python关于it审计中的应用
公司面临上市，为了满足上市it审计要求，对系统密码进行定制。
#!/bin/env python
import random,string
import os,sys,re,paramiko
from optparse import OptionParser
def pssh(host,cmd):
user = 'root'
s = paramiko.SSHClient()
s.load_system_host_keys()
s.set_missing_host_key_policy(paramiko.AutoAddPolicy())
s.connect(host,22,user,password='test',timeout=5)
#cmd="ip a | grep inet | grep 192.168 | grep brd | awk -F/22 '{print $1}'|awk '{print $2}'"
stdin,stdout,stderr = s.exec_command(cmd)
cmd_result = stdout.read(),stderr.read()
for line in cmd_result:
return line.strip("\n")
s.close()
#print pssh('192.168.3.52','ls /root')
def kssh(host,cmd):
user = 'root'
s = paramiko.SSHClient()
s.load_system_host_keys()
s.set_missing_host_key_policy(paramiko.AutoAddPolicy())
privatekeyfile = os.path.expanduser('~/.ssh/id_rsa')
mykey = paramiko.RSAKey.from_private_key_file(privatekeyfile)
# mykey=paramiko.DSSKey.from_private_key_file(privatekeyfile,password='061128')
s.connect(host,22,user,pkey=mykey,timeout=5)
#cmd=raw_input('cwd:')
#cmd="ip a | grep inet | grep 192.168 | grep brd | awk -F/22 '{print $1}'|awk '{print $2}'"
stdin,stdout,stderr = s.exec_command(cmd)
cmd_result = stdout.read(),stderr.read()
for line in cmd_result:
return line.strip("\n")
s.close()
def cmdreturn(ip,cmd):
try:
return kssh(ip,cmd)
except paramiko.AuthenticationException:
try:
return pssh(ip,cmd)
except paramiko.AuthenticationException:
return str(ip) + " passwd and key is fault"
pwfile=open('/share/pwfile','w')
ipsfile=open('/share/ipsfile','r')
def chpwd(ip):
ostr=['_','%','@','!','-','=','+','$']
chars=string.ascii_letters+string.digits
xstr=['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z']
dstr=['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z']
passwd=''.join([random.choice(''.join(xstr))])+ ''.join([random.choice(''.join(dstr))])+''.join([random.choice(string.digits)])+''.join([random.choice(''.join(ostr))+''.join([random.choice(chars) for i in range(12)])])
# passwd=random.choice(ostr)+''.join([random.choice(chars) for i in range(15)])+str(random.randint(0, 9))
chcmd="echo 'root:"+passwd+"' | chpasswd"
cmdreturn(ip,chcmd)
pwfile.write(str(ip).strip() + " "+str(passwd))
return str(ip).strip() + " "+str(passwd)
# return chcmd+"\n"+str(ip).strip() + " "+str(passwd)
#echo "$i $passwd"
#ssh root@$i "echo 'root:$passwd' | chpasswd"
for ip in ipsfile:
print chpwd(ip)
系统文件更改：
sed -i.orig 's,(password requisite pam_cracklib.so ).*,\1try_first_pass retry=3 minlen=16 dcredit=-1 ocredit=-1 lcredit=-1 ucredit=-1' /etc/pam.d/system-auth sed -ri.orig 's,(PASS_MAX_DAYS).*,\1 90,g' /etc/login.defs sed -ri 's,(PASS_MIN_LEN).*,\1 16,g' /etc/login.defs #####rollback #cp /etc/pam.d/system-auth.orig /etc/pam.d/system-auth #cp /etc/login.defs.orig /etc/login.defs