linux系统安检脚本

#! /bin/bash
  #作者：技术管理 张浩
  #73958468
  #只适用于cetos7.X版本
 
a='yes'
b='y'
#创建普通账号
while true
do
  read -p "是否需要创建普通用户" c
  if [ "$c" = "$a" -o "$c" = "$b" ]; then
    read -p "enter_name" username
    read -p "enter_password"  password
   `useradd $username`
    echo $password | passwd  --stdin $username
  else
    echo "stop to add users"
    break
  fi
done
#禁用root直接登录
read -p "是否禁用root直接登录 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  sed -i "s/# PermitRootLogin yes/ PermitRootLogin no/g" '/etc/ssh/sshd_config'
else
  echo "you can use the user_root"
fi
# 给系统文件加锁,防止未经许可的删除或添加
read -p "是否给系统用户文件枷锁 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  `chattr +ia /etc/passwd`
  `chattr +ia /etc/shadow`
  `chattr +ia /etc/group`
  `chattr +ia /etc/gshadow`
  `chattr +ia /etc/services`
else
  echo "you can also use host_user file" 
fi
# 关闭SELINUX
read -p "是否关闭沙盒 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" '/etc/selinux/config'
  sed -i "s/SELINUXTYPE=targeted/# SELINUXTYPE=targeted/g" '/etc/selinux/config'
  `setenforce 0`
else
  echo "the selinux = enforcing" 
fi
#修改ssh默认端口
read -p "是否更改ssh端口 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  sed -i "s/# Port 22/Port 222/g" '/etc/ssh/ssh_config'
  `systemctl restart sshd`
else
  echo "ssh_port is not change" 
fi
#修改主机名称

read -p "是否修改主机名 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  read -p "enter the hostname" d
  `hostname $d`
  sed -i "s/localhost.localdomain/$d/g" '/etc/hostname'
  `echo -e "127.0.0.1  $d  localhost"  >> /etc/hosts`
else
  echo "the hostname is not change" 
fi
# 同步系统时间
read -p "是否同步系统时间 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  `rm -rf /etc/localtime` #先删除默认的时区设置
  `ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime` #替换上海/北京作为默认
#  ` /usr/bin/yum -y install ntp ` # 安装ntp
  `/usr/sbin/ntpdate time1.aliyun.com` #执行时间同步
  `/usr/sbin/hwclock --systohc` #系统时钟和硬件时钟同步
  `echo -e "0 0 * * * /usr/sbin/ntpdate time1.aliyun.com  &>/dev/null" >> /var/spool/cron/root` #添加计划任务
  `service crond restart` #重启服务
else
  echo "the hosttime is not change" 
fi
# 安装基础软件包
read -p "是否安装基础软件包 " c
if [ "$c" = "$a" -o "$c" = "$b" ]; then
  `yum install -y apr* autoconf automake bison cloog-ppl compat* cpp curl curl-devel fontconfig fontconfig-devel freetype freetype* freetype-devel gcc gcc-c++ gtk+-devel gd gettext`
else
  echo "未安装" 
fi