#!/bin/bash

os_check=`cat /etc/redhat-release | awk -F '.' '{print $1}' | awk '{print $NF}'`

sshd_config() {
 # 确保SSH MaxAuthTries设置为4或更低(小)
 cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
 cat /etc/ssh/sshd_config |grep -w  '^MaxAuthTries' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a MaxAuthTries 4' /etc/ssh/sshd_config
 else
    sed -i 's/^MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
 fi

 # 确保已禁用SSH空密码登录(默认就是，但检测需要把注释打开)
 cat /etc/ssh/sshd_config |grep -w  '^PermitEmptyPasswords' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a PermitEmptyPasswords no' /etc/ssh/sshd_config
 else
    sed -i 's/^PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
 fi

 # 配置SSH空闲超时间隔
 cat /etc/ssh/sshd_config |grep -w  '^ClientAliveInterval' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a ClientAliveInterval 300' /etc/ssh/sshd_config
 else
    sed -i 's/^ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config
 fi
 cat /etc/ssh/sshd_config |grep -w  '^ClientAliveCountMax' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a ClientAliveCountMax 0' /etc/ssh/sshd_config
 else
    sed -i 's/^ClientAliveCountMax.*/ClientAliveCountMax 0/' /etc/ssh/sshd_config
 fi

 # 重启服务
 if [[ $os_check == "7" ]];then
    /usr/bin/systemctl restart sshd.service >/dev/null 2>&1
 elif [[ $os_check == "6" ]];then
    /etc/init.d/sshd restart >/dev/null 2>&1
 fi
 if [[ $? -eq 0 ]];then
    echo "------ssd_config文件修改完成:MaxAuthTries 4、禁用SSH空密码登录、配置SSH空闲超时间隔--------"
 else
    echo "ssd_config文件修改失败:MaxAuthTries 4、禁用SSH空密码登录、配置SSH空闲超时间隔"
 fi
}

local_pass() {
 # 确保配置了密码尝试失败的锁定(连续5次失败登录尝试后锁定用户)
 if [[ $os_check == "7" ]];then
    result_line=`egrep -w '^auth.*required.*pam_faillock.so preauth audit silent deny=5 unlock_time=900$|^auth.*[success=1 default=bad].*pam_unix.so$|^auth.*[default=die].*pam_faillock.so authfail audit deny=5 unlock_time=900$|^auth.*sufficient.*pam_faillock.so authsucc audit deny=5 unlock_time=900$' /etc/pam.d/password-auth  |wc -l`
    if [[ $result1_line -ne 4 ]];then
       cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak
       sed -i '/^auth.*required.*pam_faillock.so preauth audit silent deny=5 unlock_time=900$\|^auth.*[success=1 default=bad].*pam_unix.so$\|^auth.*[default=die].*pam_faillock.so authfail audit deny=5 unlock_time=900$\|^auth.*sufficient.*pam_faillock.so authsucc audit deny=5 unlock_time=900$/d'  /etc/pam.d/password-auth
       sed_line=`egrep -w -n '^auth' /etc/pam.d/password-auth |awk 'END {print}' |awk -F : '{print $1}'`
       sed -i "${sed_line}a auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900\nauth [success=1 default=bad] pam_unix.so\nauth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900\nauth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900" /etc/pam.d/password-auth
       if [[ $? -eq 0 ]];then
          echo "------/etc/pam.d/password-auth修改完成：配置连续5次失败登录后锁定用户--------"
       else
          echo "/etc/pam.d/password-auth修改失败：配置连续5次失败登录后锁定用户"
       fi
    fi
    result2_line=`egrep -w '^auth.*required.*pam_faillock.so preauth audit silent deny=5 unlock_time=900$|^auth.*[success=1 default=bad].*pam_unix.so$|^auth.*[default=die].*pam_faillock.so authfail audit deny=5 unlock_time=900$|^auth.*sufficient.*pam_faillock.so authsucc audit deny=5 unlock_time=900$' /etc/pam.d/system-auth  |wc -l`
    if [[ $result2_line -ne 4 ]];then
       cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
       sed -i '/^auth.*required.*pam_faillock.so preauth audit silent deny=5 unlock_time=900$\|^auth.*[success=1 default=bad].*pam_unix.so$\|^auth.*[default=die].*pam_faillock.so authfail audit deny=5 unlock_time=900$\|^auth.*sufficient.*pam_faillock.so authsucc audit deny=5 unlock_time=900$/d'  /etc/pam.d/system-auth
       sed_line=`egrep -w -n '^auth' /etc/pam.d/system-auth |awk 'END {print}' |awk -F : '{print $1}'`
       sed -i "${sed_line}a auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900\nauth [success=1 default=bad] pam_unix.so\nauth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900\nauth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900" /etc/pam.d/system-auth
       if [[ $? -eq 0 ]];then
          echo "------/etc/pam.d/system-auth修改完成：配置连续5次失败登录后锁定用户--------"
       else
          echo "/etc/pam.d/system-auth修改失败：配置连续5次失败登录后锁定用户"
       fi
    fi
 fi
}

variable_file() {
 # 确保默认用户shell超时为900秒或更短
 cp /etc/profile /etc/profile.bak && cp /etc/bashrc /etc/bashrc.bak
 if [[ $os_check == "7" ]];then
    cat /etc/bashrc  |egrep -w  '^TMOUT' >/dev/null 2>&1
    if [[ $? -ne 0 ]];then
        sed -i '$a TMOUT=600' /etc/bashrc
    else
        sed -i 's/^TMOUT.*/TMOUT=600/' /etc/bashrc
    fi
    cat /etc/profile  |egrep -w  '^TMOUT' >/dev/null 2>&1
    if [[ $? -ne 0 ]];then
        sed -i '$a TMOUT=600' /etc/profile
    else
        sed -i 's/^TMOUT.*/TMOUT=600/' /etc/profile
    fi
 fi
 
 # 确保默认用户(etc/passwd中)的umask限制为027或更高
 sed  -i 's/umask [0-9]\{3\}/umask 027/g' /etc/profile
 sed  -i 's/umask [0-9]\{3\}/umask 027/g' /etc/bashrc
 
 # 生效文件
 if !source /etc/profile >/dev/null 2>&1;then
    echo "/etc/profile文件source失败"
 elif !source /etc/bashrc >/dev/null 2>&1;then
    echo "/etc/bashrc文件source失败"
 else
    echo "------变量文件修改成功:TMOUT=600、umask 027------"
 fi
}

cron_mem() {
 # 确保核心转储受到限制
 if [[ $os_check == "7" ]];then
    cp /etc/security/limits.conf /etc/security/limits.bak
    cat /etc/security/limits.conf |egrep -w '^\* hard core' >/dev/null 2>&1
    if [[ $? -ne 0 ]];then
        sed -i '$a \* hard core 0' /etc/security/limits.conf
    else
        sed -i 's/^\* hard core.*/\* hard core 0/' /etc/security/limits.conf
    fi
    cp /etc/sysctl.conf /etc/sysctl.bak
    cat /etc/sysctl.conf |egrep -w '^fs.suid_dumpable' >/dev/null 2>&1   
    if [[ $? -ne 0 ]];then
        sed -i '$a fs.suid_dumpable = 0' /etc/sysctl.conf
    else
        sed -i 's/^fs.suid_dumpable.*/fs.suid_dumpable = 0/' /etc/sysctl.conf
    fi
    if sysctl -w fs.suid_dumpable=0 >/dev/null 2>&1;then
       echo "------确保核心转储受到限制:配置成功------"
    else
       echo "确保核心转储受到限制:配置失败"
    fi
 fi
}

grub_file_user() {
 # 确保配置了bootloader配置的权限(grub配置文件权限)
 if [[ $os_check == "7" ]];then
    if ! chown root:root /boot/grub2/grub.cfg;then
       echo "grub文件更改为root用户失败"
    elif ! chmod og-rwx /boot/grub2/grub.cfg;then
       echo "grub文件修改权限失败"
    else
       echo "------grub文件所属用户和权限修改成功------"
    fi
 else
    if ! chown root:root /boot/grub/grub.conf;then
       echo "grub文件更改为root用户失败"
    elif ! chmod og-rwx /boot/grub/grub.conf;then
       echo "grub文件修改权限失败"
    else
       echo "------grub文件所属用户和权限修改成功------"
    fi
 fi
}

ASLR_enable() {
 # 确保启用了地址空间布局随机化（ASLR）
 cp /etc/sysctl.conf /etc/sysctl.bak2
 cat /etc/sysctl.conf  |egrep -w '^kernel.randomize_va_space' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a kernel.randomize_va_space = 2' /etc/sysctl.conf
 else
    sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/' /etc/sysctl.conf
 fi
 if sysctl -w kernel.randomize_va_space=2 >/dev/null 2>&1;then
    echo "------启用地址空间布局随机化（ASLR）成功------"
 else
    echo "启用地址空间布局随机化（ASLR）失败"
 fi
}

audit_file() {
 # 确保收集了会话启动信息
 if [[ $os_check == "7" ]];then
    cp /etc/audit/rules.d/audit.rules /etc/audit/rules.d/audit.bak
    sed -i '/^-w\|^-e/d' /etc/audit/rules.d/audit.rules
    result_line=`wc -l /etc/audit/rules.d/audit.rules |awk '{print $1}'`
    sed -i "${result_line}a -w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k logins\n-w /var/log/btmp -p wa -k logins\n-w /var/log/sudo.log -p wa -k actions\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock/ -p wa -k logins\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d/ -p wa -k scope\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/selinux/ -p wa -k MAC-policy\n-w /usr/share/selinux/ -p wa -k MAC-policy\n-e 2" /etc/audit/rules.d/audit.rules
 else
    cp /etc/audit/audit.rules /etc/audit/audit.bak
    sed -i '/^-w\|^-e/d' /etc/audit/audit.rules
    result_line=`wc -l /etc/audit/audit.rules |awk '{print $1}'`
    sed -i "${result_line}a -w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n-w /var/log/sudo.log -p wa -k actions\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock/ -p wa -k logins\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/selinux/ -p wa -k MAC-policy\n-e 2" /etc/audit/audit.rules
 fi   
 if [ ! -d "/var/log/audit" ]; then
     mkdir -p /var/log/audit
 fi
 if service auditd restart >/dev/null 2>&1;then
     echo -e "------确保收集了会话启动信息------\n------确保收集了系统管理员操作（sudolog）------\n------确保收集了会话启动信息------\n------确保收集了登录和注销事件------\n------确保系统管理范围（sudoers）更改的收集------\n------确保收>集了修改用户/组信息的事件------\n------确保收集了修改系统的强制访问控制的事件------"
 else
    echo "auditd服务重启失败：确保收集了会话启动信息、确保收集了系统管理员操作（sudolog）、确保收集了会话启动信息、确保收集了登录和注销事件、确保系统管理范围（sudoers）更改的收集、确保收集了修改用户/组信息的事件、确保收集了修改系统的强制访问控制的事件"
 fi
}

audit_log() {
 # 确保审核日志不会自动删除
 cp /etc/audit/auditd.conf /etc/audit/auditd.bak
 cat /etc/audit/auditd.conf  |egrep -w '^max_log_file_action' >/dev/null 2>&1
 if [[ $? -ne 0 ]];then
    sed -i '$a max_log_file_action = keep_logs' /etc/audit/auditd.conf
 else
    sed -i 's/^max_log_file_action.*/max_log_file_action = keep_logs/' /etc/audit/auditd.conf
 fi
 echo "------确保审核日志不会自动删除配置成功------"
}

etc_passwd() {
 # 确保已配置/etc/passwd-的权限
 if [[ $os_check == "6" ]];then
    if ! chown root:root /etc/passwd-;then
       echo "修改/etc/passwd-文件的所属主失败"
    elif ! chmod 600 /etc/passwd-;then
       echo "修改/etc/passwd-文件的权限失败"
    else
       echo "------/etc/passwd-的文件权限和所属主修改完成------"   
    fi
 fi
}

etc_group() {
 # 确保已配置/etc/group-的权限
 if [[ $os_check == "6" ]];then
    if ! chown root:root /etc/group-;then
       echo "修改/etc/group-文件的所属主失败"
    elif ! chmod 600 /etc/group-;then
       echo "修改/etc/group-文件的权限失败"
    else
       echo "------/etc/group-的文件权限和所属主修改完成------"   
    fi  
 fi
}

main() {
 sshd_config
 local_pass
 variable_file
 cron_mem
 grub_file_user
 ASLR_enable
 audit_file
 audit_log
 etc_passwd
 etc_group         
}

main

