# Linux安全实战：防火墙配置与系统漏洞修复指南

## 一、防火墙基础与策略配置

### 1.1 iptables企业级配置模板

```bash

#!/bin/bash

# firewall_setup.sh - 企业级iptables配置

# 定义变量

IP_TABLES="/sbin/iptables"

IP6_TABLES="/sbin/ip6tables"

BACKUP_DIR="/etc/iptables"

LOG_PREFIX="[FIREWALL]"

# 备份现有规则

backup_rules() {

mkdir -p "$BACKUP_DIR"

$IP_TABLES-save > "$BACKUP_DIR/iptables-backup-$(date +%Y%m%d-%H%M%S).rules"

$IP6_TABLES-save > "$BACKUP_DIR/ip6tables-backup-$(date +%Y%m%d-%H%M%S).rules"

echo "$LOG_PREFIX 规则已备份"

}

# 初始化规则链

initialize_firewall() {

# 清除所有现有规则

$IP_TABLES -F

$IP_TABLES -X

$IP_TABLES -Z

# 设置默认策略

$IP_TABLES -P INPUT DROP

$IP_TABLES -P FORWARD DROP

$IP_TABLES -P OUTPUT ACCEPT

echo "$LOG_PREFIX 防火墙初始化完成"

}

# 配置基础规则集

configure_basic_rules() {

# 允许本地回环接口

$IP_TABLES -A INPUT -i lo -j ACCEPT

$IP_TABLES -A OUTPUT -o lo -j ACCEPT

# 允许已建立和相关连接

$IP_TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# 允许ICMP协议（ping等）

$IP_TABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# 记录并拒绝非法数据包

$IP_TABLES -A INPUT -m state --state INVALID -j LOG --log-prefix "INVALID_PACKET: "

$IP_TABLES -A INPUT -m state --state INVALID -j DROP

echo "$LOG_PREFIX 基础规则配置完成"

}

# 配置服务访问规则

configure_service_rules() {

# SSH访问限制（仅允许特定网络）

$IP_TABLES -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH_ATTEMPT: "

$IP_TABLES -A INPUT -p tcp --dport 22 -j DROP

# Web服务（HTTP/HTTPS）

$IP_TABLES -A INPUT -p tcp --dport 80 -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 443 -j ACCEPT

# 数据库服务（限制访问源）

$IP_TABLES -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 5432 -s 10.0.0.0/8 -j ACCEPT

# 监控端口（Prometheus, Node Exporter等）

$IP_TABLES -A INPUT -p tcp --dport 9090 -s 10.0.0.0/8 -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 9100 -s 10.0.0.0/8 -j ACCEPT

echo "$LOG_PREFIX 服务规则配置完成"

}

# 配置暴力破解防护

configure_bruteforce_protection() {

# SSH暴力破解防护

$IP_TABLES -N SSH_PROTECT

$IP_TABLES -A SSH_PROTECT -m recent --set --name SSH

$IP_TABLES -A SSH_PROTECT -m recent --update --seconds 60 --hitcount 4 --name SSH -j LOG --log-prefix "SSH_BRUTEFORCE: "

$IP_TABLES -A SSH_PROTECT -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

$IP_TABLES -A SSH_PROTECT -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 22 -j SSH_PROTECT

# HTTP暴力破解防护

$IP_TABLES -N HTTP_PROTECT

$IP_TABLES -A HTTP_PROTECT -m recent --set --name HTTP

$IP_TABLES -A HTTP_PROTECT -m recent --update --seconds 300 --hitcount 100 --name HTTP -j DROP

$IP_TABLES -A HTTP_PROTECT -j ACCEPT

$IP_TABLES -A INPUT -p tcp --dport 80 -j HTTP_PROTECT

$IP_TABLES -A INPUT -p tcp --dport 443 -j HTTP_PROTECT

echo "$LOG_PREFIX 暴力破解防护配置完成"

}

# 配置日志记录

configure_logging() {

# 记录被拒绝的连接尝试

$IP_TABLES -A INPUT -j LOG --log-prefix "FW_DENIED: " --log-level 4

# 记录端口扫描尝试

$IP_TABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix "PORT_SCAN: "

$IP_TABLES -A INPUT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "NULL_SCAN: "

$IP_TABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "SYN_SCAN: "

echo "$LOG_PREFIX 日志记录配置完成"

}

# 保存并应用规则

apply_rules() {

# 保存IPv4规则

$IP_TABLES-save > /etc/iptables/rules.v4

# 配置IPv6（通常建议禁用或严格限制）

$IP6_TABLES -P INPUT DROP

$IP6_TABLES -P FORWARD DROP

$IP6_TABLES -P OUTPUT ACCEPT

$IP6_TABLES -A INPUT -i lo -j ACCEPT

$IP6_TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IP6_TABLES-save > /etc/iptables/rules.v6

# 配置持久化

cat > /etc/network/if-pre-up.d/iptables << 'EOF'

#!/bin/sh

/sbin/iptables-restore < /etc/iptables/rules.v4

/sbin/ip6tables-restore < /etc/iptables/rules.v6

EOF

chmod +x /etc/network/if-pre-up.d/iptables

echo "$LOG_PREFIX 规则已保存并应用"

}

# 主执行流程

main() {

echo "开始配置企业级防火墙"

backup_rules

initialize_firewall

configure_basic_rules

configure_service_rules

configure_bruteforce_protection

configure_logging

apply_rules

echo "防火墙配置完成"

}

main

```

## 二、nftables现代化配置

### 2.1 nftables企业配置示例

```bash

#!/bin/bash

# nftables_enterprise.nft

#!/usr/sbin/nft -f

# 清空现有规则

flush ruleset

# 定义变量和集合

define management_networks = { 10.0.0.0/8, 192.168.1.0/24 }

define web_servers = { 10.0.1.10, 10.0.1.11 }

define database_servers = { 10.0.2.10, 10.0.2.11 }

# 创建表

table inet filter {

# 定义集合：记录SSH攻击IP

set ssh_attackers {

type ipv4_addr

flags timeout

timeout 1h

}

# 定义集合：记录端口扫描IP

set port_scanners {

type ipv4_addr

flags timeout

timeout 24h

}

# 定义链

chain input {

type filter hook input priority 0; policy drop;

# 基础规则

iif "lo" accept

ct state established,related accept

ct state invalid drop

# ICMP限制

ip protocol icmp icmp type echo-request limit rate 1/second accept

# SSH访问控制

tcp dport 22 ip saddr $management_networks accept

tcp dport 22 ip saddr @ssh_attackers drop

tcp dport 22 limit rate 3/minute burst 5 packets add @ssh_attackers { ip saddr } accept

# Web服务

tcp dport { 80, 443 } accept

# 数据库服务（内部访问）

tcp dport { 3306, 5432 } ip saddr $database_servers accept

# 监控端口

tcp dport { 9090, 9100 } ip saddr $management_networks accept

# 记录拒绝的连接

log prefix "nft_denied: " group 1

}

chain forward {

type filter hook forward priority 0; policy drop;

}

chain output {

type filter hook output priority 0; policy accept;

}

# 自定义链：端口扫描检测

chain portscan_detect {

# 检测NULL扫描

tcp flags & (fin|syn|rst|psh|ack|urg) == 0 add @port_scanners { ip saddr }

# 检测XMAS扫描

tcp flags & (fin|psh|urg) == fin|psh|urg add @port_scanners { ip saddr }

# 记录扫描尝试

ip saddr @port_scanners log prefix "Port_Scan_Detected: " accept

}

# 应用配置

nft -f nftables_enterprise.nft

# 保存配置

nft list ruleset > /etc/nftables.conf

# 配置系统服务

systemctl enable nftables

systemctl start nftables

```

### 2.2 nftables监控脚本

```bash

#!/bin/bash

# nftables_monitor.sh

LOG_FILE="/var/log/nftables_monitor.log"

ALERT_THRESHOLD=100

monitor_nftables() {

while true; do

TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# 获取当前连接统计

CONN_STATS=$(nft list ruleset | grep -E "counter packets|bytes")

# 获取被阻止的IP数量

BLOCKED_IPS=$(nft list set inet filter ssh_attackers 2>/dev/null | grep -c "elements =")

# 记录到日志

echo "[$TIMESTAMP] 连接统计:" >> "$LOG_FILE"

echo "$CONN_STATS" >> "$LOG_FILE"

echo "被阻止IP数量: $BLOCKED_IPS" >> "$LOG_FILE"

# 检查阈值

if [ "$BLOCKED_IPS" -gt "$ALERT_THRESHOLD" ]; then

send_alert "nftables blocked IPs threshold exceeded: $BLOCKED_IPS"

fi

# 分析日志中的攻击模式

analyze_attack_patterns

sleep 300 # 每5分钟检查一次

done

}

analyze_attack_patterns() {

# 分析过去一小时的日志

PATTERN_LOG="/tmp/attack_patterns_$(date +%Y%m%d_%H).log"

journalctl -u nftables --since "1 hour ago" | \

grep -E "Port_Scan_Detected|SSH_ATTEMPT" > "$PATTERN_LOG"

# 统计攻击源

ATTACK_SOURCES=$(awk '{print $NF}' "$PATTERN_LOG" | sort | uniq -c | sort -rn)

if [ -s "$PATTERN_LOG" ]; then

echo "攻击模式分析 ($(date)):" >> "$LOG_FILE"

echo "$ATTACK_SOURCES" >> "$LOG_FILE"

fi

}

send_alert() {

local message="$1"

echo "[ALERT] $message" >> "$LOG_FILE"

# 发送邮件告警

echo "$message" | mail -s "防火墙安全告警" admin@example.com

# 可集成到其他告警系统

# curl -X POST https://alerts.example.com -d "message=$message"

}

# 主程序

case "${1:-}" in

start)

monitor_nftables

;;

analyze)

analyze_attack_patterns

;;

status)

nft list ruleset

;;

*)

echo "用法: $0 {start|analyze|status}"

exit 1

;;

esac

```

## 三、系统漏洞扫描与修复

### 3.1 自动化漏洞扫描脚本

```bash

#!/bin/bash

# vulnerability_scanner.sh

SCAN_DIR="/var/log/security_scans"

REPORT_FILE="$SCAN_DIR/vulnerability_report_$(date +%Y%m%d).html"

LOG_FILE="$SCAN_DIR/scan_$(date +%Y%m%d).log"

# 创建目录

mkdir -p "$SCAN_DIR"

# 初始化报告

init_report() {

cat > "$REPORT_FILE" << 'EOF'

<!DOCTYPE html>

<html>

<head>

<title>安全扫描报告 - $(date)</title>

<style>

body { font-family: Arial, sans-serif; margin: 20px; }

.critical { color: #d9534f; font-weight: bold; }

.high { color: #f0ad4e; }

.medium { color: #5bc0de; }

.low { color: #5cb85c; }

table { border-collapse: collapse; width: 100%; }

th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }

th { background-color: #f2f2f2; }

</style>

</head>

<body>

<h1>系统安全扫描报告</h1>

<p>主机名: $(hostname)</p>

EOF

}

# 检查系统更新

check_updates() {

echo "检查系统更新..." | tee -a "$LOG_FILE"

if [ -f /etc/debian_version ]; then

apt update 2>&1 | tee -a "$LOG_FILE"

UPDATES=$(apt list --upgradable 2>/dev/null | grep -c upgradable)

cat >> "$REPORT_FILE" << EOF

<h2>系统更新检查</h2>

<p>可用更新: $UPDATES 个</p>

EOF

if [ "$UPDATES" -gt 0 ]; then

echo "发现 $UPDATES 个待安装更新" | tee -a "$LOG_FILE"

apt list --upgradable >> "$LOG_FILE"

fi

}

# 检查SUID/SGID异常文件

check_suid_sgid() {

echo "检查SUID/SGID文件..." | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << 'EOF'

<h2>SUID/SGID文件检查</h2>

EOF

# 查找异常SUID文件

find / -type f -perm /4000 2>/dev/null | while read -r file; do

if [ ! -f "/usr/bin/basename" ] || \

echo "可疑SUID文件: $file" | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << EOF

<p class="high">可疑SUID文件: $file</p>

EOF

fi

done

# 查找异常SGID文件

find / -type f -perm /2000 2>/dev/null | while read -r file; do

echo "SGID文件: $file" >> "$LOG_FILE"

done

}

# 检查SSH配置

check_ssh_config() {

echo "检查SSH配置..." | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << 'EOF'

<h2>SSH配置检查</h2>

EOF

SSH_CONFIG="/etc/ssh/sshd_config"

# 检查Protocol版本

if grep -q "^Protocol 1" "$SSH_CONFIG"; then

echo "SSH协议版本1已启用（不安全）" | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << EOF

<p class="critical">SSH协议版本1已启用（不安全）</p>

EOF

fi

# 检查密码认证

if grep -q "^PasswordAuthentication yes" "$SSH_CONFIG"; then

echo "密码认证已启用（建议使用密钥认证）" | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << EOF

<p class="medium">密码认证已启用（建议使用密钥认证）</p>

EOF

fi

# 检查Root登录

if grep -q "^PermitRootLogin yes" "$SSH_CONFIG"; then

echo "Root登录已启用（不安全）" | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << EOF

<p class="critical">Root登录已启用（不安全）</p>

EOF

fi

}

# 检查文件权限

check_file_permissions() {

echo "检查关键文件权限..." | tee -a "$LOG_FILE"

cat >> "$REPORT_FILE" << 'EOF'

<h2>文件权限检查</h2>

EOF

# 关键文件列表

critical_files=(

"/etc/passwd"

"/etc/shadow"

"/etc/group"

"/etc/sudoers"

"/etc/ssh/sshd_config"

)

for file in "${critical_files[@]}"; do

if [ -f "$file" ]; then

perms=$(stat -c "%a %U %G" "$file")

echo "$file 权限: $perms" >> "$LOG_FILE"

# 检查shadow文件权限

if [ "$file" = "/etc/shadow" ] && [ "$(stat -c %a "$file")" != "640" ]; then

cat >> "$REPORT_FILE" << EOF

<p class="critical">$file 权限异常: $perms (应为640)</p>

<"wuda.csxthr.com"><"nbl.zhaiLimao.com"><"gzi.yunruiwater.cn">

EOF

fi

done

}

# 运行Lynis审计

run_lynis_audit() {

echo "运行Lynis安全审计..." | tee -a "$LOG_FILE"

if command -v lynis >/dev/null 2>&1; then

lynis audit system --quick 2>&1 | tee -a "$LOG_FILE"

# 提取关键发现

lynis audit system --quick | grep -E "\[WARNING\]|\[SUGGESTION\]" > "$SCAN_DIR/lynis_findings.txt"

cat >> "$REPORT_FILE" << EOF

<h2>Lynis审计结果</h2>

<pre>

$(cat "$SCAN_DIR/lynis_findings.txt")

</pre>

EOF

else

echo "Lynis未安装，跳过审计" | tee -a "$LOG_FILE"

fi

}

# 生成报告摘要

generate_summary() {

cat >> "$REPORT_FILE" << 'EOF'

<h2>修复建议摘要</h2>

<ol>

<li>及时安装系统安全更新</li>

<li>禁用不必要的SUID/SGID权限</li>

<li>配置SSH使用密钥认证并禁用root登录</li>

<li>定期审计系统日志</li>

<li>配置防火墙限制不必要的端口访问</li>

</ol>

</body>

</html>

EOF

echo "扫描完成，报告已生成: $REPORT_FILE" | tee -a "$LOG_FILE"

}

# 主函数

main() {

echo "开始系统安全扫描" | tee -a "$LOG_FILE"

init_report

check_updates

check_suid_sgid

check_ssh_config

check_file_permissions

run_lynis_audit

generate_summary

echo "扫描报告: $REPORT_FILE" | tee -a "$LOG_FILE"

}

main

```

## 四、自动化补丁管理

### 4.1 安全更新自动化脚本

```bash

#!/bin/bash

# security_patch_manager.sh

CONFIG_FILE="/etc/security_patch.conf"

LOG_FILE="/var/log/security_patches.log"

BACKUP_DIR="/var/backups/pre_patch"

# 加载配置

load_config() {

if [ -f "$CONFIG_FILE" ]; then

source "$CONFIG_FILE"

else

# 默认配置

ENABLE_AUTO_PATCH=false

PATCH_DAY="Sunday"

PATCH_TIME="02:00"

REBOOT_REQUIRED=false

NOTIFY_EMAIL="admin@example.com"

EXCLUDE_PACKAGES=""

fi

}

# 预补丁检查

pre_patch_check() {

echo "[$(date)] 开始预补丁检查" | tee -a "$LOG_FILE"

# 检查磁盘空间

DISK_USAGE=$(df / --output=pcent | tail -1 | tr -d '% ')

if [ "$DISK_USAGE" -gt 90 ]; then

echo "磁盘空间不足: ${DISK_USAGE}%" | tee -a "$LOG_FILE"

return 1

fi

# 备份重要配置

mkdir -p "$BACKUP_DIR/$(date +%Y%m%d)"

cp -r /etc/apt/ "$BACKUP_DIR/$(date +%Y%m%d)/apt/"

cp -r /etc/yum/ "$BACKUP_DIR/$(date +%Y%m%d)/yum/" 2>/dev/null || true

# 检查当前服务状态

systemctl list-units --type=service --state=running > "$BACKUP_DIR/$(date +%Y%m%d)/services_before.txt"

return 0

}

# 应用安全更新

apply_security_updates() {

echo "[$(date)] 开始应用安全更新" | tee -a "$LOG_FILE"

if [ -f /etc/debian_version ]; then

# Debian/Ubuntu系统

apt-get update 2>&1 | tee -a "$LOG_FILE"

# 仅安装安全更新

apt-get upgrade --only-upgrade -y 2>&1 | tee -a "$LOG_FILE"

# 清理旧内核

apt-get autoremove --purge -y 2>&1 | tee -a "$LOG_FILE"

elif [ -f /etc/redhat-release ]; then

# RHEL/CentOS系统

yum update --security -y 2>&1 | tee -a "$LOG_FILE"

# 清理缓存

yum clean all 2>&1 | tee -a "$LOG_FILE"

fi

echo "[$(date)] 安全更新完成" | tee -a "$LOG_FILE"

}

# 后补丁验证

post_patch_verification() {

echo "[$(date)] 开始后补丁验证" | tee -a "$LOG_FILE"

# 检查关键服务状态

critical_services=("ssh" "nginx" "mysql" "postgresql")

for service in "${critical_services[@]}"; do

if systemctl is-active --quiet "$service"; then

echo "服务 $service 运行正常" | tee -a "$LOG_FILE"

else

echo "警告: 服务 $service 未运行" | tee -a "$LOG_FILE"

systemctl restart "$service" 2>&1 | tee -a "$LOG_FILE"

fi

done

# 生成更新报告

generate_patch_report

}

# 生成补丁报告

generate_patch_report() {

REPORT_FILE="/var/log/patch_report_$(date +%Y%m%d).txt"

{

echo "系统补丁报告"

echo "生成时间: $(date)"

echo "主机名: $(hostname)"

echo

echo "更新的包:"

if [ -f /var/log/apt/history.log ]; then

grep "upgrade" /var/log/apt/history.log | tail -5

fi

echo

echo "当前内核版本: $(uname -r)"

echo "系统启动时间: $(uptime -s)"

echo

echo "需要重启: $(needs-restarting -r 2>/dev/null || echo '未知')"

} > "$REPORT_FILE"

# 发送报告

if [ -n "$NOTIFY_EMAIL" ]; then

mail -s "系统补丁报告 $(date)" "$NOTIFY_EMAIL" < "$REPORT_FILE"

fi

}

# 主函数

main() {

load_config

if ! pre_patch_check; then

echo "预补丁检查失败，中止操作" | tee -a "$LOG_FILE"

exit 1

fi

apply_security_updates

post_patch_verification

# 根据配置决定是否重启

if [ "$REBOOT_REQUIRED" = true ]; then

echo "计划重启系统..." | tee -a "$LOG_FILE"

shutdown -r +10 "系统将在10分钟后重启以应用更新"

fi

}

# 计划任务配置示例

setup_cron_job() {

cat > /etc/cron.d/security_patches << 'EOF'

# 每周日凌晨2点运行安全更新

0 2 * * 0 root /usr/local/bin/security_patch_manager.sh >> /var/log/security_patches.log 2>&1

# 每天检查安全公告

30 8 * * * root /usr/local/bin/security_advisory_check.sh

EOF

}

main

```

## 五、合规性检查脚本

### 5.1 CIS基准检查脚本

```bash

#!/bin/bash

# cis_compliance_check.sh

REPORT_DIR="/var/log/cis_compliance"

HTML_REPORT="$REPORT_DIR/cis_report_$(date +%Y%m%d).html"

CSV_REPORT="$REPORT_DIR/cis_report_$(date +%Y%m%d).csv"

# 初始化报告

init_reports() {

mkdir -p "$REPORT_DIR"

# HTML报告头部

cat > "$HTML_REPORT" << 'EOF'

<!DOCTYPE html>

<html>

<head>

<title>CIS合规性检查报告</title>

<style>

body { font-family: Arial, sans-serif; margin: 20px; }

.pass { color: green; }

.fail { color: red; }

.warning { color: orange; }

table { border-collapse: collapse; width: 100%; margin-top: 20px; }

th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }

th { background-color: #4CAF50; color: white; }

tr:nth-child(even) { background-color: #f2f2f2; }

</style>

</head>

<body>

<h1>CIS Linux基准合规性检查报告</h1>

<p>主机名: $(hostname)</p>

<table>

<tr>

</tr>

EOF

# CSV报告头部

echo "Section,Check,Status,Details,Recommendation" > "$CSV_REPORT"

}

# 检查1: 初始设置 - 文件系统配置

check_filesystem_config() {

echo "检查文件系统配置..."

# 检查/tmp挂载选项

if mount | grep -q " /tmp "; then

TMP_OPTIONS=$(mount | grep " /tmp " | grep -o "nodev,nosuid,noexec")

if [[ "$TMP_OPTIONS" == *"nodev"* && "$TMP_OPTIONS" == *"nosuid"* && "$TMP_OPTIONS" == *"noexec"* ]]; then

add_report "1.1.2" "PASS" "/tmp挂载配置正确" "/tmp已正确配置nodev,nosuid,noexec选项"

else

add_report "1.1.2" "FAIL" "/tmp挂载配置不正确" "建议修改/etc/fstab，为/tmp添加nodev,nosuid,noexec选项"

fi

}

# 检查2: 服务配置 - SSH

check_ssh_config() {

echo "检查SSH配置..."

# 检查Protocol版本

SSH_PROTOCOL=$(grep -i "^Protocol" /etc/ssh/sshd_config | awk '{print $2}')

if [ "$SSH_PROTOCOL" = "2" ]; then

add_report "5.2.2" "PASS" "SSH协议版本正确" "SSH配置为使用协议版本2"

else

add_report "5.2.2" "FAIL" "SSH协议版本不正确" "建议在/etc/ssh/sshd_config中设置Protocol 2"

fi

# 检查X11转发

if grep -q "^X11Forwarding no" /etc/ssh/sshd_config; then

add_report "5.2.5" "PASS" "X11转发已禁用" "SSH X11转发功能已正确禁用"

else

add_report "5.2.5" "FAIL" "X11转发未禁用" "建议在/etc/ssh/sshd_config中设置X11Forwarding no"

fi

}

# 检查3: 网络配置 - 防火墙

check_firewall_config() {

echo "检查防火墙配置..."

# 检查是否启用防火墙

if systemctl is-active --quiet iptables || systemctl is-active --quiet nftables || systemctl is-active --quiet firewalld; then

add_report "3.5.1" "PASS" "防火墙服务运行中" "系统防火墙服务已启用"

else

add_report "3.5.1" "FAIL" "防火墙服务未运行" "建议启用并配置系统防火墙"

fi

}

# 检查4: 日志与审计

check_audit_config() {

echo "检查审计配置..."

# 检查auditd服务

if systemctl is-active --quiet auditd; then

add_report "4.1.1" "PASS" "审计服务运行中" "auditd服务已启用"

else

add_report "4.1.1" "FAIL" "审计服务未运行" "建议安装并启用auditd服务"

fi

# 检查系统日志配置

if [ -f /etc/rsyslog.conf ] || [ -f /etc/syslog.conf ]; then

add_report "4.2.1" "PASS" "系统日志配置存在" "系统日志服务已配置"

<"gzu.sxyicheng.cn"><"wzu.jsnjz.cn"><"wzi.csxthr.com"><"wss.zhaiLimao.com">

else

add_report "4.2.1" "FAIL" "系统日志配置缺失" "建议配置系统日志服务"

fi

}

# 添加检查结果到报告

add_report() {

local section="$1"

local status="$2"

local details="$3"

local recommendation="$4"

# 添加到HTML报告

cat >> "$HTML_REPORT" << EOF

<tr>

<td>$section</td>

<td class="$status">$status</td>

<td>$details</td>

<td>$recommendation</td>

</tr>

EOF

# 添加到CSV报告

echo "$section,$status,$details,$recommendation" >> "$CSV_REPORT"

}

# 生成报告摘要

generate_summary() {

TOTAL_CHECKS=$(grep -c "<tr>" "$HTML_REPORT")

PASS_CHECKS=$(grep -c "class=\"pass\"" "$HTML_REPORT")

FAIL_CHECKS=$(grep -c "class=\"fail\"" "$HTML_REPORT")

WARNING_CHECKS=$(grep -c "class=\"warning\"" "$HTML_REPORT")

cat >> "$HTML_REPORT" << EOF

</table>

<p>总检查数: $TOTAL_CHECKS</p>

<p class="pass">通过: $PASS_CHECKS</p>

<p class="fail">失败: $FAIL_CHECKS</p>

<p class="warning">警告: $WARNING_CHECKS</p>

<h2>合规性分数</h2>

<p>整体合规率: $((PASS_CHECKS * 100 / TOTAL_CHECKS))%</p>

<h2>立即修复建议</h2>

<ol>

EOF

# 提取失败的检查项建议

grep "class=\"fail\"" "$HTML_REPORT" | sed 's/.*<td>$.*$<\/td>.*<td>$.*$<\/td>.*<td>$.*$<\/td>.*/\1. \3/' | \

while read -r line; do

echo " <li>$line</li>" >> "$HTML_REPORT"

done

cat >> "$HTML_REPORT" << 'EOF'

</ol>

</body>

</html>

EOF

}

# 主函数

main() {

echo "开始CIS合规性检查"

init_reports

check_filesystem_config

check_ssh_config

check_firewall_config

check_audit_config

generate_summary

echo "检查完成，报告位置:"

echo " HTML报告: $HTML_REPORT"

echo " CSV报告: $CSV_REPORT"

}

main

```

## 六、实时监控与告警

### 6.1 安全事件监控脚本

```bash

#!/bin/bash

# security_monitor.sh

LOG_DIR="/var/log/security_monitor"

ALERT_LOG="$LOG_DIR/alerts.log"

CONFIG_FILE="/etc/security_monitor.conf"

# 监控配置

load_config() {

# 默认配置

MONITOR_PORTS="22,80,443,3306,5432"

ALERT_THRESHOLD=10

ALERT_EMAIL="security@example.com"

SLACK_WEBHOOK=""

if [ -f "$CONFIG_FILE" ]; then

source "$CONFIG_FILE"

fi

}

# 监控可疑连接

monitor_suspicious_connections() {

echo "[$(date)] 开始监控可疑连接" >> "$ALERT_LOG"

# 监控失败登录尝试

FAILED_LOGINS=$(grep "Failed password" /var/log/auth.log | wc -l)

if [ "$FAILED_LOGINS" -gt "$ALERT_THRESHOLD" ]; then

send_alert "high" "检测到大量失败登录

ITPub博客

Linux安全实战：防火墙配置与系统漏洞修复指南

最新文章