Master Linux Process, User Queries and System Hardening with Bash

This article presents a collection of Bash scripts for Linux system administration, covering process inspection, user information retrieval, and security hardening.

1. Filter process information by PID

#!/bin/bash
# Function: Query all information for a given PID
read -p "请输入要查询的PID: " P
n=`ps -aux| awk '$2~/^'$P'/{print $11}'|wc -l`
if [ $n -eq 0 ]; then
  echo "该PID不存在！！"
  exit
fi

echo "--------------------------------"
echo "进程PID: $P"
echo "进程命令：`ps -aux| awk '$2~/^'$P'${print $11}'`"
echo "进程所属用户: `ps -aux| awk '$2~/^'$P'${print $1}'`"
echo "CPU占用率：`ps -aux| awk '$2~/^'$P'${print $3}'`%"
echo "内存占用率：`ps -aux| awk '$2~/^'$P'${print $4}'`%"
echo "进程开始运行的时刻：`ps -aux| awk '$2~/^'$P'${print $9}'`"
echo "进程运行的时间：`ps -aux| awk '$2~/^'$P'${print $10}'`"
echo "进程状态：`ps -aux| awk '$2~/^'$P'${print $8}'`"
echo "进程虚拟内存：`ps -aux| awk '$2~/^'$P'${print $5}'`"
echo "进程共享内存：`ps -aux| awk '$2~/^'$P'${print $6}'`"
echo "--------------------------------"

2. Filter process information by name

#!/bin/bash
# Function: Find PIDs for a given process name and display detailed info
read -p "请输入要查询的进程名：" NAME
N=`ps -aux | grep $NAME | grep -v grep | wc -l`
if [ $N -le 0 ]; then
  echo "该进程名没有运行！"
  exit
fi
i=1
while [ $N -gt 0 ]
do
  echo "进程PID: `ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $2}'`"
  echo "进程命令：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $11}'`"
  echo "进程所属用户: `ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $1}'`"
  echo "CPU占用率：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $3}'`%"
  echo "内存占用率：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $4}'`%"
  echo "进程开始运行的时刻：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $9}'`"
  echo "进程运行的时间：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $11}'`"
  echo "进程状态：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $8}'`"
  echo "进程虚拟内存：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $5}'`"
  echo "进程共享内存：`ps -aux | grep $NAME | grep -v grep | awk 'NR=='$i'{print $6}'`"
  echo "***************************************************************"
  let N-- i++
done

3. Query user information by username

#!/bin/bash
# Function: Retrieve all relevant details for a given user
read -p "请输入要查询的用户名：" A
n=`cat /etc/passwd | awk -F: '$1~/^'$A'/{print}' | wc -l`
if [ $n -eq 0 ]; then
  echo "该用户不存在"
  echo "------------------------------"
  exit
fi

echo "该用户的用户名：$A"
echo "该用户的UID：`cat /etc/passwd | awk -F: '$1~/^'$A'${print $3}'`"
echo "该用户的组为：`id $A | awk '{print $3}'`"
echo "该用户的GID：`cat /etc/passwd | awk -F: '$1~/^'$A'${print $4}'`"
echo "该用户的家目录：`cat /etc/passwd | awk -F: '$1~/^'$A'${print $6}'`"
Login=`cat /etc/passwd | awk -F: '$1~/^'$A'${print $7}'`
if [ "$Login" == "/bin/bash" ]; then
  echo "该用户有登录系统的权限！！"
elif [ "$Login" == "/sbin/nologin" ]; then
  echo "该用户没有登录系统的权限！！"
fi

4. System hardening configurations

#!/bin/bash
# Password policy settings
read -p "设置密码最多可多少天不修改：" A
read -p "设置密码修改之间最小的天数：" B
read -p "设置密码最短的长度：" C
read -p "设置密码失效前多少天通知用户：" D
sed -i '/^PASS_MAX_DAYS/c\PASS_MAX_DAYS  '$A'' /etc/login.defs
sed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS  '$B'' /etc/login.defs
sed -i '/^PASS_MIN_LEN/c\PASS_MIN_LEN  '$C'' /etc/login.defs
sed -i '/^PASS_WARN_AGE/c\PASS_WARN_AGE  '$D'' /etc/login.defs

echo "已对密码进行加固，新用户不得和旧密码相同，且新密码必须同时包含数字、小写字母，大写字母！！"
sed -i '/pam_pwquality.so/c\password  requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-auth

echo "已对密码进行加固，如果输入错误密码超过3次，则锁定账户！！"
n=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so " | wc -l`
if [ $n -eq 0 ]; then
  sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=3 unlock_time=150 even_deny_root root_unlock_time=300' /etc/pam.d/sshd
fi

echo "已设置禁止root用户远程登录！！"
sed -i '/PermitRootLogin/c\PermitRootLogin no' /etc/ssh/sshd_config

# History and session timeout
read -p "设置历史命令保存条数：" E
read -p "设置账户自动注销时间：" F
sed -i '/^HISTSIZE/c\HISTSIZE='$E'' /etc/profile
sed -i '/^HISTSIZE/a\TMOUT='$F'' /etc/profile

# Restrict su to wheel group
sed -i '/pam_wheel.so use_uid/c\auth required pam_wheel.so use_uid' /etc/pam.d/su
n=`cat /etc/login.defs | grep SU_WHEEL_ONLY | wc -l`
if [ $n -eq 0 ]; then
  echo "SU_WHEEL_ONLY yes" >> /etc/login.defs
fi

# List users with login shells and UID=0
awk -F: '($7=="/bin/bash"){print $1}' /etc/passwd
awk -F: '($3=="0"){print $1}' /etc/passwd

# Detect empty password accounts and force password change
N=`awk -F: '($2==""){print $1}' /etc/shadow | wc -l`
echo "系统中空密码用户有：$N"
if [ $N -eq 0 ]; then
  echo "恭喜你，系统中无空密码用户！！"
else
  i=1
  while [ $N -gt 0 ]
  do
    None=`awk -F: '($2==""){print $1}' /etc/shadow | awk 'NR=='$i'{print}'`
    echo "------------------------"
    echo $None
    echo "必须为空用户设置密码！！"
    passwd $None
    let N--
    i++
  done
fi

# Lock critical system files
read -p "警告：此脚本运行后将无法添加删除用户和组！！确定输入Y，取消输入N；Y/N：" i
case $i in
  [Yy])
    chattr +i /etc/passwd
    chattr +i /etc/shadow
    chattr +i /etc/group
    chattr +i /etc/gshadow
    echo "锁定成功！";;
  [Nn])
    chattr -i /etc/passwd
    chattr -i /etc/shadow
    chattr -i /etc/group
    chattr -i /etc/gshadow
    echo "取消锁定成功！！";;
  *)
    echo "请输入Y/y or N/n";;
esac

These scripts together enable administrators to quickly inspect running processes, gather user details, and enforce a set of security policies that harden the Linux environment against common attacks.