audit
installsforks
How to install audit?
chaterm/terminal-skills/audit
$npx -y skills add chaterm/terminal-skills --skill audit安全审计
SKILL.md
| 1 | # 安全审计 |
| 2 | |
| 3 | ## 概述 |
| 4 | 安全审计、漏洞扫描、合规检查技能。 |
| 5 | |
| 6 | ## auditd 审计系统 |
| 7 | |
| 8 | ### 安装与管理 |
| 9 | ```bash |
| 10 | # 安装 |
| 11 | apt install auditd audispd-plugins # Debian/Ubuntu |
| 12 | yum install audit # CentOS/RHEL |
| 13 | |
| 14 | # 服务管理 |
| 15 | systemctl start auditd |
| 16 | systemctl enable auditd |
| 17 | systemctl status auditd |
| 18 | ``` |
| 19 | |
| 20 | ### 审计规则 |
| 21 | ```bash |
| 22 | # 查看规则 |
| 23 | auditctl -l |
| 24 | |
| 25 | # 添加规则 - 监控文件 |
| 26 | auditctl -w /etc/passwd -p wa -k passwd_changes |
| 27 | auditctl -w /etc/shadow -p wa -k shadow_changes |
| 28 | auditctl -w /etc/sudoers -p wa -k sudoers_changes |
| 29 | |
| 30 | # 监控目录 |
| 31 | auditctl -w /etc/ssh/ -p wa -k ssh_config |
| 32 | |
| 33 | # 监控系统调用 |
| 34 | auditctl -a always,exit -F arch=b64 -S execve -k command_exec |
| 35 | |
| 36 | # 监控用户操作 |
| 37 | auditctl -a always,exit -F arch=b64 -S open -F auid>=1000 -k user_file_access |
| 38 | ``` |
| 39 | |
| 40 | ### 永久规则 |
| 41 | ```bash |
| 42 | # /etc/audit/rules.d/audit.rules |
| 43 | -w /etc/passwd -p wa -k passwd_changes |
| 44 | -w /etc/shadow -p wa -k shadow_changes |
| 45 | -w /etc/sudoers -p wa -k sudoers_changes |
| 46 | -w /var/log/lastlog -p wa -k logins |
| 47 | -a always,exit -F arch=b64 -S execve -k commands |
| 48 | |
| 49 | # 重载规则 |
| 50 | augenrules --load |
| 51 | ``` |
| 52 | |
| 53 | ### 查看日志 |
| 54 | ```bash |
| 55 | # 搜索审计日志 |
| 56 | ausearch -k passwd_changes |
| 57 | ausearch -k commands -ts today |
| 58 | ausearch -ua root -ts recent |
| 59 | |
| 60 | # 生成报告 |
| 61 | aureport |
| 62 | aureport --summary |
| 63 | aureport --login |
| 64 | aureport --file |
| 65 | aureport --executable |
| 66 | ``` |
| 67 | |
| 68 | ## 日志审计 |
| 69 | |
| 70 | ### 系统日志 |
| 71 | ```bash |
| 72 | # 查看认证日志 |
| 73 | tail -f /var/log/auth.log # Debian/Ubuntu |
| 74 | tail -f /var/log/secure # CentOS/RHEL |
| 75 | |
| 76 | # 查看登录记录 |
| 77 | last |
| 78 | lastb # 失败登录 |
| 79 | lastlog |
| 80 | |
| 81 | # journalctl |
| 82 | journalctl -u sshd |
| 83 | journalctl --since "1 hour ago" |
| 84 | journalctl -p err |
| 85 | ``` |
| 86 | |
| 87 | ### 日志分析 |
| 88 | ```bash |
| 89 | # 统计 SSH 登录失败 |
| 90 | grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn |
| 91 | |
| 92 | # 统计 sudo 使用 |
| 93 | grep "sudo:" /var/log/auth.log | tail -20 |
| 94 | |
| 95 | # 查找异常登录 |
| 96 | grep "Accepted" /var/log/auth.log | grep -v "192.168" |
| 97 | ``` |
| 98 | |
| 99 | ## 漏洞扫描 |
| 100 | |
| 101 | ### Lynis |
| 102 | ```bash |
| 103 | # 安装 |
| 104 | apt install lynis |
| 105 | |
| 106 | # 系统审计 |
| 107 | lynis audit system |
| 108 | |
| 109 | # 查看报告 |
| 110 | cat /var/log/lynis-report.dat |
| 111 | ``` |
| 112 | |
| 113 | ### OpenSCAP |
| 114 | ```bash |
| 115 | # 安装 |
| 116 | yum install openscap-scanner scap-security-guide |
| 117 | |
| 118 | # 扫描 |
| 119 | oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard \ |
| 120 | --results results.xml \ |
| 121 | /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml |
| 122 | |
| 123 | # 生成报告 |
| 124 | oscap xccdf generate report results.xml > report.html |
| 125 | ``` |
| 126 | |
| 127 | ### Nmap 扫描 |
| 128 | ```bash |
| 129 | # 端口扫描 |
| 130 | nmap -sV -sC target.com |
| 131 | |
| 132 | # 漏洞扫描 |
| 133 | nmap --script vuln target.com |
| 134 | |
| 135 | # 全面扫描 |
| 136 | nmap -A -T4 target.com |
| 137 | ``` |
| 138 | |
| 139 | ## 文件完整性 |
| 140 | |
| 141 | ### AIDE |
| 142 | ```bash |
| 143 | # 安装 |
| 144 | apt install aide |
| 145 | |
| 146 | # 初始化数据库 |
| 147 | aide --init |
| 148 | mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db |
| 149 | |
| 150 | # 检查变更 |
| 151 | aide --check |
| 152 | |
| 153 | # 更新数据库 |
| 154 | aide --update |
| 155 | ``` |
| 156 | |
| 157 | ### Tripwire |
| 158 | ```bash |
| 159 | # 初始化 |
| 160 | tripwire --init |
| 161 | |
| 162 | # 检查 |
| 163 | tripwire --check |
| 164 | |
| 165 | # 更新策略 |
| 166 | tripwire --update-policy |
| 167 | ``` |
| 168 | |
| 169 | ## 常见场景 |
| 170 | |
| 171 | ### 场景 1：监控特权操作 |
| 172 | ```bash |
| 173 | # /etc/audit/rules.d/privileged.rules |
| 174 | # 监控 sudo |
| 175 | -w /usr/bin/sudo -p x -k privileged_sudo |
| 176 | -w /etc/sudoers -p wa -k sudoers_edit |
| 177 | |
| 178 | # 监控用户管理 |
| 179 | -w /usr/sbin/useradd -p x -k user_add |
| 180 | -w /usr/sbin/userdel -p x -k user_del |
| 181 | -w /usr/sbin/usermod -p x -k user_mod |
| 182 | |
| 183 | # 监控网络配置 |
| 184 | -w /etc/hosts -p wa -k hosts_edit |
| 185 | -w /etc/network/ -p wa -k network_config |
| 186 | ``` |
| 187 | |
| 188 | ### 场景 2：合规检查脚本 |
| 189 | ```bash |
| 190 | #!/bin/bash |
| 191 | echo "=== 安全合规检查 ===" |
| 192 | |
| 193 | # 检查空密码账户 |
| 194 | echo "空密码账户:" |
| 195 | awk -F: '($2 == "") {print $1}' /etc/shadow |
| 196 | |
| 197 | # 检查 UID 为 0 的账户 |
| 198 | echo "UID=0 账户:" |
| 199 | awk -F: '($3 == 0) {print $1}' /etc/passwd |
| 200 | |
| 201 | # 检查 SSH 配置 |
| 202 | echo "SSH 配置:" |
| 203 | grep -E "^(PermitRootLogin|PasswordAuthentication)" /etc/ssh/sshd_config |
| 204 | |
| 205 | # 检查开放端口 |
| 206 | echo "监听端口:" |
| 207 | ss -tlnp |
| 208 | ``` |
| 209 | |
| 210 | ### 场景 3：登录告警 |
| 211 | ```bash |
| 212 | #!/bin/bash |
| 213 | # /etc/profile.d/login-alert.sh |
| 214 | if [ -n "$SSH_CLIENT" ]; then |
| 215 | IP=$(echo $SSH_CLIENT | awk '{print $1}') |
| 216 | echo "SSH 登录告警: 用户 $USER 从 $IP 登录 $(hostname)" | \ |
| 217 | mail -s "SSH Login Alert" admin@example.com |
| 218 | fi |
| 219 | ``` |
| 220 | |
| 221 | ## 故障排查 |
| 222 | |
| 223 | | 问题 | 排查方法 | |
| 224 | |------|----------| |
| 225 | | 审计日志过大 | 配置日志轮转、过滤规则 | |
| 226 | | 性能影响 | 减少审计规则、优化过滤 | |
| 227 | | 规则不生效 | 检查语法、重载规则 | |
| 228 | |
| 229 | ```bash |
| 230 | # 检查 auditd 状态 |
| 231 | auditctl -s |
| 232 | |
| 233 | # 查看丢失事件 |
| 234 | aureport --summary | grep lost |
| 235 | |
| 236 | # 日志轮转配置 |
| 237 | # /etc/audit/auditd.conf |
| 238 | max_log_file = 50 |
| 239 | num_logs = 5 |
| 240 | max_log_file_action = ROTATE |
| 241 | ``` |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
