#!/bin/bash
#=====================================================
# 系统安全审计脚本 - 检查常见安全漏洞
# 来源: 整合自社区安全审计最佳实践
# 用法: sudo ./audit-system.sh
#=====================================================

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

PASS=0; FAIL=0; WARN=0

check() {
    local desc=$1
    shift
    if "$@" &>/dev/null; then
        echo -e "  ${GREEN}[通过]${NC} $desc"
        PASS=$((PASS + 1))
    else
        echo -e "  ${RED}[风险]${NC} $desc"
        FAIL=$((FAIL + 1))
    fi
}

warn() {
    echo -e "  ${YELLOW}[注意]${NC} $1"
    WARN=$((WARN + 1))
}

echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}    系统安全审计报告${NC}"
echo -e "${GREEN}========================================${NC}"
echo "审计时间: $(date '+%Y-%m-%d %H:%M:%S')"
echo ""

# 1. 账户安全
echo -e "${YELLOW}[1] 账户安全${NC}"
check "无空密码账户" test -z "$(awk -F: '($2==""){print $1}' /etc/shadow 2>/dev/null)"
check "root仅可控制台登录" grep -q "^tty1$" /etc/securetty 2>/dev/null
check "密码过期策略已启用" grep -q "^PASS_MAX_DAYS" /etc/login.defs 2>/dev/null
check "无UID=0的非root账户" test "$(awk -F: '($3==0){print $1}' /etc/passwd | grep -v root | wc -l)" -eq 0
echo ""

# 2. SSH安全
echo -e "${YELLOW}[2] SSH 安全${NC}"
check "禁止root SSH登录" grep -q "^PermitRootLogin no" /etc/ssh/sshd_config 2>/dev/null
check "SSH使用非默认端口" grep -q "^Port [^2][^2]" /etc/ssh/sshd_config 2>/dev/null
check "禁止密码认证" grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config 2>/dev/null
check "SSH协议版本2" grep -q "^Protocol 2" /etc/ssh/sshd_config 2>/dev/null
echo ""

# 3. 文件权限
echo -e "${YELLOW}[3] 文件权限${NC}"
check "/etc/passwd 权限正确" test "$(stat -c %a /etc/passwd)" = "644"
check "/etc/shadow 权限正确" test "$(stat -c %a /etc/shadow 2>/dev/null)" = "000" -o "$(stat -c %a /etc/shadow 2>/dev/null)" = "400"
check "无全局可写文件" test -z "$(find /etc -type f -perm -o+w 2>/dev/null | head -1)"
echo ""

# 4. 网络安全
echo -e "${YELLOW}[4] 网络安全${NC}"
check "防火墙已启用" systemctl is-active --quiet firewalld 2>/dev/null || systemctl is-active --quiet ufw 2>/dev/null || iptables -L &>/dev/null
check "ICMP重定向已禁用" test "$(cat /proc/sys/net/ipv4/conf/all/accept_redirects 2>/dev/null)" = "0"
check "IP转发已禁用" test "$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)" = "0"
echo ""

# 5. 服务安全
echo -e "${YELLOW}[5] 服务安全${NC}"
check "Telnet未运行" ! systemctl is-active --quiet telnet.socket 2>/dev/null
check "FTP未运行" ! systemctl is-active --quiet vsftpd 2>/dev/null
check "SELinux已启用" getenforce 2>/dev/null | grep -qi "Enforcing"
echo ""

# 6. 日志审计
echo -e "${YELLOW}[6] 日志审计${NC}"
check "rsyslog已运行" systemctl is-active --quiet rsyslog 2>/dev/null
check "auditd已运行" systemctl is-active --quiet auditd 2>/dev/null
check "日志目录存在" test -d /var/log
echo ""

# 7. 系统更新
echo -e "${YELLOW}[7] 系统更新${NC}"
UPDATES=$(yum check-update 2>/dev/null | wc -l || apt list --upgradable 2>/dev/null | wc -l)
if [ "$UPDATES" -gt 5 ]; then
    warn "有 ${UPDATES} 个可用更新"
else
    check "系统更新较少" true
fi
echo ""

# 总结
echo -e "${GREEN}========================================${NC}"
echo -e "  审计结果: ${GREEN}通过 ${PASS}${NC} / ${RED}风险 ${FAIL}${NC} / ${YELLOW}注意 ${WARN}${NC}"
echo -e "${GREEN}========================================${NC}"