Linux入侵排查脚本

根据大佬的Linux入侵排查文章，链接如下：

https://bypass007.github.io/Emergency-Response-Notes/Summary/%E7%AC%AC2%E7%AF%87%EF%BC%9ALinux%E5%85%A5%E4%BE%B5%E6%8E%92%E6%9F%A5.html

编写的简易python脚本：
 

# coding=utf-8
import os
info = '''usermod -L user    禁用帐号，帐号无法登录，/etc/shadow第二栏为!开头
userdel user       删除user用户
userdel -r user    将删除user用户，并且将/home目录下的user目录一并删除'''
min1 = "awk -F: '$3==0{print $1}' /etc/passwd"
min2 = "awk '/\$1|\$6/{print $1}' /etc/shadow"
min3 = 'more /etc/sudoers | grep -v "^#\|^$" | grep "ALL=(ALL)"'
def getinfo(min):
	tmp = os.popen(min)
	return tmp.read()
print "处置手段:"
print info
print "============================================================"
print "入侵排查 第一步账号安全 ing------"
display_format = '%-30s %-20s'
print display_format % (&