linux系统弱密码检测

需要自备弱密码明文字典

from _utils.patrol2 import data_format,report_format,run_cmd
import platform
import crypt

with open(passwd[0],'r') as f:
    content=f.readlines()


def use_md5(password,salt):
    global content
    for i in content:
        cmd="openssl passwd -1 -salt '{}' '{}'".format(salt,i)
        code,res=run_cmd(cmd)
        if res.split('$')[-1].strip()==password:
            return True
    return False


def use_SHA512(id,password,salt):
    global content
    for i in content:
        cry_password=crypt.crypt(i,'${}${}'.format(id,salt))
        if cry_password==password:
            return True
    return False


content=[i.strip('\r\n').strip('\n') for i in content]

weak_passwd=[]
remove_users =remove_users.split(',')


low_length_users=[]
cmd="awk -F: 'length($2)<={} {{print $1}}' /etc/shadow".format(passwd_length)
code,res=run_cmd(cmd)
for i in res.split('\n'):
    if i.strip() not in remove_users:
        low_length_users.append(i.strip())
blowfish=[]
nocrypt=[]
cmd="awk -F: '{print $1,$2}' /etc/shadow"
code,res=run_cmd(cmd)


for i in res.split('\n'):
    user_name=i.split()[0].strip()
    if user_name in remove_users:
        continue
    passwd=i.split()[1].strip()
    if passwd in ('!!','') and user_name not in low_length_users:
        low_length_users.append(user_name)
    elif passwd.startswith('$'):
        _,id,salt,hashed=passwd.split('$')
        if id=='1' and use_md5(hashed,salt):
            weak_passwd.append(user_name)
        elif id in ('6','5') and use_SHA512(id,hashed,salt):
            weak_passwd.append(user_name)
        elif id in ('2a','2y'):
            blowfish.append(user_name)
        elif id not in ('6','5','2a','2y','1'):
            nocrypt.append(user_name)

result=[]
if low_length_users:
    result.append('密码长度不足或空密码：{}'.format(','.join(low_length_users)))
if weak_passwd:
    result.append('密码强度不足:{}'.format(','.join(weak_passwd)))
if blowfish:
    result.append('使用了blowfish加密方式，建议使用sha512方式:{}'.format(','.join(blowfish)))
if nocrypt:
    result.append('无法识别加密类型:{}'.format(','.join(nocrypt)))
if not result:
    report=data_format('检查结果','正常',0)
else:
    report = data_format('检查结果', '\n'.join(result), 1)
reports=report_format(platform.node(),[report],is_json=True)