linux 基线检查

1 检查用户缺省UMASK

#cat /etc/profile|sed '/^#/d'|sed '/^$/d'|grep -i "umask"

修改umask

vi /etc/profile

umask 033

source /etc/profile

2 检查口令重复次数限制

##!/bin/bash
#function Calculate
{
CREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "credit"|sed 's/^.*credit=//g'|sed 's/\s.*$//g'`
DCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "dcredit"|sed 's/^.*dcredit=//g'|sed 's/\s.*$//g'`
LCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "lcredit"|sed 's/^.*lcredit=//g'|sed 's/\s.*$//g'`
UCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "ucredit"|sed 's/^.*ucredit=//g'|sed 's/\s.*$//g'`
OCREDIT=`cat $FILE|egrep -v "^#|^$"|grep -w "ocredit"|sed 's/^.*ocredit=//g'|sed 's/\s.*$//g'`
MINCLASS=`cat $FILE|egrep -v "^#|^$"|grep -w "minclass"|sed 's/^.*minclass=//g'|sed 's/\s.*$//g'`
MINLEN=`cat $FILE|egrep -v "^#|^$"|grep "minlen"|sed 's/^.*minlen=//g'|sed 's/\s.*$//g'`
COUNT1=`cat $FILE|grep -i "min=disabled,12,8,6,5"|grep -i "max=40"| grep -i "passphrase=3"|grep -i "match=4"|grep -i "similar=deny"|grep -i "retry=3"|wc -l`
COUNT2=0
for NO in $CREDIT $DCREDIT $LCREDIT $UCREDIT $OCREDIT
do
if ([ $NO -lt 0 ]);
then COUNT2=`expr $COUNT2 + 1`
fi
done
if ([ ${MINCLASS:=0} -ge 2 ] && [ ${MINLEN:=0} -ge 8 ]);
then echo "check result:true"
elif ([ $COUNT2 -ge 2 ] && [ ${MINLEN:=0} -ge 8 ]);
then echo "check result:true"
elif ([ "$COUNT1" == "1" ]);
then echo "check result:true"
else echo "check result:false"
fi
unset CREDIT DCREDIT LCREDIT UCREDIT OCREDIT MINCLASS MINLEN COUNT1 COUNT2
}
#if ([ -f /etc/redhat-release ] && [ -f /etc/pam.d/system-auth ]);
then FILE=/etc/pam.d/system-auth
echo "====/etc/pam.d/system-auth is:===="
cat $FILE |sed '/^#/d'|sed '/^$/d'
Calculate
elif ([ -f /etc/SuSE-release ] && [ -f /etc/pam.d/common-password ] && [ `cat /etc/pam.d/common-password |egrep -i "credit|min|max|passphrase|remember"|wc -l` -gt 0 ]);
then FILE=/etc/pam.d/common-password
echo "====/etc/pam.d/common-password is:===="
cat $FILE|grep -v '^#'|grep -v '^$'
Calculate
elif ([ -f /etc/SuSE-release ] && [ -f /etc/pam.d/passwd ] && [ `cat /etc/pam.d/passwd |egrep -i "credit|min|max|passphrase|remember"|wc -l` -gt 0 ]);
then FILE=/etc/pam.d/passwd
echo "====/etc/pam.d/passwd is:===="
cat $FILE|grep -v '^#'|grep -v '^$'
Calculate
fi;
#if [ -f /etc/pam.d/login ];
then cat /etc/pam.d/login |sed '/^#/d'|sed '/^$/d';
fi;
#if [ -f /etc/pam.d/sshd ];
then cat /etc/pam.d/sshd |sed '/^#/d'|sed '/^$/d';
fi;