服务器日志审计：发现入侵的蛛丝马迹

# 查看失败的SSH登录尝试
grep "Failed password" /var/log/auth.log | tail -20

# 统计每个IP的失败登录次数
grep "Failed password" /var/log/auth.log | \
  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

# 查看成功的SSH登录
grep "Accepted" /var/log/auth.log | tail -20

# 检测非工作时间的登录
grep "Accepted" /var/log/auth.log | \
  awk '{print $1, $2, $3}' | \
  while read month day time; do
    hour=$(echo $time | cut -d: -f1)
    if [ "$hour" -lt 6 ] || [ "$hour" -gt 22 ]; then
      echo "可疑登录时间: $month $day $time"
    fi
  done

# 检查sudo使用记录
grep "sudo:" /var/log/auth.log | tail -20

# 查看sudo失败记录（可能的权限提升尝试）
grep "sudo:.*authentication failure" /var/log/auth.log

# 检查su命令使用
grep "su:" /var/log/auth.log | grep -v "session"

# 查找异常的HTTP状态码（可能的扫描行为）
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# 查找SQL注入尝试
grep -iE "(union.*select|or.*1.*=.*1|drop.*table|insert.*into)" /var/log/nginx/access.log

# 查找目录遍历尝试
grep -E "\.\./|\.\.%2f" /var/log/nginx/access.log

# 查找WebShell访问
grep -iE "\.(php|asp|jsp)\?.*=(cmd|exec|system|passthru)" /var/log/nginx/access.log

# 统计请求最多的IP
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

# 查找大量404请求的IP（可能的扫描）
awk '$9 == 404 {print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

#!/bin/bash
# security-log-audit.sh - 每日安全日志审计脚本

DATE=$(date -d "yesterday" +%Y-%m-%d 2>/dev/null || date -v-1d +%Y-%m-%d)
REPORT="/var/log/security-audit/report-${DATE}.txt"

mkdir -p /var/log/security-audit

echo "=== 安全日志审计报告 ===" > $REPORT
echo "日期: ${DATE}" >> $REPORT
echo "生成时间: $(date)" >> $REPORT
echo "" >> $REPORT

# 1. SSH暴力破解统计
echo "=== SSH暴力破解统计 ===" >> $REPORT
grep "${DATE}" /var/log/auth.log 2>/dev/null | \
  grep "Failed password" | \
  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10 >> $REPORT
echo "" >> $REPORT

# 2. 成功登录记录
echo "=== 成功SSH登录 ===" >> $REPORT
grep "${DATE}" /var/log/auth.log 2>/dev/null | \
  grep "Accepted" >> $REPORT
echo "" >> $REPORT

# 3. sudo使用记录
echo "=== sudo使用记录 ===" >> $REPORT
grep "${DATE}" /var/log/auth.log 2>/dev/null | \
  grep "sudo:" | grep -v "session" >> $REPORT
echo "" >> $REPORT

# 4. Web扫描检测
echo "=== 可疑Web请求 ===" >> $REPORT
grep "${DATE}" /var/log/nginx/access.log 2>/dev/null | \
  grep -iE "(union.*select|\.\.\/|eval\(|exec\()" | head -20 >> $REPORT
echo "" >> $REPORT

# 5. 系统文件修改
echo "=== 最近修改的系统文件 ===" >> $REPORT
find /etc /usr/bin /usr/sbin -newer /var/log/security-audit/.timestamp -type f 2>/dev/null >> $REPORT

touch /var/log/security-audit/.timestamp

echo "审计报告已生成: $REPORT"

# docker-compose.yml - ELK日志管理
version: '3'
services:
  elasticsearch:
    image: elasticsearch:8.12.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ES_PASSWORD}
    volumes:
      - es-data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"

  logstash:
    image: logstash:8.12.0
    volumes:
      - ./logstash/pipeline:/usr/share/logstash/pipeline
    depends_on:
      - elasticsearch

  kibana:
    image: kibana:8.12.0
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

  filebeat:
    image: elastic/filebeat:8.12.0
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml
      - /var/log:/var/log:ro
    depends_on:
      - logstash

volumes:
  es-data:

# 将日志实时转发到远程服务器
# /etc/rsyslog.d/remote.conf
*.* @@logserver.internal:514

# 设置日志文件为只追加模式
sudo chattr +a /var/log/auth.log
sudo chattr +a /var/log/syslog

# 配置logrotate保留足够长的历史
# /etc/logrotate.d/security
/var/log/auth.log {
    rotate 365
    daily
    compress
    delaycompress
    notifempty
    missingok
}