{"_id":"@dongluliang/sec-baseline-linux","name":"@dongluliang/sec-baseline-linux","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@dongluliang/sec-baseline-linux","version":"0.1.0","description":"只读型 Linux 安全基线自查工具 - 企业终端/服务器运维场景","main":"dist/core/scanner.js","bin":{"sec-baseline-linux":"dist/cli/index.js"},"scripts":{"build":"tsc","dev":"tsc --watch","start":"node dist/cli/index.js","test":"jest","prepublishOnly":"npm run build && npm test","pack:dry":"npm pack --dry-run"},"keywords":["security","baseline","linux","hardening","audit","cis","compliance"],"author":{"name":"dongluliang"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/dongluliang/sec-baseline.git"},"engines":{"node":">=20"},"devDependencies":{"@types/jest":"^29.5.0","@types/node":"^20.0.0","jest":"^29.7.0","ts-jest":"^29.1.0","typescript":"^5.3.0"},"_id":"@dongluliang/sec-baseline-linux@0.1.0","types":"./dist/core/scanner.d.ts","bugs":{"url":"https://github.com/dongluliang/sec-baseline/issues"},"homepage":"https://github.com/dongluliang/sec-baseline#readme","_nodeVersion":"20.18.0","_npmVersion":"10.8.2","dist":{"integrity":"sha512-oqe+Y/Mfol7/PSPTt52vGE9RjooyWM+PA6QVXTg4zUyYoDYBsMUrySNJYI/eRX23qJ8pjfdJix+0PtXnUnUr2Q==","shasum":"58ae3130126a4110ba939d41974f9b3cdd9879ce","tarball":"https://registry.npmjs.org/@dongluliang/sec-baseline-linux/-/sec-baseline-linux-0.1.0.tgz","fileCount":96,"unpackedSize":314101,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEMCID3lMl/YFWeaUt3qdmsDdU6mtvcgNNG69sxAhke0BzGAAh8Vpxv8vil39VGG1nNHLTHwRK+qyqe8Y5JBcBtBfLNp"}]},"_npmUser":{"name":"dongluliang","email":"dongluliang@gmail.com"},"directories":{},"maintainers":[{"name":"dongluliang","email":"dongluliang@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/sec-baseline-linux_0.1.0_1787194768348_0.010246338147237521"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-20T02:59:28.252Z","0.1.0":"2026-08-20T02:59:28.499Z","modified":"2026-08-20T02:59:28.686Z"},"maintainers":[{"name":"dongluliang","email":"dongluliang@gmail.com"}],"description":"只读型 Linux 安全基线自查工具 - 企业终端/服务器运维场景","homepage":"https://github.com/dongluliang/sec-baseline#readme","keywords":["security","baseline","linux","hardening","audit","cis","compliance"],"repository":{"type":"git","url":"git+https://github.com/dongluliang/sec-baseline.git"},"author":{"name":"dongluliang"},"bugs":{"url":"https://github.com/dongluliang/sec-baseline/issues"},"license":"MIT","readme":"---\nAIGC:\n  ContentProducer: '001191110102MAD55U9H0F10002'\n  ContentPropagator: '001191110102MAD55U9H0F10002'\n  Label: '1'\n  ProduceID: '83252740-bc9c-48f7-9f52-fa2198c16e7a'\n  PropagateID: '83252740-bc9c-48f7-9f52-fa2198c16e7a'\n  ReservedCode1: '5ee554b2-5a02-4107-8a34-69e0c8cd24eb'\n  ReservedCode2: '5ee554b2-5a02-4107-8a34-69e0c8cd24eb'\n---\n\n# @dongluliang/sec-baseline-linux\n\n只读型 Linux 安全基线自查工具 - 面向企业终端、服务器和运维场景\n\n## 特性\n\n- **只读检查**：不会修改任何系统配置，禁止自动整改\n- **隐私保护**：不采集密码、Token、私钥等敏感内容\n- **离线运行**：默认不联网，所有数据仅保存在本机\n- **多发行版支持**：Ubuntu / Debian / CentOS / Rocky / AlmaLinux / RHEL / openEuler / Anolis OS\n- **多格式报告**：终端彩色输出 / JSON / CSV / HTML\n- **透明评分**：评分算法公开透明，风险列表为核心\n\n## 安装\n\n```bash\nnpm install -g @dongluliang/sec-baseline-linux\n```\n\n或直接通过 npx 运行：\n\n```bash\nnpx @dongluliang/sec-baseline-linux\n```\n\n## 使用\n\n### 基本用法\n\n```bash\nnpx @dongluliang/sec-baseline-linux\n```\n\n### 输出 JSON 报告\n\n```bash\nnpx @dongluliang/sec-baseline-linux --json --output report.json\n```\n\n### 输出 HTML 报告\n\n```bash\nnpx @dongluliang/sec-baseline-linux --html --output report.html\n```\n\n### 深度扫描（全盘扫描）\n\n```bash\nnpx @dongluliang/sec-baseline-linux --deep\n```\n\n### 完整参数列表\n\n```bash\nnpx @dongluliang/sec-baseline-linux --help\n```\n\n| 参数 | 说明 |\n|------|------|\n| `--help, -h` | 显示帮助信息 |\n| `--version, -v` | 显示版本号 |\n| `--json` | 以 JSON 格式输出 |\n| `--csv` | 以 CSV 格式输出 |\n| `--html` | 以 HTML 格式输出 |\n| `--output, -o` | 输出到指定文件 |\n| `--quiet, -q` | 静默模式 |\n| `--verbose` | 详细模式 |\n| `--deep` | 深度扫描（全盘扫描 world writable 等） |\n\n## 检查项\n\n### 1. 系统基础信息\n- SELinux / AppArmor 状态\n- 系统时间同步状态\n\n### 2. 账户安全\n- UID=0 账户检查\n- 空密码账户\n- 无密码用户\n- 异常 Shell\n- sudo 用户\n- 长期未使用账户\n\n### 3. 密码策略\n- PASS_MAX_DAYS / PASS_MIN_DAYS / PASS_MIN_LEN / PASS_WARN_AGE\n- PAM 密码复杂度（pam_pwquality / pam_cracklib）\n- 密码历史\n- 登录失败锁定策略（pam_faillock）\n\n### 4. SSH 安全\n- PermitRootLogin / PasswordAuthentication / PermitEmptyPasswords\n- PubkeyAuthentication / MaxAuthTries / X11Forwarding\n- AllowUsers / AllowGroups / LoginGraceTime\n- ClientAliveInterval / ClientAliveCountMax\n- 优先使用 `sshd -T` 获取生效配置\n\n### 5. 防火墙\n- firewalld / ufw / iptables / nftables 综合检测\n\n### 6. 网络监听\n- 高风险端口识别（21/22/23/25/53/111/139/445/3306/5432/6379/9200/11211/27017）\n- 绑定地址风险评估（0.0.0.0 vs 127.0.0.1）\n\n### 7. 高风险服务\n- telnet / rsh / rlogin / rexec / tftp / vsftpd / rpcbind / nfs / smb / snmp\n- docker / redis / mysql / postgresql / elasticsearch / mongodb\n\n### 8. 文件权限\n- 关键文件权限（/etc/passwd / /etc/shadow / /etc/ssh/sshd_config 等）\n- SUID / SGID 文件\n- World writable 文件/目录\n- 无属主/无属组文件\n- 全盘扫描通过 `--deep` 开启\n\n### 9. 定时任务\n- /etc/crontab / cron.d / cron.daily 等\n- 用户 crontab\n- systemd timer\n- 可写脚本检测\n\n### 10. 日志与审计\n- rsyslog / journald\n- auditd 运行状态和规则\n- 日志文件权限\n- 日志轮转\n\n### 11. 内核和网络参数\n- net.ipv4.ip_forward\n- net.ipv4.conf.all.accept_redirects\n- net.ipv4.conf.all.send_redirects\n- net.ipv4.conf.all.accept_source_route\n- kernel.randomize_va_space\n- 只读检查，不执行 sysctl -w\n\n### 12. 软件包与更新\n- 安全补丁检查\n- 自动更新服务状态\n- 不执行系统升级\n\n## 风险等级\n\n| 等级 | 说明 |\n|------|------|\n| critical | 严重风险 |\n| high | 高风险 |\n| medium | 中风险 |\n| low | 低风险 |\n| info | 提示信息 |\n| pass | 检查通过 |\n| error | 检查出错 |\n\n## 评分算法\n\n- 起始分：100\n- Critical 扣 20 分，High 扣 10 分，Medium 扣 5 分，Low 扣 2 分\n- 按检查项总数归一化，避免项目数量变化导致评分失真\n- 评分仅为辅助参考，风险列表和整改建议才是核心\n\n## 安全声明\n\n- 默认只读，禁止自动整改\n- 禁止利用漏洞、破解密码、弱口令爆破\n- 禁止读取用户密码内容\n- 禁止上传检查结果\n- 禁止默认联网\n- 禁止采集无关个人数据\n- 禁止执行破坏性命令\n- 所有数据仅保存在本机\n\n## License\n\nMIT","readmeFilename":"README.md","_rev":"1-361c589f619a306c480df4a15824e1fa"}