```
#!/bin/bash

## Edit by wangsuipeng
## Date 2017/03/02

## 需要与以下脚本配合使用
## ldap安装脚本：sh_ldap_client：.sh
## nagios安装脚本：nagios_client.sh
## zabbix安装脚本：zabbix_agentd.sh
## rsync安装脚本：rsync_server.sh

## 检查结果列表
OUTPUT="`pwd`/output"
LIST="$OUTPUT/list"
SCRIPT="$OUTPUT/done.sh"
DATE=`date +%Y-%m-%d`
HOSTNAME=`hostname`

if [ ! -d $OUTPUT ];then
    mkdir -p $OUTPUT
else
   if [ -f $LIST ];then
       echo > $LIST
   fi
fi
 
## 生成缺省配置脚本
DONE()
{
cat > $SCRIPT << EOF
#!/bin/bash

## Edit by checklist
## Date $DATE

INI="./list"

EOF
}

## 服务检查，主要是检查服务是否存在
## 有两个参数，服务名与端口号
SERVER()
{
    server=`lsof -i:$2|awk '{print $9}'| grep -v NAME|grep $1|head -n1`
    if [ -n "$server" ];then
	    echo "$1=yes" >> $LIST
	    return 0
    else 
	    echo "$1=" >> $LIST
	    echo -e "\033[31;49;1mThe snot startup or install !\033[31;49;0m"
	    return 1
    fi
}

## 安装配置ldap客户端
# -*- 脚本配置 -*-
LDCONF()
{
cat >> $SCRIPT << EOF
service autofs restart >/dev/null 2>&1 && service nslcd restart >/dev/null 2>&1
if [ \$? -ne 0 ];then
    read -p "Ldap is not installed , Do you want to install it? yes or no ? [Default:yes]" LDC
    : \${LDC:='y'}
    case "\$LDC" in
        y|Y|YES|yes)
            bash ../sh_ldap_client.sh
            sed -i 's/ldap=/ldap=yes/' \$INI
            ;;
        n|N|NO|no)
            echo -e '\033[31;49;1mldap will not be installed!\033[31;49;0m'
            ;;
        *)
		    echo -e 'You choose a bad option!'
            continue
            ;;
    esac
fi
EOF
}

## 检查ldap服务状态
LDAP()
{
    echo "## The List of LDAP" >> $LIST
    echo "[ldap]" >> $LIST
    # -*- 脚本配置 -*-
    echo "## Config ldap" >> $SCRIPT

    SERVER ldap 389
    if [ $? -ne 0 ];then
	# -*- 脚本配置 -*-
        LDCONF
    else
	# -*- 脚本配置 -*-
	echo "# -*- PASS -*-" >> $SCRIPT
    fi
    echo >> $LIST
}

## 安装配置Zabbix-agent
# -*- 脚本配置 -*-
ZBCONF()
{
cat >> $SCRIPT << EOF
ZBAGENT="/etc/init.d/zabbix_agentd"
if [ ! -f \$ZBAGENT ];then
    read -p "ZABBIX is not install.Do you want to install it?yes or no ? [Default:yes]" ZBC
    : \${ZBC:='y'}
    case "\$ZBC" in
        y|Y|YES|yes)
            bash ../zabbix_agentd.sh
            sed -i 's/zabbix=/zabbix=yes/' \$INI
            ;;
        n|N|NO|no)
            echo -e '\033[31;49;1mzabbix will not be installed!\033[31;49;0m'
			;;
        *)
            echo -e 'You choose a bad option!'
            continue
            ;;
    esac
else
    service zabbix_agentd restart >/dev/null 2>&1
fi
EOF
}

## 检查zabbix服务状态，默认编译安装在/usr/local/zabbix中
ZABBIX()
{
    echo "## The List of ZABBIX" >> $LIST
    echo "[zabbix]" >> $LIST
    # -*- 脚本配置 -*-
    echo "## Config ldap" >> $SCRIPT

    SERVER zabbix 10050
    if [ $?  -ne 0 ];then
	# -*- 脚本配置 -*-
        ZBCONF
    else
	# -*- 脚本配置 -*-
	echo "# -*- PASS -*-" >> $SCRIPT
    fi
    echo >> $LIST
}

## 安装配置nagios客户端
# -*- 脚本配置 -*-
NGCONF()
{
cat >> $SCRIPT << EOF
XINNRPE="/etc/xinetd.d/nrpe"
if [ ! -f \$XINNRPE ];then
    read -p "Nagios is not install.Do you want to install it?yes or no ? [Default:yes]!" NGC 
    : \${NGC:='y'}
    case "\$NGC" in
        y|Y|YES|yes)
            bash ../nagios_client.sh
            sed -i 's/nagios=/nagios=yes/' \$INI
            echo '\033[32;49;1mYou need config the server at 172.16.3.2\033[32;49;0m'
            ;;
        n|N|NO|no)
            echo -e '\033[31;49;1mNagios will not be installed!\033[31;49;0m'
            ;;
        *)
            echo -e 'You choose a bad option!'
            continue
    esac
else 
    if egrep -q 'disable         = no' \$XINNRPE;then
        service xinetd restart > /dev/null 2>&1
    else
        sed -i "/disable/ s/yes/no/" \$XINNRPE 
        service xinetd restart > /dev/null 2>&1
    fi
fi
EOF
}

## 检查nagios服务状态，默认安装在/usr/local/nagios中
NAGIOS()
{
    echo "## The List of NAGIOS" >> $LIST
    echo "[nagios]" >> $LIST
    # -*- 脚本配置 -*-
    echo "## Config nagios" >> $SCRIPT

    SERVER nrpe 5666
    if [ $?  -ne 0 ];then
        NGCONF
    else
        # -*- 脚本配置 -*-
        echo "# -*- PASS -*-" >> $SCRIPT
    fi
    echo >> $LIST
}

## 安装rsync服务器端
# -*- 脚本配置 -*-
RSCONF()
{
cat >> $SCRIPT << EOF
CONF="/etc/rsyncd.conf"
if [ ! -f \$CONF ];then
    read -p "Rsync is not install.Do you want to install it?yes or no ? [Default:yes]!" RSC
    : \${RSC:='y'}
    case "\$RSC" in
        y|Y|YES|yes)
            bash ../rsync_server.sh
            sed -i 's/rsync=/rsync=yes/' \$INI
            echo '\033[32;49;1mYou need config the client\033[32;49;0m'
            ;;
        n|N|NO|no)
            echo -e '\033[31;49;1mRsync will not be installed!\033[31;49;0m'
            ;;
        *)
            echo -e 'You choose a bad option!'
            continue
    esac
else
    service xinetd restart >>/dev/null 2>&1
fi
EOF
}

## 检查rsync服务状态，默认rpm包安装
RSYNC()
{
    echo "## The List of RSYNC" >> $LIST
    echo "[rsync]" >> $LIST
    # -*- 脚本配置 -*-
    echo "## Config rsync" >> $SCRIPT

    SERVER rsync 873
    if [ $?  -ne 0 ];then
        RSCONF
    else
        # -*- 脚本配置 -*-
        echo "# -*- PASS -*-" >> $SCRIPT
    fi
    echo >> $LIST
}

## 时间同步
# -*- 脚本配置 -*-
NTPCONF()
{
cat >> $SCRIPT << EOF
echo "00 01 * * * /usr/sbin/ntpdate -u 172.16.3.2 > /dev/null 2>&1" >> /var/spool/cron/root
sed -i 's/ntp=/ntp=yes/' \$LIST
EOF
}

## 检查时间同步
NTPDATE()
{
    echo "## The List of ntp" >> $LIST
    echo "[ntp]" >> $LIST
    # -*- 脚本配置 -*-
    echo "## Config ntp" >> $SCRIPT

    crontab -l | grep ntpdate|egrep '[^#]' > /dev/null 2>&1
    if [ $? -ne 0 ];then
        echo "ntp=" >> $LIST
        NTPCONF
    else
        echo "ntp=yes" >> $LIST
        # -*- 脚本配置 -*-
        echo "# -*- PASS -*-" >> $SCRIPT
    fi
    echo >> $LIST
}

## 检查hosts
HOSTS()
{
    echo "## The List of Hosts" >> $LIST
    echo "[hosts]" >> $LIST
    
    echo "## /etc/hosts" >> $LIST
    cat /etc/hosts >> $LIST
	echo >> $LIST
    echo "## /etc/hosts.allow" >> $LIST
    cat /etc/hosts.allow >> $LIST
    echo >> $LIST
}

## 防火墙配置导出
IPTABLES()
{
    echo "## The List of iptables" >> $LIST
    echo "[iptables]" >> $LIST
    /etc/init.d/iptables status | grep "not running" >/dev/null 2>&1
    if [ $? -ne 0 ];then
        cat /etc/sysconfig/iptables >> $LIST
    else
        echo "## iptables is not running!" >> $LIST
    fi
    echo >> $LIST
}

## 系统优化主要配置导出
OPTIMA()
{
    echo "## The List of optimalize" >> $LIST
    echo "[optimalize]" >> $LIST

    echo "## limits.conf" >> $LIST
    cat /etc/security/limits.conf >> $LIST
	echo >> $LIST
    echo "## sysctl.conf" >> $LIST
    cat /etc/sysctl.conf >> $LIST
	echo >> $LIST
    echo "## umask" >> $LIST
    grep '^umask' /etc/sysconfig/init >> $LIST
    echo >> $LIST
}

## 加固检查
FIRMED()
{
    echo "## The firmed" >> $LIST
    echo "[firmed]" >> $LIST
    if egrep -q "^PermitRootLogin no|^LoginGraceTime 30|^ClientAliveInterval 3600|^ClientAliveCountMax 0|^UseDNS no" /etc/ssh/sshd_config;then
        echo "firmed=yes" >> $LIST
    else 
        echo "firmed=" >> $LIST
    fi
}

## 主程序
if [ $# -eq 0 ];then
    echo "check the all programe"
    DONE
    LDAP
    ZABBIX
    NAGIOS
    RSYNC
    NTPDATE
    HOSTS
    IPTABLES
    OPTIMA
    FIRMED
    echo -e "\n\n## *** END ***" >> $LIST
else
    case $1 in
        -h|--help|?)
            echo -e "usage:bash checklist.sh [-h][Function]\n\t-h:帮助文档\n\tFunction:检查项，一次只能检查一个，包括LDAP,ZABBIX,NAGIOS,RSYNC,NTPDATE,HOSTS,IPTABLES,OPTIMA,FIRMED\n\t无参数:默认执行所有的检查，并生成配置脚本done.sh\n"
            ;;
        LDAP|ldap|Ldap)
            LDAP
            ;;
        ZABBIX|zabbix|Zabbix)
            ZABBIX
            ;;
        NAGIOS|nagios|Nagios)
            NAGIOS
            ;;
        RSYNC|rsync|Rsync)
            RSYNC
            ;;
        NTPDATE|ntpdate|Ntpdate)
            NTPDATE
            ;;
        HOSTS|hosts|Hosts)
            HOSTS
            ;;
        IPTABLES|iptables|Iptables)
            IPTABLES
            ;;
        OPTIMA|optima|Optima|optimalize)
            OPTIMA
            ;;
        FIRMED|firmed|Firmed)
            FIRME
            ;;
        *)
            echo "please choose a invalid option!"
    esac
fi

echo -e "检查列表为'$LIST'\n查漏脚本'$SCRIPT'"
chmod +x $SCRIPT
```