#定义报表的全局变量
report_DateTime="" #日期 ok
report_Hostname="" #主机名 ok
report_OSRelease="" #发行版本 ok
report_Kernel="" #内核 ok
report_Language="" #语言/编码 ok
report_LastReboot="" #最近启动时间 ok
report_Uptime="" #运行时间（天） ok
report_CPUs="" #CPU数量 ok
report_CPUType="" #CPU类型 ok
report_Arch="" #CPU架构 ok
report_MemTotal="" #内存总容量(MB) ok
report_MemFree="" #内存剩余(MB) ok
report_MemUsedPercent="" #内存使用率% ok
report_DiskTotal="" #硬盘总容量(GB) ok
report_DiskFree="" #硬盘剩余(GB) ok
report_DiskUsedPercent="" #硬盘使用率% ok
report_InodeTotal="" #Inode总量 ok
report_InodeFree="" #Inode剩余 ok
report_InodeUsedPercent="" #Inode使用率 ok
report_IP="" #IP地址 ok
report_MAC="" #MAC地址 ok
report_Gateway="" #默认网关 ok
report_DNS="" #DNS ok
report_Listen="" #监听 ok
report_Selinux="" #Selinux ok
report_Firewall="" #防火墙 ok
report_USERs="" #用户 ok
report_USEREmptyPassword="" #空密码用户 ok
report_USERTheSameUID="" #相同ID的用户 ok
report_PasswordExpiry="" #密码过期（天） ok
report_RootUser="" #root用户 ok
report_Sudoers="" #sudo授权 ok
report_SSHAuthorized="" #SSH信任主机 ok
report_SSHDProtocolVersion="" #SSH协议版本 ok
report_SSHDPermitRootLogin="" #允许root远程登录 ok
report_DefunctProsess="" #僵尸进程数量 ok
report_SelfInitiatedService="" #自启动服务数量 ok
report_SelfInitiatedProgram="" #自启动程序数量 ok
report_RuningService="" #运行中服务数 ok
report_Crontab="" #计划任务数 ok
report_Syslog="" #日志服务 ok
report_SNMP="" #SNMP OK
report_NTP="" #NTP ok
report_JDK="" #JDK版本 ok
function version(){
echo ""
echo ""
echo "系统巡检脚本：Version $VERSION"
}
function getLoginStatus(){
echo ""
echo ""
echo "############################ 登录检查 ############################"
last | head
}
function getNetworkStatus(){
echo ""
echo ""
echo "############################ 网络检查 ############################"
if [[ $centosVersion ]]; then
# 检查网络接口
echo "网络接口情况："
ifconfig -a
# Ping 一些地址
echo "Ping 测试："
ping -c 4 baidu.com
# 可以根据实际需求添加其他网络检查逻辑
fi
# 报表信息
report_Crontab="$Crontab" # 计划任务数
}
function getHowLongAgo(){
# 计算一个时间戳离现在有多久了
datetime="$*"
if [ -z "$datetime" ]; then
echo "错误的参数：getHowLongAgo() $*"
fi
Timestamp=$(date +%s -d "$datetime") # 转化为时间戳
Now_Timestamp=$(date +%s)
Difference_Timestamp=$(($Now_Timestamp-$Timestamp))
days=0; hours=0; minutes=0;
sec_in_day=$((60*60*24));
sec_in_hour=$((60*60));
sec_in_minute=60
while (( $(($Difference_Timestamp-$sec_in_day)) > 1 )); do
let Difference_Timestamp=Difference_Timestamp-sec_in_day
let days++
done
while (( $(($Difference_Timestamp-$sec_in_hour)) > 1 )); do
let Difference_Timestamp=Difference_Timestamp-sec_in_hour
let hours++
done
echo "$days 天 $hours 小时前"
}
function getUserLastLogin(){
# 获取用户最近一次登录的时间，含年份
# 很遗憾last命令不支持显示年份，只有"last -t YYYYMMDDHHMMSS"表示某个时间之间的登录，我们只能用最笨的方法了，
# 对比今天之前和今年元旦之前（或者去年之前和前年之前……）某个用户登录次数，如果登录统计次数有变化，则说明最近一次登录是今年。
username=$1
: ${username:="`whoami`"}
thisYear=$(date +%Y)
oldesYear=$(last | tail -n1 | awk '{print $NF}')
while (( $thisYear >= $oldesYear )); do
loginBeforeToday=$(last $username | grep $username | wc -l)
loginBeforeNewYearsDayOfThisYear=$(last $username -t $thisYear"0101000000" | grep $username | wc -l)
if [ $loginBeforeToday -eq 0 ]; then
echo "从未登录过"
break
elif [ $loginBeforeToday -gt $loginBeforeNewYearsDayOfThisYear ]; then
lastDateTime=$(last -i $username | head -n1 | awk '{for(i=4;i1{print $2}')
for uid in $UIDs; do
echo -n "$uid";
USERTheSameUID="$uid"
r=$(awk -F: 'ORS="";$3=='"$uid"'{print ":",$1}' /etc/passwd)
echo "$r"
echo ""
USERTheSameUID="$USERTheSameUID $r,"
done
# 报表信息
report_USERs="$USERs" # 用户
report_USEREmptyPassword=$(echo $USEREmptyPassword | sed 's/^,//')
report_USERTheSameUID=$(echo $USERTheSameUID | sed 's/,$//')
report_RootUser=$(echo $RootUser | sed 's/^,//') # 特权用户
break
fi
# 当前年份递减，继续循环
thisYear=$(( thisYear - 1 ))
done
}
function getPasswordStatus {
echo ""
echo ""
echo "############################ 密码检查 ############################"
pwdfile="$(cat /etc/passwd)"
echo ""
echo "密码过期检查"
echo "------------"
result=""
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do
get_expiry_date=$(/usr/bin/chage -l $user | grep 'Password expires' | cut -d: -f2)
if [[ $get_expiry_date = ' never' || $get_expiry_date = 'never' ]];then
printf "%-15s 永不过期\n" $user
result="$result,$user:never"
else
password_expiry_date=$(date -d "$get_expiry_date" "+%s")
current_date=$(date "+%s")
diff=$(($password_expiry_date-$current_date))
let DAYS=$(($diff/(60*60*24)))
printf "%-15s %s天后过期\n" $user $DAYS
result="$result,$user:$DAYS days"
fi
done
done
report_PasswordExpiry=$(echo $result | sed 's/^,//')
function getState(){
if [[ "$centosVersion" == "/dev/null" ]]; then
if ps aux | grep -v grep | grep "$1" > /dev/null; then
r="active"
else
r="inactive"
fi
else
if [ -e /etc/init.d/$1 ]; then
if /etc/init.d/$1 status | grep -E "is running|正在运行" > /dev/null; then
r="active"
else
r="inactive"
fi
else
# CentOS 7+
r="$(systemctl is-active $1 2>&1)"
fi
fi
echo "$r"
}
function getSSHStatus(){
echo ""
echo ""
echo "############################ SSH检查 #############################"
# 检查受信任主机
pwdfile="$(cat /etc/passwd)"
echo "服务状态：$(getState sshd)"
Protocol_Version=$(awk '/^Protocol/ {print $2}' /etc/ssh/sshd_config)
echo "SSH协议版本：$Protocol_Version"
echo ""
echo "信任主机"
echo "--------"
authorized=0
while IFS=: read -r user _ _ _ _ home _; do
authorize_file="$home/.ssh/authorized_keys"
authorized_host=$(awk '{print $3}' "$authorize_file" 2>/dev/null | tr '\n' ',' | sed 's/,$//')
if [ -n "$authorized_host" ]; then
echo "$user 授权 \"$authorized_host\" 无密码访问"
fi
authorized=$((authorized + $(awk '{print $3}' "$authorize_file" 2>/dev/null | wc -l)))
done <<< "$(echo "$pwdfile" | grep /bin/bash | awk -F: '{print $1,$6}')"
echo ""
echo "是否允许ROOT远程登录"
echo "--------------------"
config=$(awk '/^PermitRootLogin/ {print $2}' /etc/ssh/sshd_config)
firstChar=${config:0:1}
if [ "$firstChar" == "#" ]; then
PermitRootLogin="yes" # 默认是允许ROOT远程登录的
else
PermitRootLogin="$config"
fi
}
[复制链接]
发表于 2024-1-21 16:42
