ -f /etc/redhat-release ]
then
WHICHSYSTEM=`cat /etc/redhat-release | awk '{print $1}'`
fi
FTPCONF_PATH=
SYS_BANNER_PATH=
if [ "$WHICHSYSTEM" == "SUSE" ] || [ "$WHICHSYSTEM" == "Ubuntu" ] || [ "$WHICHSYSTEM" == "Debian" ];
then
FTPCONF_PATH=/etc/
SYS_BANNER_PATH=/etc/
elif [ "$WHICHSYSTEM" == "CentOS" ] || [ "$WHICHSYSTEM" == "Fedora" ] || [ "$WHICHSYSTEM" == "openSUSE" ]
then
FTPCONF_PATH=/etc/vsftpd/
SYS_BANNER_PATH=/etc/rc.d/
fi
Item_Account=1001
Item_UserPermission=1002
Item_AccessPermission=1003
Item_FTPPerimission=1004
Item_RemoteAccount=1005
Item_RemoteProtocol=1006
Item_Patch=1007
Item_LogAudit=1008
Item_LogPerimission=1009
Item_LogRecord=1010
Item_LogUpload=1011
Item_SysService=1012
Item_SysBanner=1013
Item_LogOnTimeOut=1014
Item_DangerFile=1015
Item_FTPAdministrator=1016
Item_FTPAnonymity=1017
Item_FTPBanner=1018
Item_PasswdLiveTime=1019
Item_PasswdComplexity=1020
YES=1
TIME_NOW=$(date "+%Y%m%d")
echo "***********************************************"
echo "*****" $TIME_NOW "begin baseline template 1 *****"
echo "***********************************************"
while read line
do
ItemID=$( echo $line | awk '{print $1}' )
ItemRun=$( echo $line | awk '{print $2}' )
if [ $ItemRun -eq $YES ];
then
if [ $ItemID -eq $Item_Account ];
then
echo -n "检查账户安全......"
Condition1=`cat /etc/pam.d/su | grep required | grep /lib/security/pam_wheel.so | grep -v "#" | awk '{print $1}'`
Condition2=`cat /etc/pam.d/su | grep /lib/security/pam_wheel.so | grep -v "#" | awk '{print $3}'`
Condition3=`cat /etc/pam.d/su | grep /lib/security/pam_rootok.so | grep -v "#" | awk '{print $1}'`
Condition4=`cat /etc/pam.d/su | grep /lib/security/pam_rootok.so | grep -v "#" | awk '{print $3}'`
Condition5=`cat /etc/login.defs | grep SU_WHEEL_ONLY | grep -v "#" | awk '{print $1}'`
Condition6=`cat /etc/login.defs | grep SU_WHEEL_ONLY | grep -v "#" | awk '{print $2}'`
if [[ "$Condition1" == "" || "$Condition1" != "auth" || "$Condition2" != "/lib/security/pam_wheel.so" || "$Condition3" == "" || "$Condition3" != "auth" || "$Condition4" != "/lib/security/pam_rootok.so" || "$Condition5" == "" || "$Condition6" != "yes" ]];
then
RESULT=5626
echo -n "未通过......"
Condition1=`cat /etc/pam.d/su | grep required | grep /lib/security/pam_wheel.so | grep -v "#" | awk '{print $1}'`
if [ "$Condition1" == "" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i '/lib\/security\/pam_wheel.so/d' /etc/pam.d/su
echo "auth required /lib/security/pam_wheel.so group=wheel" >> /etc/pam.d/su
echo "1001#1#1#已在/etc/pam.d/su文件中，添加wheel认证#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议在/etc/pam.d/su文件中，添加wheel认证#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ "$Condition1" != "auth" ];
then
if [ $REPAIR -eq $YES ];
then
sed -i "s/${Condition1}/auth/g" /etc/pam.d/su
echo "1001#1#1#已在/etc/pam.d/su文件中，恢复auth命令#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1001#1#0#建议在/etc/pam.d/文件中，恢复auth命令#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition2=`cat /etc/pam.d/su | grep /lib/security/pam_wheel.so | grep -v "#" | awk '{print $3}'`
if [ "$Condition2" != "/lib/security/pam_wheel.so" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i '/required/d' /etc/pam.d/su
echo "auth required /lib/security/pam_wheel.so group=wheel" >> /etc/pam.d/su
echo "1001#1#1#已恢复/etc/pam.d/su文件中，/lib/security/pam_wheel.so的指定路径#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议恢复/etc/pam.d/su文件中，/lib/security/pam_wheel.so的指定路径#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition3=`cat /etc/pam.d/su | grep /lib/security/pam_rootok.so | grep -v "#" | awk '{print $1}'`
if [ "$Condition3" == "" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i '/lib\/security\/pam_rootok.so/d' /etc/pam.d/su
echo "auth sufficient /lib/security/pam_rootok.so" >> /etc/pam.d/su
echo "1001#1#1#已在/etc/pam.d/su文件中，添加rootok认证#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议在/etc/pam.d/su文件中，添加rootok认证#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ "$Condition3" != "auth" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i "s/${Condition3}/auth/g" /etc/pam.d/su
echo "1001#1#1#已在/etc/pam.d/su文件中，恢复auth命令#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议在/etc/pam.d/su文件中，恢复auth命令#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition4=`cat /etc/pam.d/su | grep /lib/security/pam_rootok.so | grep -v "#" | awk '{print $3}'`
if [ "$Condition4" != "/lib/security/pam_rootok.so" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i '/pam_rootok/d' /etc/pam.d/su
echo "auth sufficient /lib/security/pam_rootok.so" >> /etc/pam.d/su
echo "1001#1#1#已恢复/etc/pam.d/su文件中，/lib/security/pam_wheel.so的指定路径#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议恢复/etc/pam.d/su文件中，/lib/security/pam_rootok.so的指定路径#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition5=`cat /etc/login.defs | grep SU_WHEEL_ONLY | grep -v "#" | awk '{print $1}'`
if [ "$Condition5" == "" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
sed -i '/SU_WHEEL_ONLY/d' /etc/login.defs
echo "SU_WHEEL_ONLY yes" >> /etc/login.defs
echo "1001#1#1#已在/etc/login.defs文件中，增加SU_WHEEL_ONLY为yes配置#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议在/etc/login.defs文件中，增加SU_WHEEL_ONLY为yes配置#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
Condition6=`cat /etc/login.defs | grep SU_WHEEL_ONLY | grep -v "#" | awk '{print $2}'`
if [ "$Condition6" != "yes" ];
then
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复$LINENO"
old=`cat /etc/login.defs | grep SU_WHEEL_ONLY | awk '{print $2}'`
sed -i "s/$old/yes/g" /etc/login.defs
echo "1001#1#1#已在/etc/login.defs文件中，配置SU_WHEEL_ONLY为yes#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1001#1#0#建议在/etc/login.defs文件中，配置SU_WHEEL_ONLY为yes#5802" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
fi
else
echo "1001#0#0#检查合规#5801" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_UserPermission ];
then
echo -n "检查关键文件权限......"
Condition1=`stat -c %a /etc/passwd`
Condition2=`stat -c %a /etc/shadow`
Condition3=`stat -c %a /etc/group`
if [[ $Condition1 != 644 || $Condition2 != 400 || $Condition3 != 644 ]];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
if [ $Condition1 != 644 ];
then
chmod 644 /etc/passwd
echo "1002#1#1#/etc/passwd文件权限{$Condition1}，存在违规风险，已恢复为644#5803" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ $Condition2 != 400 ];
then
chmod 400 /etc/shadow
echo "1002#1#1#/etc/shadow文件权限{$Condition2}，存在违规风险，已恢复为400#5803" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ $Condition3 != 644 ];
then
chmod 644 /etc/group
echo "1002#1#1#/etc/group文件权限{$Condition3}，存在违规风险，已恢复为644#5803" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "未开启自动修复"
if [ $Condition1 != 644 ];
then
echo "1002#1#0#/etc/passwd文件权限{$Condition1}，存在违规风险，建议恢复为644#5804" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ $Condition2 != 400 ];
then
echo "1002#1#0#/etc/shadow文件权限{$Condition2}，存在违规风险，建议恢复为400#5804" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ $Condition3 != 644 ];
then
echo "1002#1#0#/etc/group文件权限{$Condition3}，存在违规风险，建议恢复为644#5804" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
else
echo "1002#0#0#检查合规#5803" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_AccessPermission ];
then
echo -n "检查用户默认权限......"
Condition1=`cat /etc/login.defs | grep UMASK | grep -v "#" | awk '{print $2}'`
if [ "$Condition1" == "" ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/UMASK/d' /etc/login.defs
echo "UMASK 027" >> /etc/login.defs
echo "1003#1#1#/etc/login.defs文件中UMASK缺少配置或失效，存在违规风险，已在/etc/login.defs文件中，增加用户缺省权限UMASK为027配置#5805" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1003#1#0#/etc/login.defs文件中UMASK缺少配置或失效，存在违规风险，建议在/etc/login.defs文件中，增加用户缺省权限UMASK为027配置#5806" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ "$Condition1" != "027" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
egrep -q "^\s*(umask|UMASK)\s+\w+.*$" /etc/login.defs && sed -ri "s/^\s*(umask|UMASK)\s+\w+.*$/UMASK 027/" /etc/login.defs || echo "UMASK 027" >> /etc/login.defs
echo "1003#1#1#用户缺省权限为{$Condition1}，存在违规风险，已在/etc/login.defs文件中，修改用户缺省权限UMASK为027#5805" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1003#1#0#用户缺省权限为{$Condition1}，存在违规风险，建议在/etc/login.defs文件中，修改用户缺省权限UMASK为027#5806" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1003#0#0#检查合规#5805" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_FTPPerimission ];
then
echo -n "检查FTP缺省权限......"
Condition1=""$FTPCONF_PATH"chroot_list"
Condition2=`cat "$FTPCONF_PATH"vsftpd.conf | grep "chroot_local_user=" | grep -E 'no|NO' | grep -v "#"`
Condition3=`cat "$FTPCONF_PATH"vsftpd.conf | grep "chroot_list_enable=" | grep -E 'yes|YES' | grep -v "#"`
Condition4=`cat "$FTPCONF_PATH"vsftpd.conf | grep chroot_list_file="$FTPCONF_PATH"chroot_list | grep -v "#"`
if [ ! -f $Condition1 ] || [ -z "$Condition2" ] || [ -z "$Condition3" ] || [ -z "$Condition4" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
if [ ! -d "/etc/vsftpd/" ]
then
mkdir /etc/vsftpd/
fi
sed -ri "/chroot_local_user=/d" "$FTPCONF_PATH"vsftpd.conf
sed -ri "/chroot_list_enable=/d" "$FTPCONF_PATH"vsftpd.conf
sed -ri "/chroot_list_file=/d" "$FTPCONF_PATH"vsftpd.conf
echo "chroot_local_user=NO" >> "$FTPCONF_PATH"vsftpd.conf
echo "chroot_list_enable=YES" >> "$FTPCONF_PATH"vsftpd.conf
echo "chroot_list_file="$FTPCONF_PATH"chroot_list" >> "$FTPCONF_PATH"vsftpd.conf
touch "$FTPCONF_PATH"chroot_list
systemctl restart vsftpd.service
echo "1004#1#1#已在ftp服务配置文件路径$FTPCONF_PATH下恢复chroot_list文件与vsftpd.conf配置，请根据实际情况，将需要限制的用户名加入到chroot_list文件中#5807" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1004#1#0#默认配置文件"$FTPCONF_PATH"chroot_list不存在或"$FTPCONF_PATH"vsftpd.conf配置失效，建议开启自动加固修复相关配置，并根据实际情况，将需要限制的用户名加入到"$FTPCONF_PATH"chroot_list文件#5808" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1004#0#0#检查合规#5807" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_RemoteAccount ];
then
echo -n "检查远程登录帐号权限......"
Condition1=`cat /etc/ssh/sshd_config | grep -v "#" | grep -v "pass" | grep PermitRootLogin | awk '{print $1}'`
Condition2=`cat /etc/ssh/sshd_config | grep -v "#" | grep -v "pass" | grep PermitRootLogin | awk '{print $2}'`
if [[ "$Condition1" != "PermitRootLogin" || "$Condition2" != "no" || -z "$Condition1" || -z "$Condition2" ]];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/PermitRootLogin/d' /etc/ssh/sshd_config
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
service sshd restart
echo "1005#1#1#已在/etc/ssh/sshd_config文件中，修改PermitRootLogin配置为NO#5809" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1005#1#0#建议在/etc/ssh/sshd_config文件中，修改PermitRootLogin配置为NO#5810" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1005#0#0#检查合规#5809" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_RemoteProtocol ];
then
echo -n "检查远程登录协议类型......"
Condition1=`cat /etc/services | grep "#telnet"`
if [ -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
egrep -q "^\s*telnet\s+\d*.+$" /etc/services && sed -ri "/^\s*telnet\s+\d*.+$/s/^/#/" /etc/services
echo "1006#1#1#发现telnet服务或进程，存在违规风险，已关闭#5811" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1006#1#0#发现telnet服务或进程，存在违规风险，建议关闭#5812" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1006#0#0#检查合规#5811" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_Patch ];
then
echo -n "检查系统最新补丁包......"
Condition1=""
if [ -z "$Condition1" ];
then
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
echo "1007#1#2#存在违规风险，建议去对应Linux发行版官网查询可更新的内核版本#5813" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1007#1#0#存在违规风险，建议去对应Linux发行版官网查询可更新的内核版本#5813" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1007#0#0#检查合规#5813" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_LogAudit ];
then
echo -n "检查系统日志审计配置......"
if [ -f /etc/rsyslog.conf ];
then
Condition1=`cat /etc/rsyslog.conf | grep authpriv.* | grep -v info | grep -v "," | grep -v restricted | awk '{print $1}'`
if [ "$Condition1" != "authpriv.*" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/authpriv/d' /etc/rsyslog.conf
sed -i 's/#authpriv/authpriv/g' /etc/rsyslog.conf
echo "authpriv.* /var/log/secure" >> /etc/rsyslog.conf
echo "1008#1#1#authpriv不生效，已在/etc/rsyslog.conf文件中自动加固该配置#5815" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1008#1#0#authpriv不生效，建议在/etc/rsyslog.conf文件中添加该配置或开启自动加固，令其生效#5816" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ -z "$Condition1" ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
echo "authpriv.* /var/log/secure" >> /etc/rsyslog.conf
echo "1008#1#1#已在/etc/rsyslog.conf文件中，添加authpriv配置#5815" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1008#1#0#建议在/etc/rsyslog.conf文件中，添加authpriv.* /var/log/secure配置#5816" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1008#0#0#检查合规#5815" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1008#0#0#检查合规#5815" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_LogPerimission ];
then
echo -n "检查系统日志权限配置......"
MESSAGECONF=/var/log/messages
SECURECONF=/var/log/secure
MAILLOGCONF=/var/log/maillog
CRONCONF=/var/log/cron
SPOOLERCONF=/var/log/spooler
BOOTCONF=/var/log/boot.log
if [[ ! -f $MESSAGECONF && ! -f $SECURECONF && ! -f $MAILLOGCONF && ! -f $CRONCONF && ! -f $SPOOLERCONF && ! -f $BOOTCONF ]]
then
echo "1009#0#0#检查合规#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
continue
fi
IsViolation=0
Condition1=`stat -c %a $MESSAGECONF`
if [[ -f $MESSAGECONF && "$Condition1" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $MESSAGECONF
echo "1009#1#1#"$MESSAGECONF"文件权限{$Condition1}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$MESSAGECONF"文件权限{$Condition1}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition2=`stat -c %a $SECURECONF`
if [[ -f $SECURECONF && "$Condition2" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $SECURECONF
echo "1009#1#1#"$SECURECONF"文件权限{$Condition2}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$SECURECONF"文件权限{$Condition2}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition3=`stat -c %a $MAILLOGCONF`
if [[ -f $MAILLOGCONF && "$Condition3" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $MAILLOGCONF
echo "1009#1#1#"$MAILLOGCONF"文件权限{$Condition3}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$MAILLOGCONF"文件权限{$Condition3}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition4=`stat -c %a $CRONCONF`
if [[ -f $CRONCONF && "$Condition4" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $CRONCONF
echo "1009#1#1#"$CRONCONF"文件权限{$Condition4}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$CRONCONF"文件权限{$Condition4}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition5=`stat -c %a $SPOOLERCONF`
if [[ -f $SPOOLERCONF && "$Condition5" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $SPOOLERCONF
echo "1009#1#1#"$SPOOLERCONF"文件权限{$Condition5}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$SPOOLERCONF"文件权限{$Condition5}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
Condition6=`stat -c %a $BOOTCONF`
if [[ -f $BOOTCONF && "$Condition6" != "755" ]]
then
RESULT=5626
IsViolation=1
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
chmod 755 $BOOTCONF
echo "1009#1#1#"$BOOTCONF"文件权限{$Condition6}，存在违规风险，已恢复为755#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "1009#1#0#"$BOOTCONF"文件权限{$Condition6}，存在违规风险，建议恢复为755#5818" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
if [ $IsViolation -eq 0 ]
then
echo "1009#0#0#检查合规#5817" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_LogRecord ];
then
echo -n "检查系统日志记录配置......"
if [ -f /etc/rsyslog.conf ];
then
Condition1=`cat /etc/rsyslog.conf | grep "cron.*" | grep -v "stuff" | grep -v "info" | grep -v "," |
grep -v "#" | awk '{print $1}'`
if [ -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
echo "cron.* /var/log/cron " >> /etc/rsyslog.conf
echo "1010#1#1#未在/etc/rsyslog.conf文件中配置记录cron行为日志功能，存在违规风险，已添加修复#5819" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1010#1#0#未在/etc/rsyslog.conf文件中配置记录cron行为日志功能，存在违规风险，建议添加修复#5820" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
if [ "$Condition1" == "#cron.*" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i 's/#cro/cro/g' /etc/rsyslog.conf
echo "1010#1#1#/etc/rsyslog.conf文件中配置记录cron行为日志功能被注销，存在违规风险，已恢复#5819" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1010#1#0#/etc/rsyslog.conf文件中配置记录cron行为日志功能被注销，存在违规风险，建议恢复#5820" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1010#0#0#检查合规#5819" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
else
echo "1010#0#0#检查合规#5819" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_LogUpload ];
then
echo -n "检查系统日志上传......"
if [ ! -f /etc/rsyslog.conf ]
then
echo "1011#0#0#检查合规#5821" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
continue
fi
LOCAL_IP=`ip a | grep "fd" | sed 's+/.*++' | awk '{print $2}'`
if [ -z "$LOCAL_IP" ]
then
LOCAL_IP=$(echo $(ip a | grep $(route -n | grep ^0.0.0.0 | awk '{print$8}') | grep "inet " | awk '{print $2}' | sed 's+/.*++'))
fi
if [ -z "$LOCAL_IP" ]
then
LOCAL_IP=$(ip a | grep inet | sed 's+/.*++' | awk '{print $2}' | grep -v "127.0.0.1" | grep -v ":")
fi
Condition1=`cat /etc/rsyslog.conf | grep $LOCAL_IP`
if [ -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
echo "*.* @"$LOCAL_IP" " >> /etc/rsyslog.conf
echo "1011#1#1#/etc/rsyslog.conf文件中缺少远程日志传输功能配置项，存在违规风险，已添加本地IP地址到文件中#5821" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1011#1#0#/etc/rsyslog.conf文件中缺少远程日志传输功能配置项，存在违规风险，建议添加本地IP地址或域名到文件中，例如：*.*@192.168.0.1#5822" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
if [[ "$Condition1" = "#"* ]]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i "s/${Condition1}/*.* @"$LOCAL_IP"/g" /etc/rsyslog.conf
echo "1011#1#1#/etc/rsyslog.conf文件中远程日志传输功能配置项被注释，存在违规风险，已恢复#5821" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1011#1#0#/etc/rsyslog.conf文件中远程日志传输功能配置项被注释，存在违规风险，建议恢复#5822" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1011#0#0#检查合规#5821" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
elif [ $ItemID -eq $Item_SysService ];
then
echo "检查系统服务......"
Condition1=`chkconfig | grep daytime-stream: | awk '{print $2}'`
Condition2=`chkconfig | grep daytime-dgram: | awk '{print $2}'`
SuSEConDayTime1=$(chkconfig | grep -w daytime | grep -E 'on|xinetd' | grep -v '-')
SuSEConDayTime2=$(chkconfig | grep -w daytime-udp | grep -E 'on|xinetd')
Condition3=`chkconfig | grep -w time-stream: | awk '{print $2}'`
Condition4=`chkconfig | grep -w time-dgram: | awk '{print $2}'`
SuSEConTime1=$(chkconfig | grep -w time | grep -E 'on|xinetd' | grep -v '-')
SuSEConTime2=$(chkconfig | grep -w time-udp | grep -E 'on|xinetd')
Condition5=`chkconfig | grep echo-stream: | awk '{print $2}'`
Condition6=`chkconfig | grep echo-dgram: | awk '{print $2}'`
SuSEConEcho1=$(chkconfig | grep -w echo | grep -E 'on|xinetd' | grep -v '-')
SuSEConEcho2=$(chkconfig | grep -w echo-udp | grep -E 'on|xinetd')
Condition7=`chkconfig | grep discard-stream: | awk '{print $2}'`
Condition8=`chkconfig | grep discard-dgram: | awk '{print $2}'`
SuSEConDiscard1=$(chkconfig | grep -w discard | grep -E 'on|xinetd' | grep -v '-')
SuSEConDiscard2=$(chkconfig | grep -w discard-udp | grep -E 'on|xinetd')
Condition9=`chkconfig | grep chargen-stream: | awk '{print $2}'`
Condition10=`chkconfig | grep chargen-dgram: | awk '{print $2}'`
SuSEConChargen1=$(chkconfig | grep -w chargen | grep -E 'on|xinetd' | grep -v '-')
SuSEConChargen2=$(chkconfig | grep -w chargen-udp | grep -E 'on|xinetd')
Condition11=`systemctl status sendmail | grep Active | awk '{print $2}'`
Centos65C11=$(chkconfig | grep sendmail | grep -E 'on|启用|开|xinetd')
FedoraC11=`systemctl status sendmail.service | grep Active | awk '{print $2}'`
Condition12=`systemctl status ntalk.socket | grep Active | awk '{print $2}'`
Centos65C12=$(chkconfig | grep -E 'talk|ntalk' | grep -E 'on|启用|开|xinetd')
Condition13=`systemctl status tftp.socket | grep Active | awk '{print $2}'`
Centos65C13=$(chkconfig | grep tftp | grep -E 'on|启用|开|xinetd')
Condition14=`systemctl status cups-lpd.socket | grep Active | awk '{print $2}'`
Centos8C14=`systemctl status cups | grep Active | awk '{print $2}'`
Centos65C14=$(chkconfig | grep cups |grep -E 'on|启用|开|xinetd')
FedoraC14=`systemctl status cups.socket | grep Active | awk '{print $2}'`
Condition15=`systemctl status nfs | grep Active | awk '{print $2}'`
Centos65C15=$(chkconfig | grep -w nfs |grep -E 'on|启用|开|xinetd')
Condition16=`systemctl status nfslock | grep Active | awk '{print $2}'`
Centos65C16=$(chkconfig | grep nfslock |grep -E 'on|启用|开|xinetd')
Condition17=`systemctl status ypbind | grep Active | awk '{print $2}'`
Centos65C17=$(chkconfig | grep ypbind |grep -E 'on|启用|开|xinetd')
Condition18=`systemctl status printer.target | grep Active | awk '{print $2}'`
if [[ "$FedoraC11" == "active" || "$FedoraC14" == "active" || "$Condition1" == "on" || "$Condition1" == "开" || "$Condition1" == "启用" || "$Condition2" == "on" || "$Condition2" == "开" || "$Condition2" == "启用" || "$Condition3" == "on" || "$Condition3" == "开" || "$Condition3" == "启用" || "$Condition4" == "on" || "$Condition4" == "开" || "$Condition4" == "启用" || "$Condition5" == "on" || "$Condition5" == "开" || "$Condition5" == "启用" || "$Condition6" == "on" || "$Condition6" == "开" || "$Condition6" == "启用" || "$Condition7" == "on" || "$Condition7" == "开" || "$Condition7" == "启用" || "$Condition8" == "on" || "$Condition8" == "开" || "$Condition8" == "启用" || "$Condition9" == "on" || "$Condition9" == "开" || "$Condition9" == "启用" || "$Condition10" == "on" || "$Condition10" == "开" || "$Condition10" == "启用" || "$Condition11" == "active" || -n "$Centos65C11" || "$Condition12" == "active" || -n "$Centos65C12" || "$Condition13" == "active" || -n "$Centos65C13" || "$Condition14" == "active" || "$Centos8C14" == "active" || -n "$Centos65C14" || "$Condition15" == "active" || -n "$Centos65C15" || "$Condition16" == "active" || -n "$Centos65C16" || "$Condition17" == "active" || -n "$Centos65C17" || "$Condition18" == "active" || -n "$SuSEConDayTime1" || -n "$SuSEConDayTime2" || -n "$SuSEConTime1" || -n "$SuSEConTime2" || -n "$SuSEConEcho1" || -n "$SuSEConEcho2" || -n "$SuSEConDiscard1" || -n "$SuSEConDiscard2" || -n "$SuSEConChargen1" || -n "$SuSEConChargen2" || -n "$SuSEConNTalk" ]];
then
RESULT=5626
echo "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
if [[ "$Condition1" == "on" || "$Condition1" == "开" || "$Condition1" == "启用" || -n "$SuSEConDayTime1" ]];
then
chkconfig daytime-stream off
chkconfig daytime off
echo "1012#1#1#发现daytime服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition2" == "on" || "$Condition2" == "开" || "$Condition2" == "启用" || -n "$SuSEConDayTime2" ]];
then
chkconfig daytime-dgram off
chkconfig daytime-udp off
echo "1012#1#1#发现daytime-udp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition3" == "on" || "$Condition3" == "开" || "$Condition3" == "启用" || -n "$SuSEConTime1" ]];
then
chkconfig time-stream off
chkconfig time off
echo "1012#1#1#发现time服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition4" == "on" || "$Condition4" == "开" || "$Condition4" == "启用" || -n "$SuSEConTime2" ]];
then
chkconfig time-dgram off
chkconfig time-udp off
echo "1012#1#1#发现time-udp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition5" == "on" || "$Condition5" == "开" || "$Condition5" == "启用" || -n "$SuSEConEcho1" ]];
then
chkconfig echo-stream off
chkconfig echo off
echo "1012#1#1#发现echo服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition6" == "on" || "$Condition6" == "开" || "$Condition6" == "启用" || -n "$SuSEConEcho2" ]];
then
chkconfig echo-dgram off
chkconfig echo-udp off
echo "1012#1#1#发现echo-udp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition7" == "on" || "$Condition7" == "开" || "$Condition7" == "启用" || -n "$SuSEConDiscard1" ]];
then
chkconfig discard-stream off
chkconfig discard off
echo "1012#1#1#发现discard服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition8" == "on" || "$Condition8" == "开" || "$Condition8" == "启用" || -n "$SuSEConDiscard2" ]];
then
chkconfig discard-dgram off
chkconfig discard-udp off
echo "1012#1#1#发现discard-udp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition9" == "on" || "$Condition9" == "开" || "$Condition9" == "启用" || -n "$SuSEConChargen1" ]];
then
chkconfig chargen-stream off
chkconfig chargen off
echo "1012#1#1#发现chargen服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition10" == "on" || "$Condition10" == "开" || "$Condition10" == "启用" || -n "$SuSEConChargen2" ]];
then
chkconfig chargen-dgram off
chkconfig chargen-udp off
echo "1012#1#1#发现chargen-udp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition11" == "active" || -n "$Centos65C11" || "$FedoraC11" == "active" ]];
then
systemctl stop sendmail &>/dev/null 2&>/dev/null
systemctl disable sendmail &>/dev/null 2&>/dev/null
systemctl stop sendmail.service &>/dev/null 2&>/dev/null
systemctl disable sendmail.service &>/dev/null 2&>/dev/null
chkconfig sendmail off
echo "1012#1#1#发现sendmail服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition12" == "active" || -n "$Centos65C12" ]];
then
systemctl stop ntalk.socket &>/dev/null 2&>/dev/null
systemctl disable ntalk.socket &>/dev/null 2&>/dev/null
chkconfig talk off
chkconfig ntalk off
echo "1012#1#1#发现talk服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition13" == "active" || -n "$Centos65C13" ]];
then
systemctl stop tftp.socket &>/dev/null 2&>/dev/null
systemctl disable tftp.socket &>/dev/null 2&>/dev/null
chkconfig tftp off
echo "1012#1#1#发现tftp服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition14" == "active" || -n "$Centos65C14" || "$Centos8C14" == "active" || "$FedoraC14" == "active" ]];
then
systemctl stop cups-lpd.socket &>/dev/null 2&>/dev/null
systemctl disable cups-lpd.socket &>/dev/null 2&>/dev/null
systemctl stop cups &>/dev/null 2&>/dev/null
systemctl disable cups &>/dev/null 2&>/dev/null
systemctl stop cups.socket &>/dev/null 2&>/dev/null
systemctl stop cups.path &>/dev/null 2&>/dev/null
systemctl disable cups.socket &>/dev/null 2&>/dev/null
systemctl disable cups.path &>/dev/null 2&>/dev/null
chkconfig cups off
chkconfig cups-lpd off
echo "1012#1#1#发现cups服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition15" == "active" || -n "$Centos65C15" ]];
then
systemctl stop nfs &>/dev/null 2&>/dev/null
systemctl disable nfs &>/dev/null 2&>/dev/null
chkconfig nfs off
echo "1012#1#1#发现nfs服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition16" == "active" || -n "$Centos65C16" ]];
then
systemctl stop nfslock &>/dev/null 2&>/dev/null
systemctl disable nfslock &>/dev/null 2&>/dev/null
chkconfig nfslock off
echo "1012#1#1#发现nfslock服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition17" == "active" || -n "$Centos65C17" ]];
then
systemctl stop ypbind &>/dev/null 2&>/dev/null
systemctl disable ypbind &>/dev/null 2&>/dev/null
chkconfig ypbind off
echo "1012#1#1#发现ypbind服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ "$Condition18" == "active" ];
then
systemctl stop printer.target &>/dev/null 2&>/dev/null
systemctl disable printer.target &>/dev/null 2&>/dev/null
echo "1012#1#1#发现printer服务开启中，存在违规风险，已停止并禁用该服务#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "未开启自动修复"
if [[ "$Condition1" == "on" || "$Condition1" == "开" || "$Condition1" == "启用" || -n "$SuSEConDayTime1" ]];
then
echo "1012#1#0#发现daytime服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition2" == "on" || "$Condition2" == "开" || "$Condition2" == "启用" || -n "$SuSEConDayTime2" ]];
then
echo "1012#1#0#发现daytime-udp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition3" == "on" || "$Condition3" == "开" || "$Condition3" == "启用" || -n "$SuSEConTime1" ]];
then
echo "1012#1#0#发现time服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition4" == "on" || "$Condition4" == "开" || "$Condition4" == "启用" || -n "$SuSEConTime2" ]];
then
echo "1012#1#0#发现time-udp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition5" == "on" || "$Condition5" == "开" || "$Condition5" == "启用" || -n "$SuSEConEcho1" ]];
then
echo "1012#1#0#发现echo服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition6" == "on" || "$Condition6" == "开" || "$Condition6" == "启用" || -n "$SuSEConEcho2" ]];
then
echo "1012#1#0#发现echo-udp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition7" == "on" || "$Condition7" == "开" || "$Condition7" == "启用" || -n "$SuSEConDiscard1" ]];
then
echo "1012#1#0#发现discard服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition8" == "on" || "$Condition8" == "开" || "$Condition8" == "启用" || -n "$SuSEConDiscard2" ]];
then
echo "1012#1#0#发现discard-udp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition9" == "on" || "$Condition9" == "开" || "$Condition9" == "启用" || -n "$SuSEConChargen1" ]];
then
echo "1012#1#0#发现chargen服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition10" == "on" || "$Condition10" == "开" || "$Condition10" == "启用" || -n "$SuSEConChargen2" ]];
then
echo "1012#1#0#发现chargen-udp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition11" == "active" || -n "$Centos65C11" || "$FedoraC11" == "active" ]];
then
echo "1012#1#0#发现sendmail服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition12" == "active" || -n "$Centos65C12" ]];
then
echo "1012#1#0#发现talk服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition13" == "active" || -n "$Centos65C13" ]];
then
echo "1012#1#0#发现tftp服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition14" == "active" || -n "$Centos65C14" || "$Centos8C14" == "active" || "$FedoraC14" == "active" ]];
then
echo "1012#1#0#发现cups服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition15" == "active" || -n "$Centos65C15" ]];
then
echo "1012#1#0#发现nfs服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition16" == "active" || -n "$Centos65C16" ]];
then
echo "1012#1#0#发现nfslock服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [[ "$Condition17" == "active" || -n "$Centos65C17" ]];
then
echo "1012#1#0#发现ypbind服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ "$Condition18" == "active" ];
then
echo "1012#1#0#发现printer服务开启中，存在违规风险，建议停止并禁用该服务#5824" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
else
echo "1012#0#0#检查合规#5823" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_SysBanner ];
then
echo -n "检查系统Banner配置......"
Condition1=`cat "$SYS_BANNER_PATH"rc.local | grep "issue" | grep -v "#"`
if [ ! -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i 's/^[^#].*issue*/#&/g' "$SYS_BANNER_PATH"rc.local
if [ ! -f /etc/issue.bak ]
then
mv /etc/issue /etc/issue.bak
fi
if [ ! -f /etc/issue.net.bak ]
then
mv /etc/issue.net /etc/issue.net.bak
fi
echo "1013#1#1#发现"$SYS_BANNER_PATH"rc.local文件issue配置，存在违规风险，已对其进行注释，并删除存在的/etc/issue文件和/etc/issue.net文件#5825" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1013#1#0#发现"$SYS_BANNER_PATH"rc.local文件issue配置，存在违规风险，建议对其进行注释，并删除/etc/issue文件和/etc/issue.net文件#5826" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1013#0#0#检查合规#5825" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_LogOnTimeOut ];
then
echo -n "检查系统登录超时配置......"
Condition1=`cat /etc/profile | grep 'TMOUT' | grep -v "#" | awk -F '=' '{print $2}'`
if [ -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/TMOUT/d' /etc/profile
echo "TMOUT=300" >> /etc/profile
echo "1014#1#1#未发现/etc/profile文件配置TMOUT选项，存在违规风险，已添加300秒登陆超时设置#5827" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1014#1#0#未发现/etc/profile文件配置TMOUT选项，存在违规风险，建议根据使用情况，添加登陆超时设置，例如：TMOUT=300#5828" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
if [ -n "$(echo $Condition1 | sed -n "/^[0-9]\+$/p")" ]
then
echo "1014#0#0#检查合规#5827" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/TMOUT/d' /etc/profile
echo "TMOUT=300" >> /etc/profile
echo "1014#1#1#/etc/profile文件未正确配置TMOUT选项，存在违规风险，已添加默认300秒登陆超时设置#5827" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1014#1#0#/etc/profile文件未正确配置TMOUT选项，存在违规风险，建议根据使用情况，调整登陆超时设置，例如：TMOUT=300#5828" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
fi
elif [ $ItemID -eq $Item_DangerFile ];
then
echo -n "检查系统关键位置危险文件......"
Condition1=$(find / -maxdepth 3 -name *.netrc)
Condition2=$(find / -maxdepth 3 -name *.rhosts)
Condition3=$(find / -maxdepth 3 -name *hosts.equiv)
if [[ -n "$Condition1" || -n "$Condition2" || -n "$Condition3" ]];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
if [ -n "$Condition1" ];
then
find / -maxdepth 3 -name *.netrc | xargs -i mv {} {}.bak
echo "1015#1#1#发现危险文件{$Condition1}，存在违规风险，已对其进行名称变更#5829" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ -n "$Condition2" ];
then
find / -maxdepth 3 -name *.rhosts | xargs -i mv {} {}.bak
echo "1015#1#1#发现危险文件{$Condition2}，存在违规风险，已对其进行名称变更#5829" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ -n "$Condition3" ];
then
find / -maxdepth 3 -name *hosts.equiv | xargs -i mv {} {}.bak
echo "1015#1#1#发现危险文件{$Condition3}，存在违规风险，已对其进行名称变更#5829" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "未开启自动修复"
if [ -n "$Condition1" ];
then
echo "1015#1#0#发现危险文件{$Condition1}，存在违规风险，建议对其进行名称变更#5830" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ -n "$Condition2" ];
then
echo "1015#1#0#发现危险文件{$Condition2}，存在违规风险，建议对其进行名称变更#5830" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
if [ -n "$Condition3" ];
then
echo "1015#1#0#发现危险文件{$Condition3}，存在违规风险，建议对其进行名称变更#5830" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
fi
else
echo "1015#0#0#检查合规#5829" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_FTPAdministrator ];
then
echo -n "检查FTP超级管理员权限......"
Condition1=`cat "$FTPCONF_PATH"ftpusers | grep "root" | grep -v "#"`
Condition2=`cat "$FTPCONF_PATH"user_list | grep "root" | grep -v "#"`
if [ -z "$Condition1" ] || [ -z "$Condition2" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -ri "/root/d" "$FTPCONF_PATH"ftpusers
echo "root" >> "$FTPCONF_PATH"ftpusers
sed -ri "/root/d" "$FTPCONF_PATH"user_list
echo "root" >> "$FTPCONF_PATH"user_list
echo "1016#1#1#未发现ftp配置文件中禁用超级管理员root账户登陆，存在违规风险，已添加root用户到ftp配置文件#5831" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1016#1#0#未发现ftp配置文件中禁用超级管理员root账户登陆，存在违规风险，建议添加root用户到ftp配置文件#5832" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1016#0#0#检查合规#5831" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_FTPAnonymity ];
then
echo -n "检查FTP匿名登录风险......"
Condition1=`cat "$FTPCONF_PATH"vsftpd.conf | grep anonymous_enable=NO | grep -v "#"`
if [ -z "$Condition1" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/anonymous_enable=/d' "$FTPCONF_PATH"vsftpd.conf
echo "anonymous_enable=NO" >> "$FTPCONF_PATH"vsftpd.conf
echo "1017#1#1#检测到"$FTPCONF_PATH"vsftpd.conf文件已打开允许匿名登陆配置，存在违规风险，已关闭该配置选项#5833" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1017#1#0#检测到"$FTPCONF_PATH"vsftpd.conf文件已打开允许匿名登陆配置，存在违规风险，建议关闭该配置选项#5834" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1017#0#0#检查合规#5833" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_FTPBanner ];
then
echo -n "检查FTP Banner配置......"
Condition1=`cat "$FTPCONF_PATH"vsftpd.conf | grep "banner" | grep -v "#"`
if [ "$Condition1" != "banner /etc/vsftpd/ftpbanner_EDR" ];
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
if [ ! -d "/etc/vsftpd/" ]
then
mkdir /etc/vsftpd/
fi
sed -ri "/banner/d" "$FTPCONF_PATH"vsftpd.conf
echo "banner /etc/vsftpd/ftpbanner_EDR" >> "$FTPCONF_PATH"vsftpd.conf
echo "Authorized only. All activity will be monitored and reported." > /etc/vsftpd/ftpbanner_EDR
echo "1018#1#1#检测到"$FTPCONF_PATH"vsftpd.conf文件中未设置EDRftpbanner，存在违规风险，已修复相关配置#5835" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1018#1#0#检测到"$FTPCONF_PATH"vsftpd.conf文件中未设置EDRftpbanner，存在违规风险，建议开启自动修复进行相关配置#5836" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1018#0#0#检查合规#5835" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_PasswdLiveTime ]
then
echo -n "检查口令生存周期......"
Condition=`cat /etc/login.defs | grep PASS_MAX_DAYS |grep -v '#' | awk '{print $2}'`
if [ -z "$Condition" ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复1"
sed -i '/PASS_MAX_DAYS/d' /etc/login.defs
echo "PASS_MAX_DAYS 90" >> /etc/login.defs
echo "1019#1#1#检测到/etc/pam.d/login.defs文件中口令生存周期设置不存在或失效，存在违规风险，已对其进行默认配置#5837" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1019#1#0#检测到/etc/pam.d/login.defs文件中口令生存周期设置不存在或失效，存在违规风险，建议对其进行配置周期不超过90天#5838" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $Condition -gt 90 ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ];
then
echo "开始自动修复"
sed -i '/cron/d' /etc/rsyslog.conf
echo "PASS_MAX_DAYS 90" >> /etc/login.defs
echo "1019#1#1#检测到/etc/pam.d/login.defs文件中口令生存周期设置超限，存在违规风险，已对其进行默认配置90天#5837" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1019#1#0#检测到/etc/pam.d/login.defs文件中口令生存周期设置超限，存在违规风险，建议对其进行配置周期不超过90天#5838" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1019#0#0#检查合规#5837" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $ItemID -eq $Item_PasswdComplexity ]
then
echo -n "检查口令复杂度......"
SECURELIB=
COMPLEXITY_FILE=system-auth
if [ "$SYSTEM_VERSION" == "6" ]
then
SECURELIB=pam_cracklib.so
else
SECURELIB=pam_pwquality.so
fi
if [ "$WHICHSYSTEM" == "Ubuntu" ]
then
COMPLEXITY_FILE=common-password
fi
Con1=`cat /etc/pam.d/"$COMPLEXITY_FILE" | grep $SECURELIB | grep dcredit=-`
Con2=`cat /etc/pam.d/"$COMPLEXITY_FILE" | grep $SECURELIB | grep ocredit=-`
Con3=`cat /etc/pam.d/"$COMPLEXITY_FILE" | grep $SECURELIB | grep lcredit=-`
Con4=`cat /etc/pam.d/"$COMPLEXITY_FILE" | grep $SECURELIB | grep ucredit=-`
Con5=`cat /etc/pam.d/"$COMPLEXITY_FILE" | grep $SECURELIB | grep -v '#'`
Con6=`cat /etc/login.defs | grep PASS_MIN_LEN | grep -v '#' | awk '{print $2}'`
Con7=`cat /etc/login.defs | grep PASS_MAX_DAYS | grep -v '#' | awk '{print $2}'`
if [ -z "$Con5" ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ]
then
sed -i "/$SECURELIB/d" /etc/pam.d/"$COMPLEXITY_FILE"
echo "password requisite $SECURELIB try_first_pass retry=3 minlen=8 dcredit=-1 ocredit=-1 lcredit=-1" >> /etc/pam.d/"$COMPLEXITY_FILE"
echo "1020#1#1#检测到/etc/pam.d/$COMPLEXITY_FILE文件中未配置密码复杂度策略或失效，存在违规风险，已对其进行默认配置#5839" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1020#1#0#检测到/etc/pam.d/$COMPLEXITY_FILE文件中未配置密码复杂度策略，存在违规风险，建议开启自动加固选项，对其进行默认配置#5840" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [[ -z "$Con1" || -z "$Con2" || -z "$Con3" ]] && [[ -z "$Con1" || -z "$Con2" || -z "$Con4" ]] && [[ -z "$Con1" || -z "$Con3" || -z "$Con4" ]] && [[ -z "$Con2" || -z "$Con3" || -z "$Con4" ]]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ]
then
sed -i "/$SECURELIB/d" /etc/pam.d/"$COMPLEXITY_FILE"
sed -i '/ucredit=-/d' /etc/pam.d/"$COMPLEXITY_FILE"
sed -i '/ocredit=-/d' /etc/pam.d/"$COMPLEXITY_FILE"
sed -i '/dcredit=-/d' /etc/pam.d/"$COMPLEXITY_FILE"
sed -i '/lcredit=-/d' /etc/pam.d/"$COMPLEXITY_FILE"
echo "password requisite $SECURELIB try_first_pass retry=3 minlen=8 dcredit=-1 ocredit=-1 lcredit=-1" >> /etc/pam.d/"$COMPLEXITY_FILE"
echo "1020#1#1#检测到/etc/pam.d/$COMPLEXITY_FILE文件中配置密码复杂度策略不合规，存在违规风险，已对其进行默认配置#5839" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1020#1#0#检测到/etc/pam.d/$COMPLEXITY_FILE文件中配置密码复杂度策略不合规，存在违规风险，建议开启自动加固选项，默认配置复杂度策略#5840" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ -z "$Con6" ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ]
then
sed -i '/PASS_MIN_LEN/d' /etc/login.defs
echo "PASS_MIN_LEN 8" >> /etc/login.defs
echo "1020#1#1#检测到/etc/login.defs文件中缺少配置密码最小长度选项或被禁用，存在违规风险，已对其进行默认配置最小长度8#5839" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1020#1#0#检测到/etc/login.defs文件中缺少配置密码最小长度选项或被禁用，存在违规风险，建议开启自动加固选项，默认配置最小长度8#5840" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
elif [ $Con6 -lt 8 ]
then
RESULT=5626
echo -n "未通过......"
if [ $REPAIR -eq $YES ]
then
sed -i '/PASS_MIN_LEN/d' /etc/login.defs
echo "PASS_MIN_LEN 8" >> /etc/login.defs
echo "1020#1#1#检测到/etc/login.defs文件中配置密码最小长度小于8，存在违规风险，已对其进行默认配置最小长度8#5839" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
else
echo "未开启自动修复"
echo "1020#1#0#检测到/etc/login.defs文件中配置密码最小长度小于8，存在违规风险，建议修改密码最小长度为8#5840" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "1020#0#0#检查合规#5839" > /usr/local/edr/var/baseline/template_result_1.log
sleep 0.5
fi
else
echo "$ItemID"
fi
fi
done < /usr/local/edr/var/baseline/BaseLine_Template_Policy_"$1"
sleep 0.5
if [ $REPAIR -eq $YES ]
then
RESULT=5625
fi
echo "1999#0#0#检测结束#$RESULT" > /usr/local/edr/var/baseline/template_result_1.log
exit