Audit.sh

#!/bin/bash
#author: salman sk
# Configuration file path
CONFIG_FILE="config.conf"

# Function to log output
log_output() {
    echo "$1" | tee -a "$LOG_FILE"
}

if [ ! -f "$CONFIG_FILE" ]; then
    echo "Configuration file not found. Exiting..."
    exit 1
fi

source "$CONFIG_FILE"

# Clear the screen
tput clear

LOG_DIR="logs"
mkdir -p "$LOG_DIR"
LOG_FILE="$LOG_DIR/$(date '+%Y-%m-%d_%H-%M-%S')_LinuxAudit.log"

log_output "###############################################"
log_output "###############################################"
log_output
log_output "###############################################"
log_output "Welcome to security audit of your Linux machine:"
log_output "###############################################"
log_output
log_output "Script will automatically gather the required info:"
log_output "The checklist can help you in the process of hardening your system:"
log_output
sleep 3

log_output
log_output "OK... $HOSTNAME ...let's continue, please wait for it to finish:"
log_output
sleep 3
log_output
log_output "Script Starts ;)"
START=$(date +%s)
log_output

# Function to perform audit and write to file
perform_audit() {
    log_output
    log_output -e "\e[0;33m 1. Linux Kernel Information////// \e[0m"
    log_output
    uname -a | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 2. Current User and ID information////// \e[0m"
    log_output
    whoami | tee -a "$LOG_FILE"
    log_output
    id | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 3. Linux Distribution Information///// \e[0m"
    log_output
    cat /etc/redhat-release | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 4. List Current Logged In Users///// \e[0m"
    log_output
    w | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 5. $HOSTNAME Uptime Information///// \e[0m"
    log_output
    uptime | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 6. Running Services///// \e[0m"
    log_output
    systemctl list-units --type=service --state=running | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 7. Active Internet Connections and Open Ports///// \e[0m"
    log_output
    netstat -natp | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 8. Check Available Space///// \e[0m"
    log_output
    df -h | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 9. Check Memory///// \e[0m"
    log_output
    free -h | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 10. History (Commands)///// \e[0m"
    log_output
    history | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 11. Network Interfaces///// \e[0m"
    log_output
    ifconfig -a | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 12. IPtable Information///// \e[0m"
    log_output
    iptables -L -n -v | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 13. Check Running Processes///// \e[0m"
    log_output
    ps -a | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 14. Check SSH Configuration///// \e[0m"
    log_output
    cat /etc/ssh/sshd_config | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output -e "\e[0;33m 15. List All Packages Installed///// \e[0m"
    log_output
    yum list installed | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 16. Network Parameters///// \e[0m"
    log_output
    cat /etc/sysctl.conf | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 17. Password Policies///// \e[0m"
    log_output
    cat /etc/pam.d/system-auth | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 18. Check your Repository Configuration///// \e[0m"
    log_output
    cat /etc/yum.repos.d/* | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 19. Check for Broken Dependencies///// \e[0m"
    log_output
    yum check | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 20. MOTD Banner Message///// \e[0m"
    log_output
    cat /etc/motd | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 21. List User Names///// \e[0m"
    log_output
    cut -d: -f1 /etc/passwd | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 22. Check for Null Passwords///// \e[0m"
    log_output
    users="$(cut -d: -f 1 /etc/passwd)"
    for x in $users
    do
        passwd -S $x |grep "NP" | tee -a "$LOG_FILE"
    done
    log_output
    log_output "###############################################"
    log_output
    log_output -e "\e[0;33m 23. Display Password File///// \e[0m"
    log_output
    cat /etc/passwd | tee -a "$LOG_FILE"
    log_output
    log_output "###############################################"

    END=$(date +%s)
    DIFF=$(( $END - $START ))
    log_output "It took $DIFF seconds"
}

# Perform the audit
perform_audit

log_output "Script completed successfully."