# Audit

> 安全审计

- **Type:** Skill
- **Install:** `agentstack add skill-ryukyagamilight-terminal-skills-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ryukyagamilight](https://agentstack.voostack.com/s/ryukyagamilight)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [ryukyagamilight](https://github.com/ryukyagamilight)
- **Source:** https://github.com/ryukyagamilight/terminal-skills/tree/main/security/audit
- **Website:** https://ryukyagamilight.github.io

## Install

```sh
agentstack add skill-ryukyagamilight-terminal-skills-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 安全审计

## 概述
安全审计、漏洞扫描、合规检查技能。

## auditd 审计系统

### 安装与管理
```bash
# 安装
apt install auditd audispd-plugins      # Debian/Ubuntu
yum install audit                        # CentOS/RHEL

# 服务管理
systemctl start auditd
systemctl enable auditd
systemctl status auditd
```

### 审计规则
```bash
# 查看规则
auditctl -l

# 添加规则 - 监控文件
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes
auditctl -w /etc/sudoers -p wa -k sudoers_changes

# 监控目录
auditctl -w /etc/ssh/ -p wa -k ssh_config

# 监控系统调用
auditctl -a always,exit -F arch=b64 -S execve -k command_exec

# 监控用户操作
auditctl -a always,exit -F arch=b64 -S open -F auid>=1000 -k user_file_access
```

### 永久规则
```bash
# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/sudoers -p wa -k sudoers_changes
-w /var/log/lastlog -p wa -k logins
-a always,exit -F arch=b64 -S execve -k commands

# 重载规则
augenrules --load
```

### 查看日志
```bash
# 搜索审计日志
ausearch -k passwd_changes
ausearch -k commands -ts today
ausearch -ua root -ts recent

# 生成报告
aureport
aureport --summary
aureport --login
aureport --file
aureport --executable
```

## 日志审计

### 系统日志
```bash
# 查看认证日志
tail -f /var/log/auth.log          # Debian/Ubuntu
tail -f /var/log/secure            # CentOS/RHEL

# 查看登录记录
last
lastb                               # 失败登录
lastlog

# journalctl
journalctl -u sshd
journalctl --since "1 hour ago"
journalctl -p err
```

### 日志分析
```bash
# 统计 SSH 登录失败
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

# 统计 sudo 使用
grep "sudo:" /var/log/auth.log | tail -20

# 查找异常登录
grep "Accepted" /var/log/auth.log | grep -v "192.168"
```

## 漏洞扫描

### Lynis
```bash
# 安装
apt install lynis

# 系统审计
lynis audit system

# 查看报告
cat /var/log/lynis-report.dat
```

### OpenSCAP
```bash
# 安装
yum install openscap-scanner scap-security-guide

# 扫描
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard \
    --results results.xml \
    /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml

# 生成报告
oscap xccdf generate report results.xml > report.html
```

### Nmap 扫描
```bash
# 端口扫描
nmap -sV -sC target.com

# 漏洞扫描
nmap --script vuln target.com

# 全面扫描
nmap -A -T4 target.com
```

## 文件完整性

### AIDE
```bash
# 安装
apt install aide

# 初始化数据库
aide --init
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# 检查变更
aide --check

# 更新数据库
aide --update
```

### Tripwire
```bash
# 初始化
tripwire --init

# 检查
tripwire --check

# 更新策略
tripwire --update-policy
```

## 常见场景

### 场景 1：监控特权操作
```bash
# /etc/audit/rules.d/privileged.rules
# 监控 sudo
-w /usr/bin/sudo -p x -k privileged_sudo
-w /etc/sudoers -p wa -k sudoers_edit

# 监控用户管理
-w /usr/sbin/useradd -p x -k user_add
-w /usr/sbin/userdel -p x -k user_del
-w /usr/sbin/usermod -p x -k user_mod

# 监控网络配置
-w /etc/hosts -p wa -k hosts_edit
-w /etc/network/ -p wa -k network_config
```

### 场景 2：合规检查脚本
```bash
#!/bin/bash
echo "=== 安全合规检查 ==="

# 检查空密码账户
echo "空密码账户:"
awk -F: '($2 == "") {print $1}' /etc/shadow

# 检查 UID 为 0 的账户
echo "UID=0 账户:"
awk -F: '($3 == 0) {print $1}' /etc/passwd

# 检查 SSH 配置
echo "SSH 配置:"
grep -E "^(PermitRootLogin|PasswordAuthentication)" /etc/ssh/sshd_config

# 检查开放端口
echo "监听端口:"
ss -tlnp
```

### 场景 3：登录告警
```bash
#!/bin/bash
# /etc/profile.d/login-alert.sh
if [ -n "$SSH_CLIENT" ]; then
    IP=$(echo $SSH_CLIENT | awk '{print $1}')
    echo "SSH 登录告警: 用户 $USER 从 $IP 登录 $(hostname)" | \
        mail -s "SSH Login Alert" admin@example.com
fi
```

## 故障排查

| 问题 | 排查方法 |
|------|----------|
| 审计日志过大 | 配置日志轮转、过滤规则 |
| 性能影响 | 减少审计规则、优化过滤 |
| 规则不生效 | 检查语法、重载规则 |

```bash
# 检查 auditd 状态
auditctl -s

# 查看丢失事件
aureport --summary | grep lost

# 日志轮转配置
# /etc/audit/auditd.conf
max_log_file = 50
num_logs = 5
max_log_file_action = ROTATE
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ryukyagamilight](https://github.com/ryukyagamilight)
- **Source:** [ryukyagamilight/terminal-skills](https://github.com/ryukyagamilight/terminal-skills)
- **License:** Apache-2.0
- **Homepage:** https://ryukyagamilight.github.io

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ryukyagamilight-terminal-skills-audit
- Seller: https://agentstack.voostack.com/s/ryukyagamilight
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.