393 lines
16 KiB
YAML
393 lines
16 KiB
YAML
metadata:
|
||
version: "2.0"
|
||
description: "会话安全配置检查项"
|
||
|
||
checks:
|
||
# 2.7 登录超时时间
|
||
- id: "login_timeout"
|
||
category: "会话安全"
|
||
title: "登录超时设置"
|
||
description: "设置命令行界面登录超时时间不超过1800秒(30分钟)"
|
||
tags: ["low", "medium", "high", "session"]
|
||
check_script: |
|
||
# 使用 || true 避免grep未找到匹配时导致脚本退出（set -e模式下）
|
||
timeout=$(grep "^TMOUT" /etc/profile 2>/dev/null | awk -F= '{print $2}' | tr -d ' ' || true)
|
||
if [ -z "$timeout" ]; then
|
||
echo "FAIL: 未设置登录超时"
|
||
echo "建议: 在/etc/profile中添加'TMOUT=1800'"
|
||
exit 1
|
||
elif [ "$timeout" -le 1800 ]; then
|
||
echo "PASS: 登录超时设置为${timeout}秒，符合要求"
|
||
exit 0
|
||
else
|
||
echo "FAIL: 登录超时设置为${timeout}秒，超过1800秒限制"
|
||
echo "建议: 修改/etc/profile中TMOUT值为1800或更小"
|
||
exit 1
|
||
fi
|
||
fix_script: |
|
||
if ! grep -q "^TMOUT" /etc/profile; then
|
||
echo "# 设置登录超时时间为1800秒（30分钟）" >> /etc/profile
|
||
echo "TMOUT=1800" >> /etc/profile
|
||
echo "readonly TMOUT" >> /etc/profile
|
||
echo "export TMOUT" >> /etc/profile
|
||
else
|
||
sed -i '/^TMOUT/d' /etc/profile
|
||
sed -i '/^readonly TMOUT/d' /etc/profile
|
||
sed -i '/^export TMOUT/d' /etc/profile
|
||
echo "TMOUT=1800" >> /etc/profile
|
||
echo "readonly TMOUT" >> /etc/profile
|
||
echo "export TMOUT" >> /etc/profile
|
||
fi
|
||
source /etc/profile
|
||
echo "已设置登录超时时间为1800秒"
|
||
|
||
# 4.1 配置history时间戳，便于审计
|
||
# 要求：为history命令配置时间戳功能，使日志中清晰记录每条命令的执行时间，便于追溯用户操作行为、排查安全事件
|
||
- id: "history_timestamp"
|
||
category: "日志审计"
|
||
title: "配置history时间戳"
|
||
description: "为history命令配置时间戳功能，使日志中清晰记录每条命令的执行时间，便于追溯用户操作行为、排查安全事件"
|
||
tags: ["low", "medium", "high", "audit", "log"]
|
||
check_script: |
|
||
# 检查history时间戳配置
|
||
# 要求：HISTTIMEFORMAT环境变量必须配置，格式应为"%F %T "（年-月-日 时:分:秒）
|
||
# 使用 || true 避免命令失败时导致脚本退出（set -e模式下）
|
||
|
||
# 检查当前shell的HISTTIMEFORMAT配置
|
||
current_format=$(echo "$HISTTIMEFORMAT" 2>/dev/null || echo "")
|
||
|
||
# 检查系统全局配置文件
|
||
bashrc_format=$(grep -E "^export HISTTIMEFORMAT=" /etc/bashrc 2>/dev/null | head -1 | sed 's/.*HISTTIMEFORMAT="\([^"]*\)".*/\1/' || echo "")
|
||
profile_format=$(grep -E "^export HISTTIMEFORMAT=" /etc/profile 2>/dev/null | head -1 | sed 's/.*HISTTIMEFORMAT="\([^"]*\)".*/\1/' || echo "")
|
||
|
||
# 检查配置文件是否存在配置
|
||
bashrc_configured=false
|
||
profile_configured=false
|
||
|
||
if grep -qE "^export HISTTIMEFORMAT=" /etc/bashrc 2>/dev/null || true; then
|
||
bashrc_configured=true
|
||
fi
|
||
|
||
if grep -qE "^export HISTTIMEFORMAT=" /etc/profile 2>/dev/null || true; then
|
||
profile_configured=true
|
||
fi
|
||
|
||
# 判断是否符合要求
|
||
# 标准格式应为 "%F %T " 或包含日期和时间的格式
|
||
expected_format="%F %T "
|
||
format_ok=false
|
||
config_ok=false
|
||
|
||
# 检查格式是否正确（允许包含%F和%T的格式）
|
||
if [ -n "$current_format" ]; then
|
||
if echo "$current_format" | grep -qE "%F.*%T|%T.*%F"; then
|
||
format_ok=true
|
||
fi
|
||
elif [ -n "$bashrc_format" ]; then
|
||
if echo "$bashrc_format" | grep -qE "%F.*%T|%T.*%F"; then
|
||
format_ok=true
|
||
fi
|
||
elif [ -n "$profile_format" ]; then
|
||
if echo "$profile_format" | grep -qE "%F.*%T|%T.*%F"; then
|
||
format_ok=true
|
||
fi
|
||
fi
|
||
|
||
# 检查是否在配置文件中配置（至少在一个文件中配置）
|
||
if [ "$bashrc_configured" = true ] || [ "$profile_configured" = true ]; then
|
||
config_ok=true
|
||
fi
|
||
|
||
# 输出检查结果
|
||
echo "检查history时间戳配置:"
|
||
echo ""
|
||
|
||
if [ -n "$current_format" ]; then
|
||
echo "当前HISTTIMEFORMAT环境变量: $current_format"
|
||
else
|
||
echo "当前HISTTIMEFORMAT环境变量: 未设置"
|
||
fi
|
||
|
||
echo ""
|
||
echo "系统配置文件检查:"
|
||
if [ "$bashrc_configured" = true ]; then
|
||
echo " /etc/bashrc: 已配置 (格式: $bashrc_format)"
|
||
else
|
||
echo " /etc/bashrc: 未配置"
|
||
fi
|
||
|
||
if [ "$profile_configured" = true ]; then
|
||
echo " /etc/profile: 已配置 (格式: $profile_format)"
|
||
else
|
||
echo " /etc/profile: 未配置"
|
||
fi
|
||
|
||
echo ""
|
||
|
||
# 综合判断
|
||
if [ "$format_ok" = true ] && [ "$config_ok" = true ]; then
|
||
echo "PASS: history时间戳配置符合要求"
|
||
echo ""
|
||
echo "建议: 为确保所有用户生效，建议同时在/etc/bashrc和/etc/profile中配置"
|
||
echo " 可同时配置HISTSIZE和HISTFILESIZE以增强审计效果"
|
||
exit 0
|
||
elif [ "$format_ok" = true ] && [ "$config_ok" = false ]; then
|
||
echo "FAIL: history时间戳格式正确，但未在系统全局配置文件中配置"
|
||
echo ""
|
||
echo "建议: 在/etc/bashrc和/etc/profile中添加以下配置:"
|
||
echo " export HISTTIMEFORMAT=\"%F %T \""
|
||
echo " export HISTSIZE=10000"
|
||
echo " export HISTFILESIZE=10000"
|
||
exit 1
|
||
elif [ "$format_ok" = false ] && [ "$config_ok" = true ]; then
|
||
echo "FAIL: history时间戳已在配置文件中配置，但格式不正确"
|
||
echo ""
|
||
echo "当前配置格式: $bashrc_format$profile_format"
|
||
echo "建议格式: %F %T （%F表示日期，%T表示时间）"
|
||
echo ""
|
||
echo "修复建议: 编辑/etc/bashrc和/etc/profile，修改HISTTIMEFORMAT配置为:"
|
||
echo " export HISTTIMEFORMAT=\"%F %T \""
|
||
exit 1
|
||
else
|
||
echo "FAIL: 未配置history时间戳"
|
||
echo ""
|
||
echo "建议: 在/etc/bashrc和/etc/profile中添加以下配置:"
|
||
echo " export HISTTIMEFORMAT=\"%F %T \""
|
||
echo " export HISTSIZE=10000"
|
||
echo " export HISTFILESIZE=10000"
|
||
echo ""
|
||
echo "配置后执行以下命令使配置立即生效:"
|
||
echo " source /etc/bashrc"
|
||
echo " source /etc/profile"
|
||
exit 1
|
||
fi
|
||
fix_script: |
|
||
echo "此问题需要人工干预，请根据检查结果执行以下操作："
|
||
echo ""
|
||
echo "1. 编辑系统全局bash配置文件: vi /etc/bashrc"
|
||
echo " 在文件末尾添加以下内容:"
|
||
echo " export HISTTIMEFORMAT=\"%F %T \""
|
||
echo " export HISTSIZE=10000"
|
||
echo " export HISTFILESIZE=10000"
|
||
echo ""
|
||
echo "2. 编辑系统全局配置文件: vi /etc/profile"
|
||
echo " 在文件末尾添加以下内容:"
|
||
echo " export HISTTIMEFORMAT=\"%F %T \""
|
||
echo " export HISTSIZE=10000"
|
||
echo " export HISTFILESIZE=10000"
|
||
echo ""
|
||
echo "3. 保存文件后，执行以下命令使配置立即生效:"
|
||
echo " source /etc/bashrc"
|
||
echo " source /etc/profile"
|
||
echo ""
|
||
echo "4. 验证配置:"
|
||
echo " echo \$HISTTIMEFORMAT"
|
||
echo " history 10 # 查看是否包含时间戳"
|
||
echo ""
|
||
echo "说明:"
|
||
echo " - HISTTIMEFORMAT=\"%F %T \" 配置时间戳格式为'年-月-日 时:分:秒 '"
|
||
echo " - HISTSIZE=10000 记录最近10000条命令"
|
||
echo " - HISTFILESIZE=10000 历史文件保存10000条命令"
|
||
exit 1
|
||
|
||
# 4.2 开启安全日志记录功能
|
||
# 要求：必须开启系统安全日志记录功能，通过syslog服务（如rsyslog）捕获发送给AUTHPRIV Facility的消息，包括用户登录、权限变更、密码修改等关键安全事件，并将其记录至/var/log/secure日志文件中
|
||
- id: "security_log_recording"
|
||
category: "日志审计"
|
||
title: "开启安全日志记录功能"
|
||
description: "必须开启系统安全日志记录功能，通过syslog服务（如rsyslog）捕获发送给AUTHPRIV Facility的消息，包括用户登录、权限变更、密码修改等关键安全事件，并将其记录至/var/log/secure日志文件中，为安全审计和事件追溯提供依据"
|
||
tags: ["low", "medium", "high", "audit", "log"]
|
||
check_script: |
|
||
# 检查rsyslog安全日志记录功能
|
||
# 要求：rsyslog配置文件中必须包含 authpriv.* /var/log/secure 配置
|
||
# 使用 || true 避免命令失败时导致脚本退出（set -e模式下）
|
||
|
||
config_ok=false
|
||
log_file_ok=false
|
||
service_ok=false
|
||
|
||
# 检查rsyslog配置文件
|
||
rsyslog_conf="/etc/rsyslog.conf"
|
||
config_found=false
|
||
config_correct=false
|
||
config_line=""
|
||
|
||
# 检查主配置文件
|
||
if [ -f "$rsyslog_conf" ]; then
|
||
# 查找authpriv配置行（排除注释和none配置）
|
||
authpriv_lines=$(grep -E "^[^#]*authpriv" "$rsyslog_conf" 2>/dev/null | grep -v "authpriv.none" || true)
|
||
|
||
if [ -n "$authpriv_lines" ]; then
|
||
config_found=true
|
||
# 检查是否包含 /var/log/secure
|
||
if echo "$authpriv_lines" | grep -qE "authpriv\.\*\s+/var/log/secure"; then
|
||
config_correct=true
|
||
config_line=$(echo "$authpriv_lines" | grep -E "authpriv\.\*\s+/var/log/secure" | head -1 | tr -s ' ' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
|
||
fi
|
||
fi
|
||
|
||
# 也检查include的配置文件
|
||
if [ "$config_correct" = false ]; then
|
||
include_files=$(grep -E "^\\$IncludeConfig|^include" "$rsyslog_conf" 2>/dev/null | awk '{print $2}' || true)
|
||
for include_file in $include_files; do
|
||
if [ -f "$include_file" ]; then
|
||
authpriv_lines=$(grep -E "^[^#]*authpriv" "$include_file" 2>/dev/null | grep -v "authpriv.none" || true)
|
||
if [ -n "$authpriv_lines" ]; then
|
||
config_found=true
|
||
if echo "$authpriv_lines" | grep -qE "authpriv\.\*\s+/var/log/secure"; then
|
||
config_correct=true
|
||
config_line=$(echo "$authpriv_lines" | grep -E "authpriv\.\*\s+/var/log/secure" | head -1 | tr -s ' ' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
|
||
break
|
||
fi
|
||
fi
|
||
fi
|
||
done
|
||
fi
|
||
else
|
||
echo "WARN: rsyslog配置文件 $rsyslog_conf 不存在"
|
||
fi
|
||
|
||
# 检查安全日志文件
|
||
secure_log="/var/log/secure"
|
||
if [ -f "$secure_log" ]; then
|
||
log_file_ok=true
|
||
# 检查文件是否有内容（至少大于0字节）
|
||
if [ -s "$secure_log" ]; then
|
||
log_file_ok=true
|
||
else
|
||
log_file_ok=false
|
||
fi
|
||
else
|
||
log_file_ok=false
|
||
fi
|
||
|
||
# 检查rsyslog服务状态
|
||
if command -v systemctl >/dev/null 2>&1; then
|
||
if systemctl is-active rsyslog >/dev/null 2>&1; then
|
||
service_ok=true
|
||
else
|
||
service_ok=false
|
||
fi
|
||
elif command -v service >/dev/null 2>&1; then
|
||
if service rsyslog status >/dev/null 2>&1; then
|
||
service_ok=true
|
||
else
|
||
service_ok=false
|
||
fi
|
||
else
|
||
# 无法检查服务状态，假设服务正常
|
||
service_ok=true
|
||
fi
|
||
|
||
# 输出检查结果
|
||
echo "检查安全日志记录功能:"
|
||
echo ""
|
||
|
||
echo "1. rsyslog配置检查:"
|
||
if [ "$config_correct" = true ]; then
|
||
echo " 配置状态: 已正确配置"
|
||
if [ -n "$config_line" ]; then
|
||
echo " 配置内容: $config_line"
|
||
fi
|
||
config_ok=true
|
||
elif [ "$config_found" = true ]; then
|
||
echo " 配置状态: 已配置但路径不正确"
|
||
echo " 当前配置: $authpriv_lines"
|
||
echo " 要求配置: authpriv.* /var/log/secure"
|
||
config_ok=false
|
||
else
|
||
echo " 配置状态: 未配置"
|
||
echo " 要求配置: authpriv.* /var/log/secure"
|
||
config_ok=false
|
||
fi
|
||
|
||
echo ""
|
||
echo "2. 安全日志文件检查:"
|
||
if [ "$log_file_ok" = true ]; then
|
||
log_size=$(stat -c "%s" "$secure_log" 2>/dev/null || echo "0")
|
||
log_mtime=$(stat -c "%y" "$secure_log" 2>/dev/null || echo "未知")
|
||
echo " 文件状态: 存在且有内容"
|
||
echo " 文件大小: ${log_size} 字节"
|
||
echo " 最后修改: $log_mtime"
|
||
else
|
||
echo " 文件状态: 不存在或为空"
|
||
echo " 文件路径: $secure_log"
|
||
fi
|
||
|
||
echo ""
|
||
echo "3. rsyslog服务状态:"
|
||
if [ "$service_ok" = true ]; then
|
||
echo " 服务状态: 运行中"
|
||
else
|
||
echo " 服务状态: 未运行"
|
||
fi
|
||
|
||
echo ""
|
||
|
||
# 综合判断
|
||
if [ "$config_ok" = true ] && [ "$log_file_ok" = true ] && [ "$service_ok" = true ]; then
|
||
echo "PASS: 安全日志记录功能已正确开启"
|
||
echo ""
|
||
echo "建议: 确保rsyslog服务开机自启: systemctl enable rsyslog"
|
||
exit 0
|
||
elif [ "$config_ok" = true ] && [ "$service_ok" = true ] && [ "$log_file_ok" = false ]; then
|
||
echo "FAIL: rsyslog配置正确但安全日志文件不存在或为空"
|
||
echo ""
|
||
echo "可能原因:"
|
||
echo " 1. 服务刚启动，尚未有日志记录"
|
||
echo " 2. 日志文件路径配置错误"
|
||
echo " 3. 文件权限问题导致无法写入"
|
||
echo ""
|
||
echo "建议: 执行测试操作（如切换用户）后再次检查"
|
||
exit 1
|
||
elif [ "$config_ok" = false ] && [ "$service_ok" = true ]; then
|
||
echo "FAIL: rsyslog服务运行中但未正确配置安全日志记录"
|
||
echo ""
|
||
echo "建议: 编辑 /etc/rsyslog.conf，添加以下配置:"
|
||
echo " authpriv.* /var/log/secure"
|
||
echo " 然后重启服务: systemctl restart rsyslog"
|
||
exit 1
|
||
elif [ "$service_ok" = false ]; then
|
||
echo "FAIL: rsyslog服务未运行"
|
||
echo ""
|
||
echo "建议: 启动rsyslog服务: systemctl start rsyslog"
|
||
echo " 设置开机自启: systemctl enable rsyslog"
|
||
exit 1
|
||
else
|
||
echo "FAIL: 安全日志记录功能未正确配置"
|
||
echo ""
|
||
echo "建议:"
|
||
echo " 1. 编辑 /etc/rsyslog.conf，添加: authpriv.* /var/log/secure"
|
||
echo " 2. 启动rsyslog服务: systemctl start rsyslog"
|
||
echo " 3. 设置开机自启: systemctl enable rsyslog"
|
||
exit 1
|
||
fi
|
||
fix_script: |
|
||
echo "此问题需要人工干预，请根据检查结果执行以下操作："
|
||
echo ""
|
||
echo "1. 编辑rsyslog配置文件: vi /etc/rsyslog.conf"
|
||
echo " 在文件中添加或修改以下配置项:"
|
||
echo " authpriv.* /var/log/secure"
|
||
echo ""
|
||
echo "2. 保存文件后，重启rsyslog服务使配置生效:"
|
||
echo " systemctl restart rsyslog"
|
||
echo ""
|
||
echo "3. 设置rsyslog服务开机自启:"
|
||
echo " systemctl enable rsyslog"
|
||
echo ""
|
||
echo "4. 验证配置效果:"
|
||
echo " grep -E 'authpriv.*' /etc/rsyslog.conf"
|
||
echo " systemctl status rsyslog"
|
||
echo " ls -l /var/log/secure"
|
||
echo ""
|
||
echo "5. 测试日志记录（可选）:"
|
||
echo " su - testuser # 切换用户"
|
||
echo " tail -f /var/log/secure # 查看日志记录"
|
||
echo ""
|
||
echo "说明:"
|
||
echo " - authpriv.* 表示捕获所有AUTHPRIV Facility的消息"
|
||
echo " - /var/log/secure 是安全日志文件的存储路径"
|
||
echo " - AUTHPRIV Facility用于记录用户登录、权限变更、密码修改等关键安全事件"
|
||
exit 1
|
||
|