（整理）统信UOS测评命令

# 密码策略
grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS' /etc/login.defs               # 密码有效期
cat /etc/pam.d/common-password | grep pam_pwquality.so              # 密码复杂度
cat /etc/pam.d/common-auth | grep pam_tally2.so                     # 登录失败锁定

# 账户管理

cat /etc/passwd                                      

cat /etc/shadow                                     # 检查账户

# 审计服务
systemctl status auditd                                             # 审计服务状态
auditctl -l                                                         # 当前审计规则
grep 'max_log_file\|max_log_file_action' /etc/audit/auditd.conf     # 日志存储策略

# 系统日志
systemctl status rsyslog                                            # 日志服务状态
cat /etc/logrotate.conf | grep rotate                               # 日志轮转策略

# 防火墙
sudo ufw status verbose                                             # 防火墙规则
grep -E 'PermitRootLogin|Protocol|MaxAuthTries' /etc/ssh/sshd_config # SSH安全配置
netstat -antp | grep LISTEN                                         # 监听端口检查

# 补丁与更新
sudo apt list --upgradable                                          # 待更新软件包
uname -r                                                            # 内核版本

# 文件权限
find / -perm -4000 -type f 2>/dev/null                              # 检查SUID文件
sudo aa-status                                                      # AppArmor状态

# 查看SELinux/AppArmor状态
sudo aa-status   # AppArmor
sudo sestatus    # SELinux

# 检查高危文件权限
find / -perm -4000 -type f 2>/dev/null  # 查找SUID文件