Linux服务器权限管理与安全加固：根治越权操作、入侵检测与访问控制

Linux系统权限管理与安全加固是运维工作的核心环节，但多数企业仅停留在基础用户管理层面。本文通过十五个真实安全事件案例，深度解析sudo权限滥用、文件权限配置、SSH安全加固、入侵检测等关键环节，提供完整的权限审计框架和主动防御方案，帮助企业构建纵深安全防护体系。

一、用户权限管理与sudo配置深度优化

1. 用户账户安全审计

（1）账户安全状态全面检查

<strong>#!/bin/bash</strong>
# user_security_audit.sh

echo "====== 用户账户安全审计 ======"
echo "审计时间: $(date)"
echo ""

# 检查空密码账户
echo "1. 空密码账户检查:"
awk -F: '($2 == "") {print $1}' /etc/shadow

# 检查UID为0的异常账户
echo -e "\n2. UID为0的账户:"
awk -F: '($3 == 0) {print $1}' /etc/passwd

# 检查过期账户
echo -e "\n3. 密码过期账户:"
awk -F: '($2 == "!!" || $2 == "*") {print $1}' /etc/shadow

# 检查最近登录用户
echo -e "\n4. 最近登录用户:"
last -n 20

# 检查sudo权限用户
echo -e "\n5. 具有sudo权限的用户:"
getent group sudo | cut -d: -f4
getent group wheel | cut -d: -f4

# 检查用户登录shell
echo -e "\n6. 异常登录shell:"
awk -F: '($7 != "/bin/bash" && $7 != "/bin/sh" && $7 != "/sbin/nologin") {print $1":"$7}' /etc/passwd

# 检查家目录权限
echo -e "\n7. 家目录权限检查:"
for user in $(ls /home); do
    perms=$(stat -c "%a %U:%G" /home/$user <strong>2</strong>>/dev/null)
    if [[ ! "$perms" =~ 700.*$user:$user ]] && [[ ! "$perms" =~ 755.*$user:$user ]]; then
        echo "异常权限: /home/$user - $perms"
    fi
done

（2）用户行为监控脚本

<strong>#!/bin/bash</strong>
# user_behavior_monitor.sh

LOG_FILE="/var/log/user_monitor.log"
ALERT_THRESHOLD=10  # 10分钟内多次失败登录触发告警

# 监控失败登录
monitor_failed_logins() {
    echo "$(date) - 检查失败登录尝试"
    
    # 检查最近的失败登录
    failed_logins=$(grep "Failed password" /var/log/auth.log | grep "$(date '+%b %e %H:%M')" | wc -l)
    
    if [ "$failed_logins" -gt 5 ]; then
        echo "警告: 发现 $failed_logins 次失败登录尝试" | tee -a "$LOG_FILE"
        
        # 提取可疑IP
        suspicious_ips=$(grep "Failed password" /var/log/auth.log | grep "$(date '+%b %e %H')" | awk '{print $11}' | sort | uniq -c | sort -nr)
        echo "可疑IP统计:" | tee -a "$LOG_FILE"
        echo "$suspicious_ips" | tee -a "$LOG_FILE"
    fi
}

# 监控sudo使用
monitor_sudo_usage() {
    echo "$(date) - 检查sudo使用情况"
    
    # 检查非正常时间的sudo使用
    abnormal_sudo=$(grep "sudo:" /var/log/auth.log | grep -v "session opened for user root" | grep "$(date '+%b %e')" | grep -E "(23:|00:|01:|02:|03:|04:|05:)" | head -10)
    
    if [ -n "$abnormal_sudo" ]; then
        echo "警告: 发现非正常时间的sudo使用" | tee -a "$LOG_FILE"
        echo "$abnormal_sudo" | tee -a "$LOG_FILE"
    fi
}

# 监控新用户创建
monitor_new_users() {
    echo "$(date) - 检查新用户创建"
    
    # 检查24小时内创建的用户
    recent_users=$(awk -F: '{print $1,$3,$5}' /etc/passwd | while read user uid desc; do
        if [ -d "/home/$user" ]; then
            create_time=$(stat -c %Y "/home/$user" <strong>2</strong>>/dev/null)
            if [ -n "$create_time" ] && [ $(( $(date +%s) - create_time )) -lt 86400 ]; then
                echo "新用户: $user (UID: $uid) - $desc"
            fi
        fi
    done)
    
    if [ -n "$recent_users" ]; then
        echo "发现新创建的用户:" | tee -a "$LOG_FILE"
        echo "$recent_users" | tee -a "$LOG_FILE"
    fi
}

# 主监控循环
while true; do
    monitor_failed_logins
    monitor_sudo_usage
    monitor_new_users
    sleep 300  # 5分钟检查一次
done

2. Sudo权限精细化管理

（1）Sudo规则安全审计

<strong>#!/bin/bash</strong>
# sudo_policy_audit.sh

echo "====== Sudo策略安全审计 ======"

# 检查sudoers文件语法
echo "1. Sudoers文件语法检查:"
visudo -c

# 分析sudo权限配置
echo -e "\n2. Sudo权限配置分析:"

# 检查无密码sudo权限
echo "无密码sudo配置:"
grep -r "NOPASSWD" /etc/sudoers /etc/sudoers.d/ <strong>2</strong>>/dev/null

# 检查危险命令权限
echo -e "\n危险命令sudo权限:"
dangerous_commands="chmod|chown|rm|dd|mkfs|passwd|visudo|useradd|userdel"

grep -E "$dangerous_commands" /etc/sudoers /etc/sudoers.d/* <strong>2</strong>>/dev/null | while read line; do
    echo "警告: $line"
done

# 检查通配符使用
echo -e "\n通配符sudo配置:"
grep -r "ALL" /etc/sudoers /etc/sudoers.d/ <strong>2</strong>>/dev/null | grep -v "^#" | while read line; do
    if echo "$line" | grep -q "ALL.*=.*ALL"; then
        echo "全权限警告: $line"
    fi
done

# 生成sudo使用报告
echo -e "\n3. Sudo使用统计:"
echo "今日sudo使用次数:"
grep "sudo:" /var/log/auth.log | grep "$(date '+%b %e')" | wc -l

echo -e "\n各用户sudo使用排名:"
grep "sudo:" /var/log/auth.log | grep "session opened" | awk '{print $12}' | sort | uniq -c | sort -nr

（2）最小权限Sudo配置生成器

<strong>#!/bin/bash</strong>
# sudo_policy_generator.sh

# 基于用户角色生成最小权限sudo配置
generate_minimal_sudo_policy() {
    local user=$1
    local role=$2
    
    case $role in
        "web-admin")
            cat << EOF
# Web管理员权限 - $user
User_Alias WEB_ADMINS = $user
Cmnd_Alias WEB_CMDS = /bin/systemctl reload nginx, /bin/systemctl status nginx, /usr/bin/tail -f /var/log/nginx/*.log
Cmnd_Alias WEB_LOGS = /usr/bin/tail -f /var/log/nginx/*, /usr/bin/less /var/log/nginx/*

WEB_ADMINS ALL=(root) WEB_CMDS
WEB_ADMINS ALL=(root) WEB_LOGS
EOF
            ;;
        "db-admin")
            cat << EOF
# 数据库管理员权限 - $user
User_Alias DB_ADMINS = $user
Cmnd_Alias DB_CMDS = /bin/systemctl restart mysql, /bin/systemctl status mysql, /usr/bin/mysqladmin
Cmnd_Alias DB_BACKUP = /usr/bin/mysqldump, /bin/tar

DB_ADMINS ALL=(root) DB_CMDS
DB_ADMINS ALL=(root) DB_BACKUP
EOF
            ;;
        "backup-user")
            cat << EOF
# 备份用户权限 - $user
User_Alias BACKUP_USERS = $user
Cmnd_Alias BACKUP_CMDS = /bin/tar, /usr/bin/rsync, /bin/cp

BACKUP_USERS ALL=(root) BACKUP_CMDS
EOF
            ;;
        *)
            echo "错误: 未知角色 $role"
            return 1
            ;;
    esac
}

# 应用sudo配置
apply_sudo_policy() {
    local user=$1
    local role=$2
    local config_file="/etc/sudoers.d/${user}_${role}"
    
    # 生成配置
    generate_minimal_sudo_policy "$user" "$role" > "$config_file"
    
    # 设置正确权限
    chmod 440 "$config_file"
    chown root:root "$config_file"
    
    # 验证配置
    if visudo -c -f "$config_file"; then
        echo "成功应用$role权限给用户$user"
    else
        echo "配置验证失败，已回滚"
        rm -f "$config_file"
        return 1
    fi
}

# 使用示例
# apply_sudo_policy "zhangsan" "web-admin"
# apply_sudo_policy "lisi" "db-admin"

二、文件系统权限安全加固

1. 关键文件权限审计与修复

（1）系统关键文件权限检查

<strong>#!/bin/bash</strong>
# critical_file_permissions.sh

echo "====== 系统关键文件权限审计 ======"

# 定义关键文件及其预期权限
declare -A critical_files=(
    ["/etc/passwd"]="644"
    ["/etc/shadow"]="600"
    ["/etc/group"]="644"
    ["/etc/gshadow"]="600"
    ["/etc/sudoers"]="440"
    ["/etc/ssh/sshd_config"]="600"
    ["/etc/crontab"]="644"
    ["/etc/cron.allow"]="600"
    ["/etc/cron.deny"]="600"
    ["/var/log/auth.log"]="640"
)

# 检查每个关键文件的权限
for file in "${!critical_files[@]}"; do
    expected_perm="${critical_files[$file]}"
    
    if [ -e "$file" ]; then
        actual_perm=$(stat -c "%a" "$file")
        owner=$(stat -c "%U:%G" "$file")
        
        if [ "$actual_perm" != "$expected_perm" ]; then
            echo "权限异常: $file"
            echo "  当前权限: $actual_perm ($owner), 期望权限: $expected_perm"
            
            # 自动修复（需要root权限）
            if [ "$EUID" -eq 0 ]; then
                read -p "是否修复权限? (y/N): " -n 1 -r
                echo
                if [[ $REPLY =~ ^[Yy]$ ]]; then
                    chmod "$expected_perm" "$file"
                    echo "  已修复: $file -> $expected_perm"
                fi
            fi
        else
            echo "权限正常: $file - $actual_perm ($owner)"
        fi
    else
        echo "文件不存在: $file"
    fi
done

# 检查SUID/SGID文件
echo -e "\nSUID/SGID文件检查:"
find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -lh {} \; <strong>2</strong>>/dev/null | while read line; do
    echo "SUID/SGID: $line"
done

# 检查世界可写文件
echo -e "\n世界可写文件检查:"
find / -xdev -type f -perm -0002 -exec ls -lh {} \; <strong>2</strong>>/dev/null | head -20

（2）自动化权限修复工具

<strong>#!/bin/bash</strong>
# auto_permission_fixer.sh

# 配置文件权限修复规则
apply_permission_fixes() {
    echo "开始应用权限修复..."
    
    # 关键系统文件
    chmod 644 /etc/passwd
    chmod 600 /etc/shadow
    chmod 644 /etc/group
    chmod 600 /etc/gshadow
    chmod 644 /etc/hosts
    chmod 644 /etc/hostname
    
    # SSH相关
    chmod 600 /etc/ssh/sshd_config
    chmod 600 /etc/ssh/ssh_host_*_key
    chmod 644 /etc/ssh/ssh_host_*_key.pub
    
    # Cron相关
    chmod 644 /etc/crontab
    chmod 600 /etc/cron.allow <strong>2</strong>>/dev/null
    chmod 600 /etc/cron.deny <strong>2</strong>>/dev/null
    chmod 600 /var/spool/cron/* <strong>2</strong>>/dev/null
    
    # 日志文件
    chmod 640 /var/log/auth.log
    chmod 640 /var/log/secure
    chmod 640 /var/log/messages
    
    # 用户家目录
    for user in $(ls /home); do
        if [ -d "/home/$user" ]; then
            chmod 700 "/home/$user"
            chown "$user:$user" "/home/$user"
        fi
    done
    
    echo "权限修复完成"
}

# 检查并移除危险的SUID/SGID
remove_dangerous_suid() {
    echo "检查危险的SUID/SGID程序..."
    
    # 定义应该具有SUID的程序白名单
    local suid_whitelist=(
        "/usr/bin/passwd"
        "/usr/bin/sudo"
        "/usr/bin/chsh"
        "/usr/bin/chfn"
        "/usr/bin/gpasswd"
        "/usr/bin/newgrp"
        "/bin/su"
        "/bin/mount"
        "/bin/umount"
        "/bin/ping"
    )
    
    # 查找所有SUID文件
    find / -type f -perm /4000 <strong>2</strong>>/dev/null | while read file; do
        local found=0
        for allowed in "${suid_whitelist[@]}"; do
            if [ "$file" = "$allowed" ]; then
                found=1
                break
            fi
        done
        
        if [ $found -eq 0 ]; then
            echo "警告: 发现非白名单SUID程序: $file"
            read -p "是否移除SUID位? (y/N): " -n 1 -r
            echo
            if [[ $REPLY =~ ^[Yy]$ ]]; then
                chmod u-s "$file"
                echo "已移除: $file"
            fi
        fi
    done
}

# 主函数
main() {
    if [ "$EUID" -ne 0 ]; then
        echo "需要root权限运行此脚本"
        exit 1
    fi
    
    apply_permission_fixes
    remove_dangerous_suid
}

main "$@"

三、SSH服务安全加固实战

1. SSH配置深度安全优化

（1）SSH安全配置生成器

<strong>#!/bin/bash</strong>
# ssh_hardening_config.sh

generate_secure_ssh_config() {
    local port=${1:-6022}
    local permit_users=${2:-"ubuntu admin"}
    
    cat << EOF
# SSH安全加固配置
# 生成时间: $(date)

Port $port
Protocol 2
ListenAddress 0.0.0.0

# 认证配置
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no

# 用户访问控制
AllowUsers $permit_users
DenyUsers root bin daemon adm lp sync shutdown halt mail news uucp operator games gopher ftp nobody nscd vcsa rpc mailnull smmsp pcap ntp dbus avahi sshd rpcuser nfsnobody haldaemon avahi-autoipd distcache apache oprofile webalizer dovecot squid named xfs gdm sabayon
AllowGroups ssh-users

# 加密算法配置
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256

# 会话配置
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 60

# 其他安全配置
UsePAM yes
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
UseDNS no
Compression no

# 日志配置
SyslogFacility AUTH
LogLevel VERBOSE

# 限制监听地址（根据实际情况调整）
# ListenAddress 192.168.1.100
EOF
}

# 应用SSH配置
apply_ssh_config() {
    local port=$1
    local permit_users=$2
    local backup_file="/etc/ssh/sshd_config.backup.$(date +%Y%m%d_%H%M%S)"
    
    # 备份原配置
    cp /etc/ssh/sshd_config "$backup_file"
    echo "原配置已备份到: $backup_file"
    
    # 生成新配置
    generate_secure_ssh_config "$port" "$permit_users" > /etc/ssh/sshd_config
    
    # 验证配置
    if sshd -t; then
        echo "SSH配置验证成功"
        systemctl restart sshd
        echo "SSH服务已重启，新端口: $port"
        
        # 显示防火墙规则建议
        echo -e "\n防火墙规则建议:"
        echo "ufw allow $port/tcp"
        echo "ufw deny 22/tcp"
    else
        echo "SSH配置验证失败，已恢复备份"
        cp "$backup_file" /etc/ssh/sshd_config
        return 1
    fi
}

# 使用示例
# apply_ssh_config 6022 "ubuntu admin"

（2）SSH访问监控与防御

<strong>#!/bin/bash</strong>
# ssh_intrusion_detection.sh

# 配置参数
FAILED_LIMIT=5  # 失败次数限制
BAN_TIME=3600   # 封禁时间（秒）
WHITELIST_IPS=("192.168.1.0/24" "10.0.0.1")

# 检查失败登录并封禁
check_failed_logins() {
    echo "$(date) - 检查SSH失败登录"
    
    # 获取失败登录记录
    grep "Failed password" /var/log/auth.log | grep "$(date '+%b %e %H:%M')" | awk '{print $11}' | sort | uniq -c | while read count ip; do
        if [ "$count" -ge "$FAILED_LIMIT" ]; then
            # 检查IP是否在白名单
            local is_whitelisted=0
            for whitelist_ip in "${WHITELIST_IPS[@]}"; do
                if ipcalc -s -c "$ip" "$whitelist_ip" <strong>2</strong>>/dev/null; then
                    is_whitelisted=1
                    break
                fi
            done
            
            if [ "$is_whitelisted" -eq 0 ]; then
                echo "检测到SSH暴力破解: $ip (失败 $count 次)"
                
                # 使用iptables封禁
                if ! iptables -C INPUT -s "$ip" -j DROP <strong>2</strong>>/dev/null; then
                    iptables -A INPUT -s "$ip" -j DROP
                    echo "已封禁IP: $ip"
                    
                    # 记录封禁日志
                    echo "$(date): 封禁IP $ip, 失败次数: $count" >> /var/log/ssh_ban.log
                    
                    # 设置自动解封
                    (sleep "$BAN_TIME" && iptables -D INPUT -s "$ip" -j DROP && echo "已解封IP: $ip") &
                fi
            fi
        fi
    done
}

# 监控SSH连接数
monitor_ssh_connections() {
    local max_connections=10
    
    connection_count=$(netstat -tn | grep ':22 ' | grep ESTABLISHED | wc -l)
    
    if [ "$connection_count" -gt "$max_connections" ]; then
        echo "警告: SSH连接数异常 - $connection_count"
        
        # 获取连接详情
        echo "当前SSH连接:"
        netstat -tn | grep ':22 ' | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
    fi
}

# 检查异常登录时间
check_abnormal_login_time() {
    echo "$(date) - 检查异常时间登录"
    
    # 检查非工作时间的成功登录
    abnormal_logins=$(grep "Accepted password" /var/log/auth.log | grep -E "$(date '+%b %e') (22:|23:|00:|01:|02:|03:|04:|05:|06:)" | head -10)
    
    if [ -n "$abnormal_logins" ]; then
        echo "发现异常时间登录:"
        echo "$abnormal_logins"
        
        # 发送告警（需要配置邮件）
        # echo "$abnormal_logins" | mail -s "异常SSH登录告警" admin@company.com
    fi
}

# 主监控循环
while true; do
    check_failed_logins
    monitor_ssh_connections
    check_abnormal_login_time
    sleep 60
done

四、入侵检测与应急响应

1. 文件完整性监控

（1）AIDE配置与监控

<strong>#!/bin/bash</strong>
# file_integrity_monitor.sh

# 初始化AIDE数据库
init_aide_database() {
    echo "初始化AIDE数据库..."
    
    # 安装AIDE
    if ! command -v aide >/dev/null <strong>2</strong>><strong>&1</strong>; then
        apt-get install aide -y  # Ubuntu/Debian
        # yum install aide -y    # CentOS/RHEL
    fi
    
    # 生成初始配置
    aide --init
    
    # 移动数据库到正确位置
    mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
    
    echo "AIDE数据库初始化完成"
}

# 自定义AIDE配置
generate_aide_config() {
    local config_file="/etc/aide/aide.conf"
    
    cat > "$config_file" << 'EOF'
# AIDE安全监控配置

# 定义监控规则
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide

# 监控规则定义
MyRule = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha512

# 应用规则
/etc MyRule
/bin MyRule
/sbin MyRule
/usr/bin MyRule
/usr/sbin MyRule
/var MyRule
/boot MyRule
/lib MyRule
/lib64 MyRule
/opt MyRule
/home MyRule
/root MyRule

# 排除目录
!/proc
!/sys
!/tmp
!/var/tmp
!/var/run
!/var/cache
!/var/log/aide
!/dev

# 报告设置
report_url=file:@@{LOGDIR}/aide.log
report_url=stdout
EOF

    echo "AIDE配置已更新"
}

# 执行完整性检查
run_integrity_check() {
    echo "开始文件完整性检查..."
    
    # 更新数据库
    aide --update
    
    # 执行检查
    aide --check
    
    # 生成报告
    local report_file="/var/log/aide/report_$(date +%Y%m%d_%H%M%S).txt"
    aide --check > "$report_file" <strong>2</strong>><strong>&1</strong>
    
    # 检查是否有变更
    if grep -q "added files:\|changed files:\|removed files:" "$report_file"; then
        echo "发现文件变更，详情见: $report_file"
        
        # 发送告警
        send_alert "文件完整性检查发现变更" "$report_file"
    else
        echo "文件完整性检查通过"
        rm "$report_file"
    fi
}

# 发送告警
send_alert() {
    local subject=$1
    local report_file=$2
    
    # 这里可以集成邮件、Slack、钉钉等告警方式
    echo "告警: $subject"
    echo "报告文件: $report_file"
    
    # 邮件告警示例
    # mail -s "$subject" admin@company.com < "$report_file"
}

# 定时检查任务
setup_aide_cron() {
    echo "设置AIDE定时检查..."
    
    # 每天凌晨2点执行检查
    cat > /etc/cron.d/aide << EOF
0 2 * * * root /usr/bin/aide --check | mail -s "AIDE检查报告" admin@company.com
EOF

    echo "定时任务已配置"
}

# 主函数
main() {
    if [ "$EUID" -ne 0 ]; then
        echo "需要root权限运行此脚本"
        exit 1
    fi
    
    case "${1:-}" in
        "init")
            init_aide_database
            generate_aide_config
            ;;
        "check")
            run_integrity_check
            ;;
        "setup")
            setup_aide_cron
            ;;
        *)
            echo "用法: $0 {init|check|setup}"
            exit 1
            ;;
    esac
}

main "$@"

2. 异常进程检测

（1）进程行为监控系统

<strong>#!/bin/bash</strong>
# process_behavior_monitor.sh

# 监控异常进程行为
monitor_suspicious_processes() {
    echo "$(date) - 监控异常进程"
    
    # 检查隐藏进程
    echo "检查隐藏进程:"
    ps -ef | awk '{print $2}' | sort -n | uniq > /tmp/current_pids
    ls /proc | grep -E '^[0-9]+$' | sort -n > /tmp/proc_pids
    
    diff /tmp/current_pids /tmp/proc_pids | grep '^>' | awk '{print $2}' | while read pid; do
        echo "发现隐藏进程: PID $pid"
        # 进一步分析进程信息
        if [ -d "/proc/$pid" ]; then
            echo "进程信息:"
            cat "/proc/$pid/status" | head -10
            echo "可执行文件:"
            ls -la "/proc/$pid/exe" <strong>2</strong>>/dev/null
        fi
    done
    
    # 检查异常网络连接
    echo -e "\n检查异常网络连接:"
    netstat -tunap | grep -v ESTABLISHED | while read line; do
        if echo "$line" | grep -q -E "(:1337|:31337|:54321)"; then
            echo "可疑端口连接: $line"
        fi
    done
    
    # 检查异常进程名
    suspicious_names=("miner" "backdoor" "bot" "xmr" "minerd")
    for name in "${suspicious_names[@]}"; do
        if pgrep -f "$name" >/dev/null; then
            echo "发现可疑进程: $name"
            pkill -f "$name"
        fi
    done
}

# 监控进程资源异常
monitor_process_resources() {
    echo "$(date) - 监控进程资源使用"
    
    # 检查CPU使用异常的进程
    ps -eo pid,ppid,pcpu,pmem,comm --sort=-pcpu | head -10 | while read pid ppid cpu mem comm; do
        if [ "$pid" != "PID" ] && [ "${cpu%.*}" -gt 80 ]; then
            echo "高CPU进程: $comm (PID: $pid, CPU: $cpu%)"
        fi
    done
    
    # 检查内存使用异常的进程
    ps -eo pid,ppid,pcpu,pmem,comm --sort=-pmem | head -10 | while read pid ppid cpu mem comm; do
        if [ "$pid" != "PID" ] && [ "${mem%.*}" -gt 20 ]; then
            echo "高内存进程: $comm (PID: $pid, 内存: $mem%)"
        fi
    done
}

# 检查进程权限升级
monitor_privilege_escalation() {
    echo "$(date) - 检查权限升级行为"
    
    # 检查setuid程序执行
    grep -r "setuid" /var/log/auth.log <strong>2</strong>>/dev/null | tail -5 | while read line; do
        echo "setuid执行: $line"
    done
    
    # 检查sudo提权
    grep "sudo:" /var/log/auth.log | grep "session opened" | tail -5 | while read line; do
        user=$(echo "$line" | awk '{print $12}')
        if [ "$user" != "root" ]; then
            echo "sudo提权: $line"
        fi
    done
}

# 主监控循环
while true; do
    monitor_suspicious_processes
    monitor_process_resources
    monitor_privilege_escalation
    sleep 300  # 5分钟检查一次
done

总结

Linux系统权限管理与安全加固是一个系统工程，需要从用户管理、文件权限、服务配置到入侵检测的全方位防护。通过本文提供的审计脚本、加固方案和监控工具，企业可以构建完善的主动防御体系。建议定期进行安全审计，及时更新安全策略，并建立完善的应急响应机制。

1 本网站名称： VC博客
2 本站永久网址：vcvcc.cc
3 本站资源如有解压密码，则为：vcvcc.cc
4 本网站的文章部分内容可能来源于网络，仅供大家学习与参考，如有侵权，请联系站长 QQ378214732进行删除处理。
5 本站一切资源不代表本站立场，并不代表本站赞同其观点和对其真实性负责。
6 本站一律禁止以任何方式发布或转载任何违法的相关信息，访客发现请向站长举报
7 本站资源大都存储在云盘，如发现链接失效，请联系我们我们会第一时间更新。
8 如无特别声明本文即为原创文章仅代表个人观点，版权归《VC博客》所有，欢迎转载，转载请保留原文链接。

THE END