add firewalld check

Signed-off-by: Fanjun Kong <kongfanjun@iscas.ac.cn>
2025-11-24 14:51:18 +08:00
parent d117d3c356
commit df4e4e4af6
1 changed files with 137 additions and 0 deletions
@@ -0,0 +1,137 @@
+metadata:
+  version: "2.0"
+  description: "防火墙配置检查项"
+
+checks:
+  # 6.1 防火墙配置
+  # 要求：启用firewalld防火墙服务并设置开机自启，严格遵循"最小权限"原则，仅开放业务必需的服务端口
+  - id: "firewall_config"
+    category: "防火墙配置"
+    title: "防火墙配置检查"
+    description: "检查firewalld服务状态、开放端口和服务、开机自启配置。防火墙是系统网络安全的第一道防线，必须启用系统默认的firewalld防火墙服务并设置开机自启，严格遵循最小权限原则，仅开放业务必需的服务端口（如SSH端口22），关闭所有非必要端口，有效阻断未授权的网络访问请求，降低远程攻击风险。"
+    tags: ["low", "medium", "high", "network", "firewall"]
+    check_script: |
+      # 检查firewalld服务运行状态
+      # 使用 || true 避免命令失败时导致脚本退出（set -e模式下）
+      service_status=$(systemctl is-active firewalld 2>/dev/null || echo "unknown")
+      service_enabled=$(systemctl is-enabled firewalld 2>/dev/null || echo "unknown")
+      
+      # 检查服务是否存在
+      if [ "$service_status" = "unknown" ] && [ "$service_enabled" = "unknown" ]; then
+        echo "FAIL: firewalld服务未安装或无法访问"
+        echo "服务状态: 未安装"
+        echo "建议: 安装firewalld服务，执行命令: dnf install firewalld -y"
+        exit 1
+      fi
+      
+      # 检查服务运行状态
+      if [ "$service_status" != "active" ]; then
+        echo "FAIL: firewalld服务未运行"
+        echo "服务状态: $service_status"
+        echo "建议: 启动firewalld服务，执行命令: systemctl start firewalld"
+        exit 1
+      fi
+      
+      # 检查开机自启状态
+      if [ "$service_enabled" != "enabled" ]; then
+        echo "FAIL: firewalld服务未设置开机自启"
+        echo "开机自启状态: $service_enabled"
+        echo "建议: 设置firewalld服务开机自启，执行命令: systemctl enable firewalld"
+        exit 1
+      fi
+      
+      # 检查防火墙开放的端口和服务
+      firewall_info=$(firewall-cmd --list-all 2>/dev/null || echo "")
+      
+      if [ -z "$firewall_info" ]; then
+        echo "FAIL: 无法获取防火墙配置信息"
+        echo "建议: 检查firewalld服务是否正常运行，执行命令: systemctl status firewalld"
+        exit 1
+      fi
+      
+      # 提取services和ports信息
+      # firewall-cmd --list-all 输出格式示例：
+      # services: ssh dhcpv6-client
+      # ports: 80/tcp 443/tcp
+      services_line=$(echo "$firewall_info" | grep -E "^\\s*services:" || echo "")
+      ports_line=$(echo "$firewall_info" | grep -E "^\\s*ports:" || echo "")
+      
+      # 提取services值（去除"services:"前缀和前后空格）
+      services=$(echo "$services_line" | sed 's/^[[:space:]]*services:[[:space:]]*//;s/[[:space:]]*$//' | tr -s ' ' || echo "")
+      # 提取ports值（去除"ports:"前缀和前后空格）
+      ports=$(echo "$ports_line" | sed 's/^[[:space:]]*ports:[[:space:]]*//;s/[[:space:]]*$//' | tr -s ' ' || echo "")
+      
+      # 检查是否有非必要的服务或端口
+      # 定义必要的服务（可根据实际情况调整）
+      APPROVED_SERVICES="ssh"
+      APPROVED_PORTS="22/tcp"
+      
+      has_issues=false
+      issue_details=""
+      
+      # 检查services（如果services不为空）
+      if [ -n "$services" ]; then
+        # 检查是否包含非ssh服务
+        for service in $services; do
+          if [ "$service" != "ssh" ]; then
+            has_issues=true
+            issue_details="${issue_details}非必要服务: $service; "
+          fi
+        done
+      fi
+      
+      # 检查ports（如果ports不为空）
+      if [ -n "$ports" ]; then
+        # 检查是否包含非22端口
+        for port in $ports; do
+          if [ "$port" != "22/tcp" ] && [ "$port" != "22/udp" ]; then
+            has_issues=true
+            issue_details="${issue_details}非必要端口: $port; "
+          fi
+        done
+      fi
+      
+      # 输出检查结果
+      if [ "$has_issues" = true ]; then
+        echo "FAIL: 防火墙开放了非必要的服务或端口"
+        echo "服务状态: active (running)"
+        echo "开机自启: enabled"
+        echo "当前开放的服务: ${services:-无}"
+        echo "当前开放的端口: ${ports:-无}"
+        echo "问题详情: $issue_details"
+        echo "建议: 移除非必要的服务和端口，仅保留业务必需的服务（如SSH）"
+        echo "移除服务示例: firewall-cmd --permanent --remove-service=http"
+        echo "移除端口示例: firewall-cmd --permanent --remove-port=80/tcp"
+        echo "重新加载配置: firewall-cmd --reload"
+        exit 1
+      else
+        echo "PASS: 防火墙配置符合要求"
+        echo "服务状态: active (running)"
+        echo "开机自启: enabled"
+        echo "当前开放的服务: ${services:-无}"
+        echo "当前开放的端口: ${ports:-无}"
+        exit 0
+      fi
+    fix_script: |
+      # 修复防火墙配置
+      # 1. 设置firewalld服务开机自启
+      systemctl enable firewalld 2>/dev/null || true
+      
+      # 2. 启动firewalld服务
+      systemctl start firewalld 2>/dev/null || true
+      
+      # 3. 等待服务启动
+      sleep 2
+      
+      # 4. 开放必要服务（SSH）
+      firewall-cmd --permanent --add-service=ssh 2>/dev/null || true
+      
+      # 5. 重新加载防火墙配置
+      firewall-cmd --reload 2>/dev/null || true
+      
+      echo "修复完成，请手动检查并移除非必要的服务和端口"
+      echo "查看当前配置: firewall-cmd --list-all"
+      echo "移除服务示例: firewall-cmd --permanent --remove-service=http"
+      echo "移除端口示例: firewall-cmd --permanent --remove-port=80/tcp"
+      echo "重新加载配置: firewall-cmd --reload"
+