Linux 服務器日常巡檢腳本分享
https://mp.weixin.qq.com/s/zWB4AMqGnytY7y61mom2vw
Linux 系統日常巡檢腳本，巡檢內容包含了，磁盤，內存 cpu 進程 文件更改 用戶登錄等一系列的操作 直接用就行了。
報告以郵件發送到郵箱 在log下生成巡檢報告。
#!/bin/bash # @Author: HanWei # @Date: 2020-03-16 09:56:57 # @Last Modified by: HanWei # @Last Modified time: 2020-03-16 11:06:31 # @E-mail: han_wei_95@163.com #!/bin/bash #主機信息每日巡檢 IPADDR=$(ifconfig eth0|grep 'inet addr'|awk -F '[ :]' '{print $13}') #環境變量PATH沒設好，在cron里執行時有很多命令會找不到 export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin source /etc/profile [ $(id -u) -gt 0 ] && echo "請用root用戶執行此腳本！" && exit 1 centosVersion=$(awk '{print $(NF-1)}' /etc/redhat-release) VERSION="2020-03-16" #日志相關 PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'` [ -f $PROGPATH ] && PROGPATH="." LOGPATH="$PROGPATH/log" [ -e $LOGPATH ] || mkdir $LOGPATH RESULTFILE="$LOGPATH/HostDailyCheck-$IPADDR-`date +%Y%m%d`.txt" #定義報表的全局變量 report_DateTime="" #日期 ok report_Hostname="" #主機名 ok report_OSRelease="" #發行版本 ok report_Kernel="" #內核 ok report_Language="" #語言/編碼 ok report_LastReboot="" #最近啟動時間 ok report_Uptime="" #運行時間（天） ok report_CPUs="" #CPU數量 ok report_CPUType="" #CPU類型 ok report_Arch="" #CPU架構 ok report_MemTotal="" #內存總容量(MB) ok report_MemFree="" #內存剩余(MB) ok report_MemUsedPercent="" #內存使用率% ok report_DiskTotal="" #硬盤總容量(GB) ok report_DiskFree="" #硬盤剩余(GB) ok report_DiskUsedPercent="" #硬盤使用率% ok report_InodeTotal="" #Inode總量 ok report_InodeFree="" #Inode剩余 ok report_InodeUsedPercent="" #Inode使用率 ok report_IP="" #IP地址 ok report_MAC="" #MAC地址 ok report_Gateway="" #默認網關 ok report_DNS="" #DNS ok report_Listen="" #監聽 ok report_Selinux="" #Selinux ok report_Firewall="" #防火牆 ok report_USERs="" #用戶 ok report_USEREmptyPassword="" #空密碼用戶 ok report_USERTheSameUID="" #相同ID的用戶 ok report_PasswordExpiry="" #密碼過期（天） ok report_RootUser="" #root用戶 ok report_Sudoers="" #sudo授權 ok report_SSHAuthorized="" #SSH信任主機 ok report_SSHDProtocolVersion="" #SSH協議版本 ok report_SSHDPermitRootLogin="" #允許root遠程登錄 ok report_DefunctProsess="" #僵屍進程數量 ok report_SelfInitiatedService="" #自啟動服務數量 ok report_SelfInitiatedProgram="" #自啟動程序數量 ok report_RuningService="" #運行中服務數 ok report_Crontab="" #計划任務數 ok report_Syslog="" #日志服務 ok report_SNMP="" #SNMP OK report_NTP="" #NTP ok report_JDK="" #JDK版本 ok function version(){ echo "" echo "" echo "系統巡檢腳本：Version $VERSION" } function getCpuStatus(){ echo "" echo "" echo "############################ CPU檢查 #############################" Physical_CPUs=$(grep "physical id" /proc/cpuinfo| sort | uniq | wc -l) Virt_CPUs=$(grep "processor" /proc/cpuinfo | wc -l) CPU_Kernels=$(grep "cores" /proc/cpuinfo|uniq| awk -F ': ' '{print $2}') CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq) CPU_Arch=$(uname -m) echo "物理CPU個數:$Physical_CPUs" echo "邏輯CPU個數:$Virt_CPUs" echo "每CPU核心數:$CPU_Kernels" echo " CPU型號:$CPU_Type" echo " CPU架構:$CPU_Arch" #報表信息 report_CPUs=$Virt_CPUs #CPU數量 report_CPUType=$CPU_Type #CPU類型 report_Arch=$CPU_Arch #CPU架構 } function getMemStatus(){ echo "" echo "" echo "############################ 內存檢查 ############################" if [[ $centosVersion < 7 ]];then free -mo else free -h fi #報表信息 MemTotal=$(grep MemTotal /proc/meminfo| awk '{print $2}') #KB MemFree=$(grep MemFree /proc/meminfo| awk '{print $2}') #KB let MemUsed=MemTotal-MemFree MemPercent=$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}") report_MemTotal="$((MemTotal/1024))""MB" #內存總容量(MB) report_MemFree="$((MemFree/1024))""MB" #內存剩余(MB) report_MemUsedPercent="$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}")""%" #內存使用率% } function getDiskStatus(){ echo "" echo "" echo "############################ 磁盤檢查 ############################" df -hiP | sed 's/Mounted on/Mounted/'> /tmp/inode df -hTP | sed 's/Mounted on/Mounted/'> /tmp/disk join /tmp/disk /tmp/inode | awk '{print $1,$2,"|",$3,$4,$5,$6,"|",$8,$9,$10,$11,"|",$12}'| column -t #報表信息 diskdata=$(df -TP | sed '1d' | awk '$2!="tmpfs"{print}') #KB disktotal=$(echo "$diskdata" | awk '{total+=$3}END{print total}') #KB diskused=$(echo "$diskdata" | awk '{total+=$4}END{print total}') #KB diskfree=$((disktotal-diskused)) #KB diskusedpercent=$(echo $disktotal $diskused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}') inodedata=$(df -iTP | sed '1d' | awk '$2!="tmpfs"{print}') inodetotal=$(echo "$inodedata" | awk '{total+=$3}END{print total}') inodeused=$(echo "$inodedata" | awk '{total+=$4}END{print total}') inodefree=$((inodetotal-inodeused)) inodeusedpercent=$(echo $inodetotal $inodeused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}') report_DiskTotal=$((disktotal/1024/1024))"GB" #硬盤總容量(GB) report_DiskFree=$((diskfree/1024/1024))"GB" #硬盤剩余(GB) report_DiskUsedPercent="$diskusedpercent""%" #硬盤使用率% report_InodeTotal=$((inodetotal/1000))"K" #Inode總量 report_InodeFree=$((inodefree/1000))"K" #Inode剩余 report_InodeUsedPercent="$inodeusedpercent""%" #Inode使用率% } function getSystemStatus(){ echo "" echo "" echo "############################ 系統檢查 ############################" if [ -e /etc/sysconfig/i18n ];then default_LANG="$(grep "LANG=" /etc/sysconfig/i18n | grep -v "^#" | awk -F '"' '{print $2}')" else default_LANG=$LANG fi export LANG="en_US.UTF-8" Release=$(cat /etc/redhat-release 2>/dev/null) Kernel=$(uname -r) OS=$(uname -o) Hostname=$(uname -n) SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}') LastReboot=$(who -b | awk '{print $3,$4}') uptime=$(uptime | sed 's/.*up \([^,]*\), .*/\1/') echo " 系統：$OS" echo " 發行版本：$Release" echo " 內核：$Kernel" echo " 主機名：$Hostname" echo " SELinux：$SELinux" echo "語言/編碼：$default_LANG" echo " 當前時間：$(date +'%F %T')" echo " 最后啟動：$LastReboot" echo " 運行時間：$uptime" #報表信息 report_DateTime=$(date +"%F %T") #日期 report_Hostname="$Hostname" #主機名 report_OSRelease="$Release" #發行版本 report_Kernel="$Kernel" #內核 report_Language="$default_LANG" #語言/編碼 report_LastReboot="$LastReboot" #最近啟動時間 report_Uptime="$uptime" #運行時間（天） report_Selinux="$SELinux" export LANG="$default_LANG" } function getServiceStatus(){ echo "" echo "" echo "############################ 服務檢查 ############################" echo "" if [[ $centosVersion > 7 ]];then conf=$(systemctl list-unit-files --type=service --state=enabled --no-pager | grep "enabled") process=$(systemctl list-units --type=service --state=running --no-pager | grep ".service") #報表信息 report_SelfInitiatedService="$(echo "$conf" | wc -l)" #自啟動服務數量 report_RuningService="$(echo "$process" | wc -l)" #運行中服務數量 else conf=$(/sbin/chkconfig | grep -E ":on|:啟用") process=$(/sbin/service --status-all 2>/dev/null | grep -E "is running|正在運行") #報表信息 report_SelfInitiatedService="$(echo "$conf" | wc -l)" #自啟動服務數量 report_RuningService="$(echo "$process" | wc -l)" #運行中服務數量 fi echo "服務配置" echo "--------" echo "$conf" | column -t echo "" echo "正在運行的服務" echo "--------------" echo "$process" } function getAutoStartStatus(){ echo "" echo "" echo "############################ 自啟動檢查 ##########################" conf=$(grep -v "^#" /etc/rc.d/rc.local| sed '/^$/d') echo "$conf" #報表信息 report_SelfInitiatedProgram="$(echo $conf | wc -l)" #自啟動程序數量 } function getLoginStatus(){ echo "" echo "" echo "############################ 登錄檢查 ############################" last | head } function getNetworkStatus(){ echo "" echo "" echo "############################ 網絡檢查 ############################" if [[ $centosVersion < 7 ]];then /sbin/ifconfig -a | grep -v packets | grep -v collisions | grep -v inet6 else #ip a for i in $(ip link | grep BROADCAST | awk -F: '{print $2}');do ip add show $i | grep -E "BROADCAST|global"| awk '{print $2}' | tr '\n' ' ' ;echo "" ;done fi GATEWAY=$(ip route | grep default | awk '{print $3}') DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' ',' | sed 's/,$//') echo "" echo "網關：$GATEWAY " echo " DNS：$DNS" #報表信息 IP=$(ip -f inet addr | grep -v 127.0.0.1 | grep inet | awk '{print $NF,$2}' | tr '\n' ',' | sed 's/,$//') MAC=$(ip link | grep -v "LOOPBACK\|loopback" | awk '{print $2}' | sed 'N;s/\n//' | tr '\n' ',' | sed 's/,$//') report_IP="$IP" #IP地址 report_MAC=$MAC #MAC地址 report_Gateway="$GATEWAY" #默認網關 report_DNS="$DNS" #DNS } function getListenStatus(){ echo "" echo "" echo "############################ 監聽檢查 ############################" TCPListen=$(ss -ntul | column -t) echo "$TCPListen" #報表信息 report_Listen="$(echo "$TCPListen"| sed '1d' | awk '/tcp/ {print $5}' | awk -F: '{print $NF}' | sort | uniq | wc -l)" } function getCronStatus(){ echo "" echo "" echo "############################ 計划任務檢查 ########################" Crontab=0 for shell in $(grep -v "/sbin/nologin" /etc/shells);do for user in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do crontab -l -u $user >/dev/null 2>&1 status=$? if [ $status -eq 0 ];then echo "$user" echo "--------" crontab -l -u $user let Crontab=Crontab+$(crontab -l -u $user | wc -l) echo "" fi done done #計划任務 find /etc/cron* -type f | xargs -i ls -l {} | column -t let Crontab=Crontab+$(find /etc/cron* -type f | wc -l) #報表信息 report_Crontab="$Crontab" #計划任務數 } function getHowLongAgo(){ # 計算一個時間戳離現在有多久了 datetime="$*" [ -z "$datetime" ] && echo "錯誤的參數：getHowLongAgo() $*" Timestamp=$(date +%s -d "$datetime") #轉化為時間戳 Now_Timestamp=$(date +%s) Difference_Timestamp=$(($Now_Timestamp-$Timestamp)) days=0;hours=0;minutes=0; sec_in_day=$((60*60*24)); sec_in_hour=$((60*60)); sec_in_minute=60 while (( $(($Difference_Timestamp-$sec_in_day)) > 1 )) do let Difference_Timestamp=Difference_Timestamp-sec_in_day let days++ done while (( $(($Difference_Timestamp-$sec_in_hour)) > 1 )) do let Difference_Timestamp=Difference_Timestamp-sec_in_hour let hours++ done echo "$days 天 $hours 小時前" } function getUserLastLogin(){ # 獲取用戶最近一次登錄的時間，含年份 # 很遺憾last命令不支持顯示年份，只有"last -t YYYYMMDDHHMMSS"表示某個時間之間的登錄，我 # 們只能用最笨的方法了，對比今天之前和今年元旦之前（或者去年之前和前年之前……）某個用戶 # 登錄次數，如果登錄統計次數有變化，則說明最近一次登錄是今年。 username=$1 : ${username:="`whoami`"} thisYear=$(date +%Y) oldesYear=$(last | tail -n1 | awk '{print $NF}') while(( $thisYear >= $oldesYear));do loginBeforeToday=$(last $username | grep $username | wc -l) loginBeforeNewYearsDayOfThisYear=$(last $username -t $thisYear"0101000000" | grep $username | wc -l) if [ $loginBeforeToday -eq 0 ];then echo "從未登錄過" break elif [ $loginBeforeToday -gt $loginBeforeNewYearsDayOfThisYear ];then lastDateTime=$(last -i $username | head -n1 | awk '{for(i=4;i<(NF-2);i++)printf"%s ",$i}')" $thisYear" #格式如: Sat Nov 2 20:33 2015 lastDateTime=$(date "+%Y-%m-%d %H:%M:%S" -d "$lastDateTime") echo "$lastDateTime" break else thisYear=$((thisYear-1)) fi done } function getUserStatus(){ echo "" echo "" echo "############################ 用戶檢查 ############################" #/etc/passwd 最后修改時間 pwdfile="$(cat /etc/passwd)" Modify=$(stat /etc/passwd | grep Modify | tr '.' ' ' | awk '{print $2,$3}') echo "/etc/passwd 最后修改時間：$Modify ($(getHowLongAgo $Modify))" echo "" echo "特權用戶" echo "--------" RootUser="" for user in $(echo "$pwdfile" | awk -F: '{print $1}');do if [ $(id -u $user) -eq 0 ];then echo "$user" RootUser="$RootUser,$user" fi done echo "" echo "用戶列表" echo "--------" USERs=0 echo "$( echo "用戶名 UID GID HOME SHELL 最后一次登錄" for shell in $(grep -v "/sbin/nologin" /etc/shells);do for username in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do userLastLogin="$(getUserLastLogin $username)" echo "$pwdfile" | grep -w "$username" |grep -w "$shell"| awk -F: -v lastlogin="$(echo "$userLastLogin" | tr ' ' '_')" '{print $1,$3,$4,$6,$7,lastlogin}' done let USERs=USERs+$(echo "$pwdfile" | grep "$shell"| wc -l) done )" | column -t echo "" echo "空密碼用戶" echo "----------" USEREmptyPassword="" for shell in $(grep -v "/sbin/nologin" /etc/shells);do for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do r=$(awk -F: '$2=="!!"{print $1}' /etc/shadow | grep -w $user) if [ ! -z $r ];then echo $r USEREmptyPassword="$USEREmptyPassword,"$r fi done done echo "" echo "相同ID的用戶" echo "------------" USERTheSameUID="" UIDs=$(cut -d: -f3 /etc/passwd | sort | uniq -c | awk '$1>1{print $2}') for uid in $UIDs;do echo -n "$uid"; USERTheSameUID="$uid" r=$(awk -F: 'ORS="";$3=='"$uid"'{print ":",$1}' /etc/passwd) echo "$r" echo "" USERTheSameUID="$USERTheSameUID $r," done #報表信息 report_USERs="$USERs" #用戶 report_USEREmptyPassword=$(echo $USEREmptyPassword | sed 's/^,//') report_USERTheSameUID=$(echo $USERTheSameUID | sed 's/,$//') report_RootUser=$(echo $RootUser | sed 's/^,//') #特權用戶 } function getPasswordStatus { echo "" echo "" echo "############################ 密碼檢查 ############################" pwdfile="$(cat /etc/passwd)" echo "" echo "密碼過期檢查" echo "------------" result="" for shell in $(grep -v "/sbin/nologin" /etc/shells);do for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do get_expiry_date=$(/usr/bin/chage -l $user | grep 'Password expires' | cut -d: -f2) if [[ $get_expiry_date = ' never' || $get_expiry_date = 'never' ]];then printf "%-15s 永不過期\n" $user result="$result,$user:never" else password_expiry_date=$(date -d "$get_expiry_date" "+%s") current_date=$(date "+%s") diff=$(($password_expiry_date-$current_date)) let DAYS=$(($diff/(60*60*24))) printf "%-15s %s天后過期\n" $user $DAYS result="$result,$user:$DAYS days" fi done done report_PasswordExpiry=$(echo $result | sed 's/^,//') echo "" echo "密碼策略檢查" echo "------------" grep -v "#" /etc/login.defs | grep -E "PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE" } function getSudoersStatus(){ echo "" echo "" echo "############################ Sudoers檢查 #########################" conf=$(grep -v "^#" /etc/sudoers| grep -v "^Defaults" | sed '/^$/d') echo "$conf" echo "" #報表信息 report_Sudoers="$(echo $conf | wc -l)" } function getInstalledStatus(){ echo "" echo "" echo "############################ 軟件檢查 ############################" rpm -qa --last | head | column -t } function getProcessStatus(){ echo "" echo "" echo "############################ 進程檢查 ############################" if [ $(ps -ef | grep defunct | grep -v grep | wc -l) -ge 1 ];then echo "" echo "僵屍進程"; echo "--------" ps -ef | head -n1 ps -ef | grep defunct | grep -v grep fi echo "" echo "內存占用TOP10" echo "-------------" echo -e "PID %MEM RSS COMMAND $(ps aux | awk '{print $2, $4, $6, $11}' | sort -k3rn | head -n 10 )"| column -t echo "" echo "CPU占用TOP10" echo "------------" top b -n1 | head -17 | tail -11 #報表信息 report_DefunctProsess="$(ps -ef | grep defunct | grep -v grep|wc -l)" } function getJDKStatus(){ echo "" echo "" echo "############################ JDK檢查 #############################" java -version 2>/dev/null if [ $? -eq 0 ];then java -version 2>&1 fi echo "JAVA_HOME=\"$JAVA_HOME\"" #報表信息 report_JDK="$(java -version 2>&1 | grep version | awk '{print $1,$3}' | tr -d '"')" } function getSyslogStatus(){ echo "" echo "" echo "############################ syslog檢查 ##########################" echo "服務狀態：$(getState rsyslog)" echo "" echo "/etc/rsyslog.conf" echo "-----------------" cat /etc/rsyslog.conf 2>/dev/null | grep -v "^#" | grep -v "^\\$" | sed '/^$/d' | column -t #報表信息 report_Syslog="$(getState rsyslog)" } function getFirewallStatus(){ echo "" echo "" echo "############################ 防火牆檢查 ##########################" #防火牆狀態，策略等 if [[ $centosVersion < 7 ]];then /etc/init.d/iptables status >/dev/null 2>&1 status=$? if [ $status -eq 0 ];then s="active" elif [ $status -eq 3 ];then s="inactive" elif [ $status -eq 4 ];then s="permission denied" else s="unknown" fi else s="$(getState iptables)" fi echo "iptables: $s" echo "" echo "/etc/sysconfig/iptables" echo "-----------------------" cat /etc/sysconfig/iptables 2>/dev/null #報表信息 report_Firewall="$s" } function getSNMPStatus(){ #SNMP服務狀態，配置等 echo "" echo "" echo "############################ SNMP檢查 ############################" status="$(getState snmpd)" echo "服務狀態：$status" echo "" if [ -e /etc/snmp/snmpd.conf ];then echo "/etc/snmp/snmpd.conf" echo "--------------------" cat /etc/snmp/snmpd.conf 2>/dev/null | grep -v "^#" | sed '/^$/d' fi #報表信息 report_SNMP="$(getState snmpd)" } function getState(){ if [[ $centosVersion < 7 ]];then if [ -e "/etc/init.d/$1" ];then if [ `/etc/init.d/$1 status 2>/dev/null | grep -E "is running|正在運行" | wc -l` -ge 1 ];then r="active" else r="inactive" fi else r="unknown" fi else #CentOS 7+ r="$(systemctl is-active $1 2>&1)" fi echo "$r" } function getSSHStatus(){ #SSHD服務狀態，配置,受信任主機等 echo "" echo "" echo "############################ SSH檢查 #############################" #檢查受信任主機 pwdfile="$(cat /etc/passwd)" echo "服務狀態：$(getState sshd)" Protocol_Version=$(cat /etc/ssh/sshd_config | grep Protocol | awk '{print $2}') echo "SSH協議版本：$Protocol_Version" echo "" echo "信任主機" echo "--------" authorized=0 for user in $(echo "$pwdfile" | grep /bin/bash | awk -F: '{print $1}');do authorize_file=$(echo "$pwdfile" | grep -w $user | awk -F: '{printf $6"/.ssh/authorized_keys"}') authorized_host=$(cat $authorize_file 2>/dev/null | awk '{print $3}' | tr '\n' ',' | sed 's/,$//') if [ ! -z $authorized_host ];then echo "$user 授權 \"$authorized_host\" 無密碼訪問" fi let authorized=authorized+$(cat $authorize_file 2>/dev/null | awk '{print $3}'|wc -l) done echo "" echo "是否允許ROOT遠程登錄" echo "--------------------" config=$(cat /etc/ssh/sshd_config | grep PermitRootLogin) firstChar=${config:0:1} if [ $firstChar == "#" ];then PermitRootLogin="yes" #默認是允許ROOT遠程登錄的 else PermitRootLogin=$(echo $config | awk '{print $2}') fi echo "PermitRootLogin $PermitRootLogin" echo "" echo "/etc/ssh/sshd_config" echo "--------------------" cat /etc/ssh/sshd_config | grep -v "^#" | sed '/^$/d' #報表信息 report_SSHAuthorized="$authorized" #SSH信任主機 report_SSHDProtocolVersion="$Protocol_Version" #SSH協議版本 report_SSHDPermitRootLogin="$PermitRootLogin" #允許root遠程登錄 } function getNTPStatus(){ #NTP服務狀態，當前時間，配置等 echo "" echo "" echo "############################ NTP檢查 #############################" if [ -e /etc/ntp.conf ];then echo "服務狀態：$(getState ntpd)" echo "" echo "/etc/ntp.conf" echo "-------------" cat /etc/ntp.conf 2>/dev/null | grep -v "^#" | sed '/^$/d' fi #報表信息 report_NTP="$(getState ntpd)" } function uploadHostDailyCheckReport(){ json="{ \"DateTime\":\"$report_DateTime\", \"Hostname\":\"$report_Hostname\", \"OSRelease\":\"$report_OSRelease\", \"Kernel\":\"$report_Kernel\", \"Language\":\"$report_Language\", \"LastReboot\":\"$report_LastReboot\", \"Uptime\":\"$report_Uptime\", \"CPUs\":\"$report_CPUs\", \"CPUType\":\"$report_CPUType\", \"Arch\":\"$report_Arch\", \"MemTotal\":\"$report_MemTotal\", \"MemFree\":\"$report_MemFree\", \"MemUsedPercent\":\"$report_MemUsedPercent\", \"DiskTotal\":\"$report_DiskTotal\", \"DiskFree\":\"$report_DiskFree\", \"DiskUsedPercent\":\"$report_DiskUsedPercent\", \"InodeTotal\":\"$report_InodeTotal\", \"InodeFree\":\"$report_InodeFree\", \"InodeUsedPercent\":\"$report_InodeUsedPercent\", \"IP\":\"$report_IP\", \"MAC\":\"$report_MAC\", \"Gateway\":\"$report_Gateway\", \"DNS\":\"$report_DNS\", \"Listen\":\"$report_Listen\", \"Selinux\":\"$report_Selinux\", \"Firewall\":\"$report_Firewall\", \"USERs\":\"$report_USERs\", \"USEREmptyPassword\":\"$report_USEREmptyPassword\", \"USERTheSameUID\":\"$report_USERTheSameUID\", \"PasswordExpiry\":\"$report_PasswordExpiry\", \"RootUser\":\"$report_RootUser\", \"Sudoers\":\"$report_Sudoers\", \"SSHAuthorized\":\"$report_SSHAuthorized\", \"SSHDProtocolVersion\":\"$report_SSHDProtocolVersion\", \"SSHDPermitRootLogin\":\"$report_SSHDPermitRootLogin\", \"DefunctProsess\":\"$report_DefunctProsess\", \"SelfInitiatedService\":\"$report_SelfInitiatedService\", \"SelfInitiatedProgram\":\"$report_SelfInitiatedProgram\", \"RuningService\":\"$report_RuningService\", \"Crontab\":\"$report_Crontab\", \"Syslog\":\"$report_Syslog\", \"SNMP\":\"$report_SNMP\", \"NTP\":\"$report_NTP\", \"JDK\":\"$report_JDK\" }" #echo "$json" curl -l -H "Content-type: application/json" -X POST -d "$json" "$uploadHostDailyCheckReportApi" 2>/dev/null } function getchage_file_24h() { echo "############################ 文件檢查 #############################" check2=$(find / -name '*.sh' -mtime -1) check21=$(find / -name '*.asp' -mtime -1) check22=$(find / -name '*.php' -mtime -1) check23=$(find / -name '*.aspx' -mtime -1) check24=$(find / -name '*.jsp' -mtime -1) check25=$(find / -name '*.html' -mtime -1) check26=$(find / -name '*.htm' -mtime -1) check9=$(find / -name core -exec ls -l {} \;) check10=$(cat /etc/crontab) check12=$(ls -alt /usr/bin | head -10) cat <<EOF ############################查看所有被修改過的文件返回最近24小時內的############################ ${check2} ${check21} ${check22} ${check23} ${check24} ${check25} ${check26} ${line} ############################檢查定時文件的完整性############################ ${check10} ${line} ############################查看系統命令是否被替換############################ ${check12} ${line} EOF } function check(){ version getSystemStatus getCpuStatus getMemStatus getDiskStatus getNetworkStatus getListenStatus getProcessStatus getServiceStatus getAutoStartStatus getLoginStatus getCronStatus getUserStatus getPasswordStatus getSudoersStatus getJDKStatus getFirewallStatus getSSHStatus getSyslogStatus getSNMPStatus getNTPStatus getInstalledStatus getchage_file_24h } #執行檢查並保存檢查結果 check > $RESULTFILE echo "檢查結果：$RESULTFILE" echo -e "`date "+%Y-%m-%d %H:%M:%S"` 阿里雲PHP企業平台巡檢報告" | mail -a $RESULTFILE -s "阿里雲PHP企業平台巡檢報告" h@163.com
結果示例
cat log/HostDailyCheck--20211027.txt 系統巡檢腳本：Version 2020-03-16 ############################ 系統檢查 ############################ 系統：GNU/Linux 發行版本：CentOS Linux release 7.5.1804 (Core) 內核：3.10.0-514.el7.x86_64 主機名：mongo_mongo_16 SELinux：disabled 語言/編碼：en_US.UTF-8 當前時間：2021-10-27 09:39:27 最后啟動：2021-07-13 10:10 運行時間：105 days ############################ CPU檢查 ############################# 物理CPU個數:1 邏輯CPU個數:2 每CPU核心數:2 CPU型號:Intel(R) Xeon(R) CPU E5-2680 0 @ 2.70GHz CPU架構:x86_64 ############################ 內存檢查 ############################ total used free shared buff/cache available Mem: 3.7G 780M 1.5G 174M 1.4G 2.5G Swap: 1.6G 0B 1.6G ############################ 磁盤檢查 ############################ Filesystem Type | Size Used Avail Use% | Inodes IUsed IFree IUse% | Mounted /dev/mapper/cl-root xfs | 14G 4.9G 8.6G 37% | 6.7M 74K 6.7M 2% | / devtmpfs devtmpfs | 1.9G 0 1.9G 0% | 472K 353 471K 1% | /dev tmpfs tmpfs | 1.9G 216K 1.9G 1% | 474K 55 474K 1% | /dev/shm tmpfs tmpfs | 1.9G 216K 1.9G 1% | 474K 545 474K 1% | /run tmpfs tmpfs | 1.9G 216K 1.9G 1% | 474K 16 474K 1% | /sys/fs/cgroup tmpfs tmpfs | 1.9G 175M 1.7G 10% | 474K 55 474K 1% | /dev/shm tmpfs tmpfs | 1.9G 175M 1.7G 10% | 474K 545 474K 1% | /run tmpfs tmpfs | 1.9G 175M 1.7G 10% | 474K 16 474K 1% | /sys/fs/cgroup tmpfs tmpfs | 1.9G 0 1.9G 0% | 474K 55 474K 1% | /dev/shm tmpfs tmpfs | 1.9G 0 1.9G 0% | 474K 545 474K 1% | /run tmpfs tmpfs | 1.9G 0 1.9G 0% | 474K 16 474K 1% | /sys/fs/cgroup /dev/sdb1 xfs | 100G 3.9G 97G 4% | 50M 18K 50M 1% | /data /dev/sda1 xfs | 1014M 135M 880M 14% | 512K 332 512K 1% | /boot tmpfs tmpfs | 380M 0 380M 0% | 474K 1 474K 1% | /run/user/0 ############################ 網絡檢查 ############################ ens160: 192.168.15.16/24 網關：192.168.15.1 DNS：202.96.134.133 ############################ 監聽檢查 ############################ Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 127.0.0.1:323 *:* udp UNCONN 0 0 *:123 *:* udp UNCONN 0 0 ::1:323 :::* tcp LISTEN 0 128 *:22 *:* tcp LISTEN 0 1000 *:4505 *:* tcp LISTEN 0 1000 *:4506 *:* tcp LISTEN 0 128 *:3717 *:* tcp LISTEN 0 128 :::22 :::* ############################ 進程檢查 ############################ 內存占用TOP10 ------------- PID %MEM RSS COMMAND 3662 8.1 315484 /usr/local/mongodb/bin/mongod 1214 1.9 77076 /usr/bin/python 1218 1.4 55604 /usr/bin/python 1217 1.4 55588 /usr/bin/python 1229 1.4 55504 /usr/bin/python 1219 1.4 55500 /usr/bin/python 1228 1.4 55460 /usr/bin/python 982 1.3 52048 /usr/bin/python 984 1.1 45928 /usr/bin/python 1216 1.0 40388 /usr/bin/python CPU占用TOP10 ------------ PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 7338 root 20 0 161852 2120 1540 R 6.2 0.1 0:00.04 top 1 root 20 0 125324 3752 2512 S 0.0 0.1 1:07.85 systemd 2 root 20 0 0 0 0 S 0.0 0.0 0:02.44 kthreadd 3 root 20 0 0 0 0 S 0.0 0.0 0:07.84 ksoftirqd/0 7 root rt 0 0 0 0 S 0.0 0.0 0:33.33 migration/0 8 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_bh 9 root 20 0 0 0 0 S 0.0 0.0 33:59.52 rcu_sched 10 root rt 0 0 0 0 S 0.0 0.0 0:47.50 watchdog/0 11 root rt 0 0 0 0 S 0.0 0.0 0:50.74 watchdog/1 12 root rt 0 0 0 0 S 0.0 0.0 1:18.91 migration/1 ############################ 服務檢查 ############################ 服務配置 -------- auditd.service enabled autovt@.service enabled chronyd.service enabled crond.service enabled dbus-org.freedesktop.NetworkManager.service enabled dbus-org.freedesktop.nm-dispatcher.service enabled getty@.service enabled irqbalance.service enabled kdump.service enabled lvm2-monitor.service enabled microcode.service enabled NetworkManager-dispatcher.service enabled NetworkManager-wait-online.service enabled NetworkManager.service enabled rhel-autorelabel-mark.service enabled rhel-autorelabel.service enabled rhel-configure.service enabled rhel-dmesg.service enabled rhel-domainname.service enabled rhel-import-state.service enabled rhel-loadmodules.service enabled rhel-readonly.service enabled rsyslog.service enabled salt-master.service enabled salt-syndic.service enabled sshd.service enabled systemd-readahead-collect.service enabled systemd-readahead-drop.service enabled systemd-readahead-replay.service enabled tuned.service enabled vmtoolsd.service enabled 正在運行的服務 -------------- auditd.service loaded active running Security Auditing Service chronyd.service loaded active running NTP client/server crond.service loaded active running Command Scheduler dbus.service loaded active running D-Bus System Message Bus getty@tty1.service loaded active running Getty on tty1 irqbalance.service loaded active running irqbalance daemon lvm2-lvmetad.service loaded active running LVM2 metadata daemon NetworkManager.service loaded active running Network Manager polkit.service loaded active running Authorization Manager rsyslog.service loaded active running System Logging Service salt-master.service loaded active running The Salt Master Server salt-syndic.service loaded active running The Salt Master Server sshd.service loaded active running OpenSSH server daemon systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-udevd.service loaded active running udev Kernel Device Manager tuned.service loaded active running Dynamic System Tuning Daemon vgauthd.service loaded active running VGAuth Service for open-vm-tools vmtoolsd.service loaded active running Service for virtual machines hosted on VMware ############################ 自啟動檢查 ########################## touch /var/lock/subsys/local ############################ 登錄檢查 ############################ root pts/0 192.168.10.18 Mon Oct 25 09:30 still logged in root pts/0 192.168.10.18 Fri Oct 8 09:54 - 04:34 (15+18:39) root pts/0 192.168.10.18 Fri Aug 6 18:03 - 00:19 (55+06:16) root pts/0 192.168.10.18 Tue Jul 13 10:14 - 18:03 (24+07:49) reboot system boot 3.10.0-514.el7.x Tue Jul 13 10:10 - 09:39 (105+23:29) root pts/0 192.168.10.18 Fri Jul 9 16:54 - crash (3+17:16) root pts/0 192.168.10.18 Fri Jul 9 15:22 - 15:35 (00:13) root pts/1 192.168.10.18 Wed Jul 7 17:13 - 17:56 (00:43) root pts/0 192.168.10.18 Mon Jul 5 22:37 - 15:15 (3+16:38) reboot system boot 3.10.0-514.el7.x Mon Jul 5 22:36 - 09:39 (113+11:02) ############################ 計划任務檢查 ######################## root -------- */20 * * * * /usr/sbin/ntpdate -b time1.aliyun.com > /dev/null 2>&1 -rw-r--r--. 1 root root 128 Apr 11 2018 /etc/cron.d/0hourly -rw-r--r-- 1 root root 224 Dec 6 2018 /etc/cron.d/mongodb-consistent-backup -rwx------. 1 root root 219 Apr 11 2018 /etc/cron.daily/logrotate -rwxr-xr-x. 1 root root 618 Mar 18 2014 /etc/cron.daily/man-db.cron -rw-------. 1 root root 0 Apr 11 2018 /etc/cron.deny -rwxr-xr-x. 1 root root 392 Apr 11 2018 /etc/cron.hourly/0anacron -rw-r--r--. 1 root root 451 Jun 10 2014 /etc/crontab ############################ 用戶檢查 ############################ /etc/passwd 最后修改時間：2021-07-13 10:34:27 (105 天 23 小時前) 特權用戶 -------- root 用戶列表 -------- 用戶名 UID GID HOME SHELL 最后一次登錄 root 0 0 /root /bin/bash 2021-10-25_09:30:00 25QPSZUser 1000 1000 /home/25QPSZUser /bin/bash 從未登錄過 postgres 1002 1002 /home/postgres /bin/bash 從未登錄過 空密碼用戶 ---------- postgres 相同ID的用戶 ------------ ############################ 密碼檢查 ############################ 密碼過期檢查 ------------ root 永不過期 25QPSZUser 永不過期 postgres 永不過期 密碼策略檢查 ------------ PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_MIN_LEN 5 PASS_WARN_AGE 7 ############################ Sudoers檢查 ######################### root ALL=(ALL) ALL 25QPSZUser ALL=(root) ALL %wheel ALL=(ALL) ALL ############################ JDK檢查 ############################# JAVA_HOME="" ############################ 防火牆檢查 ########################## iptables: inactive /etc/sysconfig/iptables ----------------------- ############################ SSH檢查 ############################# 服務狀態：active SSH協議版本： 信任主機 -------- 是否允許ROOT遠程登錄 -------------------- PermitRootLogin yes /etc/ssh/sshd_config -------------------- HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key SyslogFacility AUTHPRIV AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication yes ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials no UsePAM yes X11Forwarding yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS Subsystem sftp /usr/libexec/openssh/sftp-server ############################ syslog檢查 ########################## 服務狀態：active /etc/rsyslog.conf ----------------- *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log ############################ SNMP檢查 ############################ 服務狀態：unknown ############################ NTP檢查 ############################# ############################ 軟件檢查 ############################ libgcc-4.8.5-44.el7.i686 Wed 13 Oct 2021 11:41:41 AM CST gcc-4.8.5-44.el7.x86_64 Wed 13 Oct 2021 11:41:39 AM CST cpp-4.8.5-44.el7.x86_64 Wed 13 Oct 2021 11:41:37 AM CST libgcc-4.8.5-44.el7.x86_64 Wed 13 Oct 2021 11:41:35 AM CST libgomp-4.8.5-44.el7.x86_64 Wed 13 Oct 2021 11:41:34 AM CST psmisc-22.20-17.el7.x86_64 Thu 01 Jul 2021 10:03:22 PM CST irqbalance-1.0.7-12.el7.x86_64 Wed 30 Jun 2021 03:54:44 PM CST percona-xtrabackup-80-8.0.25-17.1.el7.x86_64 Wed 23 Jun 2021 05:52:32 PM CST gpg-pubkey-8507efa5-5b02c2fb Wed 23 Jun 2021 05:52:07 PM CST gpg-pubkey-cd2efd2a-4b26dda1 Wed 23 Jun 2021 05:51:57 PM CST ############################ 文件檢查 ############################# ############################查看所有被修改過的文件返回最近24小時內的############################ /tmp/a.sh ############################檢查定時文件的完整性############################ SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed ############################查看系統命令是否被替換############################ total 482908 dr-xr-xr-x. 2 root root 28672 Oct 13 11:41 . lrwxrwxrwx 1 root root 3 Oct 13 11:41 cc -> gcc lrwxrwxrwx 1 root root 6 Jul 1 22:03 pstree.x11 -> pstree -rwxr-xr-x 1 root root 75684 Jun 23 17:52 qpress -rwxr-xr-x 1 root root 467824 May 31 18:49 xbcloud -rwxr-xr-x 1 root root 222456 May 31 18:49 xbcrypt -rwxr-xr-x 1 root root 252224 May 31 18:49 xbstream -rwxr-xr-x 1 root root 58267600 May 31 18:48 xtrabackup -rwxr-xr-x 1 root root 3020 May 31 18:25 xbcloud_osenv
f