feat(host-sec-check): add staged hardening and remediation

2026-10-10 18:59:38 +08:00
parent 86ce602b28
commit cf78d0cab2
7 changed files with 545 additions and 9 deletions
@@ -35,8 +35,30 @@ echo "----- users uid0 / human -----"
 awk -F: '$3==0 || ($3>=1000 && $3<65534) {print}' /etc/passwd
 echo "----- sshd -----"
 grep -E "^(Port|PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null
+sshd -t 2>&1 && echo "sshd_syntax=ok" || echo "sshd_syntax=failed"
+sshd -T 2>/dev/null | grep -iE "^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|permitempty passwords|maxauthtries|x11forwarding|allowtcpforwarding) "
+systemctl is-active ssh.service sshd.service ssh.socket 2>/dev/null
+systemctl is-enabled ssh.service sshd.service ssh.socket 2>/dev/null
 echo "----- last -----"
 last -a | head -15
+echo "----- failed logins -----"
+lastb -a 2>/dev/null | head -15 || true
+echo "----- firewall -----"
+ufw status verbose 2>/dev/null || true
+firewall-cmd --state 2>/dev/null || true
+nft list ruleset 2>/dev/null | head -160 || true
+iptables -S 2>/dev/null | head -160 || true
+echo "----- fail2ban -----"
+fail2ban-client status 2>/dev/null || echo "fail2ban unavailable"
+echo "----- timers -----"
+systemctl list-timers --all --no-pager 2>/dev/null | head -120
+echo "----- privilege groups -----"
+getent group sudo wheel docker lxd libvirt 2>/dev/null || true
+echo "----- outbound connections (numeric) -----"
+ss -tpn 2>/dev/null | head -160 || true
+echo "----- docker security summary -----"
+docker ps -a --format '{{.Names}} ports={{.Ports}}' 2>/dev/null || true
+docker inspect --format '{{.Name}} privileged={{.HostConfig.Privileged}} pid={{.HostConfig.PidMode}} network={{.HostConfig.NetworkMode}} binds={{len .Mounts}}' $(docker ps -aq 2>/dev/null) 2>/dev/null || true
 EOS
 }