# 生产环境GRUB2安全配置脚本
# cat > /fgedu/shell/secure_grub.sh << 'EOF' #!/bin/bash # GRUB2生产环境安全配置脚本 # from:www.itpux.com.qq113257174.wx:itpux-com echo "=== GRUB2 Security Configuration ===" echo "Date: $(date)" echo "" # 1. 备份原始配置 echo "1. Backing up original configuration..." cp /etc/default/grub /etc/default/grub.backup.$(date +%Y%m%d) cp /boot/grub2/grub.cfg /boot/grub2/grub.cfg.backup.$(date +%Y%m%d) # 2. 生成强密码 echo "2. Generating strong passwords..." ROOT_PASSWORD=$(openssl rand -base64 24) ADMIN_PASSWORD=$(openssl rand -base64 24) # 生成密码哈希 ROOT_HASH=$(echo -e "$ROOT_PASSWORD\n$ROOT_PASSWORD" | grub2-mkpasswd-pbkdf2 | tail -1 | cut -d' ' -f7) ADMIN_HASH=$(echo -e "$ADMIN_PASSWORD\n$ADMIN_PASSWORD" | grub2-mkpasswd-pbkdf2 | tail -1 | cut -d' ' -f7) # 3. 创建用户配置文件 echo "3. Creating user configuration..." cat > /etc/grub.d/00_users << USEREOF set superusers="root admin" password_pbkdf2 root $ROOT_HASH password_pbkdf2 admin $ADMIN_HASH USEREOF chmod 600 /etc/grub.d/00_users # 4. 配置启动超时 echo "4. Configuring boot timeout..." sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=5/' /etc/default/grub # 5. 配置内核参数 echo "5. Configuring kernel parameters..." sed -i 's/^GRUB_CMDLINE_LINUX=.*/GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=rhel\/root rd.lvm.lv=rhel\/swap rhgb quiet transparent_hugepage=never numa=off"/' /etc/default/grub # 6. 重新生成GRUB2配置 echo "6. Regenerating GRUB2 configuration..." grub2-mkconfig -o /boot/grub2/grub.cfg # 7. 验证配置 echo "7. Verifying configuration..." if grub2-fstest /boot/grub2/grub.cfg; then echo "Configuration is valid" else echo "ERROR: Configuration is invalid" exit 1 fi # 8. 保存密码到安全位置 echo "8. Saving passwords to secure location..." mkdir -p /root/.grub_secrets chmod 700 /root/.grub_secrets cat > /root/.grub_secrets/passwords.txt << PWDEOF GRUB2 Passwords - Generated on $(date) ======================================== Root user password: $ROOT_PASSWORD Admin user password: $ADMIN_PASSWORD ======================================== IMPORTANT: Store these passwords securely! PWDEOF chmod 600 /root/.grub_secrets/passwords.txt # 9. 发送密码到管理员邮箱 echo "9. Sending passwords to administrator..." cat /root/.grub_secrets/passwords.txt | mail -s "GRUB2 Passwords for $(hostname)" admin@fgedu.net.cn echo "" echo "=== Configuration Complete ===" echo "Passwords have been saved to /root/.grub_secrets/passwords.txt" echo "Please store these passwords securely!" echo "" echo "IMPORTANT: After verifying the configuration works correctly," echo "delete the password file: rm /root/.grub_secrets/passwords.txt" EOF # 添加执行权限 # chmod +x /fgedu/shell/secure_grub.sh # 执行配置脚本 # /fgedu/shell/secure_grub.sh

# 创建GRUB2安全检查脚本
# cat > /fgedu/shell/check_grub_security.sh << 'EOF' #!/bin/bash # GRUB2安全检查脚本 # from:www.itpux.com.qq113257174.wx:itpux-com echo "=== GRUB2 Security Check ===" echo "Date: $(date)" echo "" SECURITY_SCORE=0 MAX_SCORE=10 # 检查1：超级用户配置 echo "Check 1: Superuser configuration" if grep -q "set superusers" /boot/grub2/grub.cfg; then echo " PASS: Superusers configured" SECURITY_SCORE=$((SECURITY_SCORE + 1)) else echo " FAIL: No superusers configured" fi # 检查2：密码配置 echo "Check 2: Password configuration" if grep -q "password_pbkdf2" /boot/grub2/grub.cfg; then echo " PASS: Passwords configured" SECURITY_SCORE=$((SECURITY_SCORE + 1)) else echo " FAIL: No passwords configured" fi # 检查3：配置文件权限 echo "Check 3: Configuration file permissions" if [ $(stat -c %a /etc/grub.d/00_users 2>/dev/null) = “600” ]; then
echo ” PASS: File permissions are secure”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” FAIL: File permissions are not secure”
fi

# 检查4：配置文件语法
echo “Check 4: Configuration file syntax”
if grub2-fstest /boot/grub2/grub.cfg; then
echo ” PASS: Configuration file is valid”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” FAIL: Configuration file is invalid”
fi

# 检查5：启动超时设置
echo “Check 5: Boot timeout setting”
TIMEOUT=$(grep “^set timeout” /boot/grub2/grub.cfg | cut -d’ ‘ -f2)
if [ “$TIMEOUT” -le 10 ] && [ “$TIMEOUT” -ge 3 ]; then
echo ” PASS: Boot timeout is appropriate ($TIMEOUT seconds)”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” WARN: Boot timeout may need adjustment ($TIMEOUT seconds)”
fi

# 检查6：内核参数配置
echo “Check 6: Kernel parameters”
if grep -q “transparent_hugepage=never” /boot/grub2/grub.cfg; then
echo ” PASS: Kernel parameters are optimized”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” INFO: Consider adding kernel parameters”
fi

# 检查7：菜单项保护
echo “Check 7: Menu entry protection”
PROTECTED_ENTRIES=$(grep “menuentry.*–users” /boot/grub2/grub.cfg | wc -l)
if [ “$PROTECTED_ENTRIES” -gt 0 ]; then
echo ” PASS: $PROTECTED_ENTRIES menu entries are protected”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” INFO: Consider protecting sensitive menu entries”
fi

# 检查8：配置文件备份
echo “Check 8: Configuration file backup”
if [ -f /boot/grub2/grub.cfg.backup.* ]; then
echo ” PASS: Configuration backup exists”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” WARN: No configuration backup found”
fi

# 检查9：审计配置
echo “Check 9: Audit configuration”
if auditctl -l | grep -q “grub_config”; then
echo ” PASS: Audit rules are configured”
SECURITY_SCORE=$((SECURITY_SCORE + 1))
else
echo ” INFO: Consider configuring audit rules”
fi

# 检查10：密码强度
echo “Check 10: Password strength”
# 这里可以添加密码强度检查逻辑
echo ” INFO: Manual password strength review recommended”
SECURITY_SCORE=$((SECURITY_SCORE + 1))

echo “”
echo “=== Security Score: $SECURITY_SCORE/$MAX_SCORE ===”

if [ $SECURITY_SCORE -ge 8 ]; then
echo “Overall: EXCELLENT”
exit 0
elif [ $SECURITY_SCORE -ge 6 ]; then
echo “Overall: GOOD”
exit 0
elif [ $SECURITY_SCORE -ge 4 ]; then
echo “Overall: FAIR”
exit 1
else
echo “Overall: POOR”
exit 2
fi
EOF

# 添加执行权限
# chmod +x /fgedu/shell/check_grub_security.sh

# 执行安全检查
# /fgedu/shell/check_grub_security.sh