检查用户脚本

[tex=code]#!/bin/bash

# Usage: check and repair user
# History:
# 20140918 hean debug 1.0
LOG=usercheck.log

IP=`ifconfig eth1|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
if [ "$IP"x = ""x ]; then
IP=`awk -F '[=]' '{print $2}' /etc/sinainstall.conf`
fi

if [ "$IP"x = ""x ]; then
IP=`ifconfig eth0|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
fi

rm -f $IP"_"$LOG
touch $IP"_"$LOG

RSYNC=10.217.13.242::hean/usercheck/log/

function Check()
{
while read user;do
  echo -e "\n\n**************check $user************************"
  #check if user exist
  id $user && r=0 || r=1
  if [ $r -eq 1 ];then
   echo "$user not exist! run /var/cfengine/bin/cfagent -qv -K"
   continue
  fi
  
  #check shadow
  status=`grep $user /etc/shadow  | awk -F '[:]' '{print $2}'`
  if [ "$status"x = "!"x ];then
   echo "$user is disallowed to login, modify the shadow..."
   sed -i "s/$user:\!/$user:\*/g" /etc/shadow
  else
   echo "shadow ok!"
  fi
  
  #check .ssh
  if [ ! -f /usr/home/$user/.ssh/authorized_keys ];then
   echo "/usr/home/$user/.ssh/authorized_keys not exist! run /var/cfengine/bin/cfagent -qv -K"
   continue
  fi
  
  #check home dir permission
  mod=`ls -l /usr/home/ | grep " $user" | awk '{print $1}'`
  if [ "$mod"x != "drwxr-xr-x"x ];then
   echo "home dir permission error! chmod to 755..."
   chmod 755 /usr/home/$user
  else
   echo "home dir ok!"
  fi
  
  #check .ssh dir permission
  mod=`ls -la /usr/home/$user | grep -E "\.ssh" | awk '{print $1}'`
  if [ "$mod"x != "drwx------"x ];then
   echo ".ssh dir permission error! chmod to 755..."
   chmod 700 /usr/home/$user/.ssh
  else
   echo ".ssh dir ok!"
  fi
  
  #check authorized_keys permission
  mod=`ls -l /usr/home/$user/.ssh | grep "authorized_keys" | awk '{print $1}'`
  if [ "$mod"x != "-rw-r--r--"x ];then
   echo "authorized_keys permission error! chmod to 755..."
   chmod 644 /usr/home/$user/.ssh/authorized_keys
  else
   echo "authorized_keys file ok!"
  fi
  
  #check home dir owner
  owner=`ls -l /usr/home/ | grep " $user" | awk '{print $3}'`
  if [ "$owner"x != "$user"x ];then
   echo "home dir owner error! chown to $user.."
   chown -R $user /usr/home/$user
  else
   echo "home dir owner ok!"
  fi
  
  #check home dir group
  group=`ls -l /usr/home/ | grep " $user" | awk '{print $4}'`
  if [ "$group"x != "$user"x ];then
   echo "home dir group error! chown to $user.."
   chown :$user /usr/home/$user
  else
   echo "home dir group ok!"
  fi
  
  #del user line in authorized_keys
  sed -i "/$user/d" /usr/home/$user/.ssh/authorized_keys
done <dat
}


# Check if user is root
if [ $(id -u) != "0" ]; then
    printf "Error: You must be root to run this script!\n"
    exit 1
fi

Check 2>&1 | tee -a $IP"_"$LOG
rsync $IP"_"$LOG $RSYNC[/tex]

[tex=code]#!/bin/bash
set -x
# Usage: check and repair user
# History:
#        20140918 hean debug 1.0
#        20141104 hean 修复过滤不严bug
LOG=usercheck.log

IP=`ifconfig eth1|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
if [ "$IP"x = ""x ]; then
        IP=`awk -F '[=]' '{print $2}' /etc/sinainstall.conf`
fi

if [ "$IP"x = ""x ]; then
        IP=`ifconfig eth0|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
fi

rm -f $IP"_"$LOG
touch $IP"_"$LOG

RSYNC=10.217.13.242::hean/usercheck/log/

function Check()
{
        while read user;do
                echo -e "\n\n**************check $user @ $IP************************"
                #check if user exist
                id $user && r=0 || r=1
                if [ $r -eq 1 ];then
                        echo "$user not exist! run /var/cfengine/bin/cfagent -qv -K"
                        continue
                fi
               
                #check shadow
                status=`grep "^$user:" /etc/shadow  | awk -F '[:]' '{print $2}'`
                if [ "$status"x = "!!"x ];then
                        echo "$user is disallowed to login, modify the shadow..."
                        sed -i "s/^$user:\!\!/$user:\*/g" /etc/shadow
                else
                        echo "shadow ok!"
                fi
               
                #check .ssh
                if [ ! -f /usr/home/$user/.ssh/authorized_keys ];then
                        echo "/usr/home/$user/.ssh/authorized_keys not exist! run /var/cfengine/bin/cfagent -qv -K"
                        continue
                fi
               
                #check home dir permission
                mod=`ls -l /usr/home/ | grep " $user\$" | awk '{print $1}'`
                if [ "$mod"x != "drwxr-xr-x"x ];then
                        echo "home dir permission error! chmod to 755..."
                        chmod 755 /usr/home/$user
                else
                        echo "home dir ok!"
                fi
               
                #check .ssh dir permission
                mod=`ls -la /usr/home/$user | grep -E "\.ssh" | awk '{print $1}'`
                if [ "$mod"x != "drwx------"x ];then
                        echo ".ssh dir permission error! chmod to 755..."
                        chmod 700 /usr/home/$user/.ssh
                else
                        echo ".ssh dir ok!"
                fi
               
                #check authorized_keys permission
                mod=`ls -l /usr/home/$user/.ssh | grep "authorized_keys" | awk '{print $1}'`
                if [ "$mod"x != "-rw-r--r--"x ];then
                        echo "authorized_keys permission error! chmod to 755..."
                        chmod 644 /usr/home/$user/.ssh/authorized_keys
                else
                        echo "authorized_keys file ok!"
                fi
               
                #check home dir owner
                owner=`ls -l /usr/home/ | grep " $user\$" | awk '{print $3}'`
                if [ "$owner"x != "$user"x ];then
                        echo "home dir owner error! chown to $user.."
                        chown -R $user /usr/home/$user
                else
                        echo "home dir owner ok!"
                fi
               
                #check home dir group
                group=`ls -l /usr/home/ | grep " $user\$" | awk '{print $4}'`
                if [ "$group"x != "$user"x ];then
                        echo "home dir group error! chown to $user.."
                        chown :$user /usr/home/$user
                else
                        echo "home dir group ok!"
                fi
               
                #del user line in authorized_keys
                sed -i "/$user/d" /usr/home/$user/.ssh/authorized_keys
        done <dat
}


# Check if user is root
if [ $(id -u) != "0" ]; then
    printf "Error: You must be root to run this script!\n"
    exit 1
fi

Check 2>&1 | tee -a $IP"_"$LOG
rsync $IP"_"$LOG $RSYNC
[/tex]

[tex=code][root@localhost usercheck]# vim test
[root@localhost usercheck]# sed "s/!/*/g" test
-bash: !/*/g": event not found
[root@localhost usercheck]# sed 's/!/*/g' test
***********
[root@localhost usercheck]# sed "s/\!/*/g" test
***********
[root@localhost usercheck]# sed "s/\!/\*/g" test
***********
[root@localhost usercheck]# cat test
!!!!!!!!!!!
[root@localhost usercheck]# [/tex]

[tex=code]
#!/bin/bash
#set -x
# Usage: check and repair user
# History:
#        20140918 hean debug 1.0
#        20141104 hean 修复过滤不严bug
#        20141106 hean 检查/etc/下passwd,shadow等文件隐藏权限
LOG=usercheck.log

IP=`ifconfig eth1|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
if [ "$IP"x = ""x ]; then
        IP=`awk -F '[=]' '{print $2}' /etc/sinainstall.conf`
fi

if [ "$IP"x = ""x ]; then
        IP=`ifconfig eth0|grep "inet addr"|awk '{print $2}'|awk -F '[:]' '{print $2}'`
fi

rm -f $IP"_"$LOG
touch $IP"_"$LOG

RSYNC=10.217.13.242::hean/usercheck/log/

CONF=(
/etc/shadow
/etc/passwd
/etc/group
)

function CheckAttr()
{
        for id in ${CONF

}
        do
                lsattr $id |grep "\-i\-" &>/dev/null && r=0 || r=1
                if [ $r -eq 0 ]; then
                        echo "$id has attribute i ,cfengine can not modify $id ,before you run cfengine you must remove the attribute i"
                        echo "use the command : chattr -i $id "
                fi
        done
}
function Check()
{
        while read user;do
                echo -e "\n\n**************check $user @ $IP************************"
                #check if user exist
                id $user && r=0 || r=1
                if [ $r -eq 1 ];then
                        echo "$user not exist! run /var/cfengine/bin/cfagent -qv -K"
                        continue
                fi
               
                #check shadow
                status=`grep "^$user:" /etc/shadow  | awk -F '[:]' '{print $2}'`
                if [ "$status"x = "!!"x ];then
                        echo "$user is disallowed to login, modify the shadow..."
                        sed -i "s/^$user:\!\!/$user:\*/g" /etc/shadow
                else
                        echo "shadow ok!"
                fi
               
                #check .ssh
                if [ ! -f /usr/home/$user/.ssh/authorized_keys ];then
                        echo "/usr/home/$user/.ssh/authorized_keys not exist! run /var/cfengine/bin/cfagent -qv -K"
                        continue
                fi
               
                #check home dir permission
                mod=`ls -l /usr/home/ | grep " $user\$" | awk '{print $1}'`
                if [ "$mod"x != "drwxr-xr-x"x ];then
                        echo "home dir permission error! chmod to 755..."
                        chmod 755 /usr/home/$user
                else
                        echo "home dir ok!"
                fi
               
                #check .ssh dir permission
                mod=`ls -la /usr/home/$user | grep -E "\.ssh" | awk '{print $1}'`
                if [ "$mod"x != "drwx------"x ];then
                        echo ".ssh dir permission error! chmod to 755..."
                        chmod 700 /usr/home/$user/.ssh
                else
                        echo ".ssh dir ok!"
                fi
               
                #check authorized_keys permission
                mod=`ls -l /usr/home/$user/.ssh | grep "authorized_keys" | awk '{print $1}'`
                if [ "$mod"x != "-rw-r--r--"x ];then
                        echo "authorized_keys permission error! chmod to 755..."
                        chmod 644 /usr/home/$user/.ssh/authorized_keys
                else
                        echo "authorized_keys file ok!"
                fi
               
                #check home dir owner
                owner=`ls -l /usr/home/ | grep " $user\$" | awk '{print $3}'`
                if [ "$owner"x != "$user"x ];then
                        echo "home dir owner error! chown to $user.."
                        chown -R $user /usr/home/$user
                else
                        echo "home dir owner ok!"
                fi
               
                #check home dir group
                group=`ls -l /usr/home/ | grep " $user\$" | awk '{print $4}'`
                if [ "$group"x != "$user"x ];then
                        echo "home dir group error! chown to $user.."
                        chown :$user /usr/home/$user
                else
                        echo "home dir group ok!"
                fi
               
                #del user line in authorized_keys
                sed -i "/$user/d" /usr/home/$user/.ssh/authorized_keys
        done <dat
}


# Check if user is root
if [ $(id -u) != "0" ]; then
    printf "Error: You must be root to run this script!\n"
    exit 1
fi

CheckAttr 2>&1 | tee -a $IP"_"$LOG
Check 2>&1 | tee -a $IP"_"$LOG
rsync $IP"_"$LOG $RSYNC
[/tex]