耶稣蓝队访问控制与监控脚本：Bash自动化安全实践

#!/bin/bash
# 耶稣蓝队访问控制与监控脚本
# 作者: System Admin Bash Builder
# 描述: 该脚本在Linux系统上实施访问控制并监控用户活动，确保安全访问并记录所有操作

LOG_FILE="access_control.log"

# 步骤1: 初始化日志文件
echo "访问控制日志 - $(date)" > $LOG_FILE
echo "----------------------------------------" >> $LOG_FILE

# 步骤2: 设置用户账户管理
echo "[*] 正在设置用户账户管理..." | tee -a $LOG_FILE
useradd -m -s /bin/bash secure_user | tee -a $LOG_FILE
echo "secure_user:SecurePass123!" | chpasswd | tee -a $LOG_FILE

# 步骤3: 实施强认证
echo "[*] 正在通过SSH密钥认证实现强认证..." | tee -a $LOG_FILE
mkdir -p /home/secure_user/.ssh
ssh-keygen -t rsa -b 4096 -f /home/secure_user/.ssh/id_rsa -N '' | tee -a $LOG_FILE
cat /home/secure_user/.ssh/id_rsa.pub >> /home/secure_user/.ssh/authorized_keys
chmod 600 /home/secure_user/.ssh/authorized_keys
chmod 700 /home/secure_user/.ssh
chown -R secure_user:secure_user /home/secure_user/.ssh | tee -a $LOG_FILE

# 步骤4: 设置访问日志
echo "[*] 正在设置访问日志..." | tee -a $LOG_FILE
touch /var/log/auth.log
chown syslog:adm /var/log/auth.log
chmod 640 /var/log/auth.log
echo "auth,authpriv.* /var/log/auth.log" >> /etc/rsyslog.d/50-default.conf
systemctl restart rsyslog

# 步骤5: 监控并记录访问尝试
echo "[*] 正在监控并记录访问尝试..." | tee -a $LOG_FILE
tail -f /var/log/auth.log | tee -a $LOG_FILE &

# 步骤6: 完成访问控制设置
echo "----------------------------------------" >> $LOG_FILE
echo "[*] 访问控制与监控设置完成。结果已保存至$LOG_FILE。"