mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
139 lines
3.7 KiB
Bash
139 lines
3.7 KiB
Bash
#!/bin/bash
|
|
# Linux Security Audit Script
|
|
# Usage: ./audit-system.sh [--verbose]
|
|
|
|
set -euo pipefail
|
|
|
|
VERBOSE="${1:-}"
|
|
PASS=0
|
|
WARN=0
|
|
FAIL=0
|
|
|
|
check() {
|
|
local status="$1"
|
|
local message="$2"
|
|
case "$status" in
|
|
PASS) echo -e "\e[32m[PASS]\e[0m $message"; ((PASS++)) ;;
|
|
WARN) echo -e "\e[33m[WARN]\e[0m $message"; ((WARN++)) ;;
|
|
FAIL) echo -e "\e[31m[FAIL]\e[0m $message"; ((FAIL++)) ;;
|
|
esac
|
|
}
|
|
|
|
echo "========================================="
|
|
echo "Linux Security Audit"
|
|
echo "========================================="
|
|
echo ""
|
|
|
|
# 1. System Updates
|
|
echo "1. System Updates"
|
|
echo "-----------------"
|
|
UPDATES=$(apt-get -s upgrade 2>/dev/null | grep -c "^Inst" || echo 0)
|
|
if [ "$UPDATES" -eq 0 ]; then
|
|
check "PASS" "System is up to date"
|
|
else
|
|
check "FAIL" "$UPDATES packages need updating"
|
|
fi
|
|
|
|
# 2. SSH Configuration
|
|
echo ""
|
|
echo "2. SSH Configuration"
|
|
echo "--------------------"
|
|
if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config* 2>/dev/null; then
|
|
check "PASS" "Root login disabled"
|
|
else
|
|
check "FAIL" "Root login may be enabled"
|
|
fi
|
|
|
|
if grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config* 2>/dev/null; then
|
|
check "PASS" "Password authentication disabled"
|
|
else
|
|
check "WARN" "Password authentication may be enabled"
|
|
fi
|
|
|
|
# 3. User Accounts
|
|
echo ""
|
|
echo "3. User Accounts"
|
|
echo "----------------"
|
|
EMPTY_PASS=$(awk -F: '($2 == "") {print $1}' /etc/shadow 2>/dev/null | wc -l)
|
|
if [ "$EMPTY_PASS" -eq 0 ]; then
|
|
check "PASS" "No accounts with empty passwords"
|
|
else
|
|
check "FAIL" "$EMPTY_PASS accounts with empty passwords"
|
|
fi
|
|
|
|
ROOT_ACCOUNTS=$(awk -F: '($3 == 0) {print $1}' /etc/passwd | wc -l)
|
|
if [ "$ROOT_ACCOUNTS" -eq 1 ]; then
|
|
check "PASS" "Only root has UID 0"
|
|
else
|
|
check "FAIL" "$ROOT_ACCOUNTS accounts have UID 0"
|
|
fi
|
|
|
|
# 4. File Permissions
|
|
echo ""
|
|
echo "4. File Permissions"
|
|
echo "-------------------"
|
|
SHADOW_PERMS=$(stat -c %a /etc/shadow 2>/dev/null)
|
|
if [ "$SHADOW_PERMS" = "600" ] || [ "$SHADOW_PERMS" = "640" ]; then
|
|
check "PASS" "/etc/shadow permissions: $SHADOW_PERMS"
|
|
else
|
|
check "FAIL" "/etc/shadow permissions: $SHADOW_PERMS (should be 600)"
|
|
fi
|
|
|
|
WORLD_WRITABLE=$(find /etc -type f -perm -002 2>/dev/null | wc -l)
|
|
if [ "$WORLD_WRITABLE" -eq 0 ]; then
|
|
check "PASS" "No world-writable files in /etc"
|
|
else
|
|
check "FAIL" "$WORLD_WRITABLE world-writable files in /etc"
|
|
fi
|
|
|
|
# 5. Network Security
|
|
echo ""
|
|
echo "5. Network Security"
|
|
echo "-------------------"
|
|
if sysctl -n net.ipv4.tcp_syncookies 2>/dev/null | grep -q "1"; then
|
|
check "PASS" "TCP SYN cookies enabled"
|
|
else
|
|
check "WARN" "TCP SYN cookies not enabled"
|
|
fi
|
|
|
|
if sysctl -n net.ipv4.conf.all.rp_filter 2>/dev/null | grep -q "1"; then
|
|
check "PASS" "Reverse path filtering enabled"
|
|
else
|
|
check "WARN" "Reverse path filtering not enabled"
|
|
fi
|
|
|
|
# 6. Firewall
|
|
echo ""
|
|
echo "6. Firewall Status"
|
|
echo "------------------"
|
|
if command -v ufw &>/dev/null && ufw status | grep -q "active"; then
|
|
check "PASS" "UFW firewall is active"
|
|
elif command -v firewalld &>/dev/null && systemctl is-active firewalld &>/dev/null; then
|
|
check "PASS" "firewalld is active"
|
|
elif iptables -L -n 2>/dev/null | grep -q "DROP\|REJECT"; then
|
|
check "PASS" "iptables has rules configured"
|
|
else
|
|
check "FAIL" "No firewall appears to be active"
|
|
fi
|
|
|
|
# 7. Services
|
|
echo ""
|
|
echo "7. Running Services"
|
|
echo "-------------------"
|
|
LISTENING=$(ss -tlnp 2>/dev/null | grep -c LISTEN || echo 0)
|
|
check "WARN" "$LISTENING services listening on ports"
|
|
|
|
# Summary
|
|
echo ""
|
|
echo "========================================="
|
|
echo "Audit Summary"
|
|
echo "========================================="
|
|
echo -e "Passed: \e[32m$PASS\e[0m"
|
|
echo -e "Warnings: \e[33m$WARN\e[0m"
|
|
echo -e "Failed: \e[31m$FAIL\e[0m"
|
|
echo ""
|
|
|
|
if [ "$FAIL" -gt 0 ]; then
|
|
exit 1
|
|
fi
|