li-base-scan

# Li Base Scan v0.0.2 - Linux安全基线扫描器 / Linux Security Baseline Scanner

**作者 Author**: 北京老李 (Beijing Lao Li)  
**版本 Version**: 0.0.2  
**许可证 License**: MIT

---

## 🌐 Language / 语言

- [中文说明](#中文文档-chinese-docs)
- [English Documentation](#english-documentation)

---

<a name="中文文档-chinese-docs"></a>
## 中文文档 Chinese Docs

### ⚠️ 安全限制 - 重要

**本工具仅支持单主机扫描，出于安全考虑，以下输入会被拒绝：**
- ❌ CIDR网段 (如 192.168.1.0/24)
- ❌ IP范围 (如 192.168.1.1-254)
- ❌ 多目标 (如 192.168.1.1,192.168.1.2)

**允许的目标格式：**
- ✅ 单个IP: `192.168.1.1`
- ✅ 域名: `scanme.nmap.org`
- ✅ 本地地址: `127.0.0.1`, `localhost`

### 概述

Li Base Scan 是一个集成多种安全工具的Linux基线扫描器，v0.0.2版本包含以下增强功能：
- **网络安全** - 使用安全临时文件、完善超时处理、错误脱敏
- **进度显示** - 实时进度条显示扫描进度
- **历史记录** - SQLite数据库存储扫描历史
- **报告导出** - 支持Markdown和JSON格式导出
- **AI分析** - 自动生成AI分析请求区块

### 集成工具

| 工具 | 功能 | 扫描类型 |
|------|------|----------|
| **nmap** | 端口扫描、服务识别 | 网络层 |
| **lynis** | 系统安全审计 | 主机层 |
| **nikto** | Web漏洞扫描 | 应用层 |
| **sqlmap** | SQL注入测试 | 应用层 |
| **trivy** | 容器/文件系统漏洞 | 多层 |

### 扫描模式

#### 1. Quick Scan (快速扫描)
```
快速扫描 127.0.0.1
```
- **工具**: nmap
- **时间**: ~30秒
- **用途**: 快速了解开放端口

#### 2. Standard Scan (标准扫描)
```
标准扫描 127.0.0.1
```
- **工具**: nmap + lynis
- **时间**: 2-5分钟
- **用途**: 端口+系统配置审计

#### 3. Full Scan (完整扫描)
```
完整扫描 127.0.0.1
完整扫描 127.0.0.1 包含web
```
- **工具**: nmap + lynis + trivy
- **时间**: 5-10分钟
- **用途**: 全面安全评估

#### 4. Web Focused (Web专项)
```
web扫描 http://localhost
扫描网站 http://example.com
```
- **工具**: nmap + nikto
- **时间**: 2-3分钟
- **用途**: Web应用安全检测

#### 5. Compliance (合规检查)
```
合规扫描 127.0.0.1
基线检查 localhost
```
- **工具**: lynis + trivy
- **时间**: 3-5分钟
- **用途**: CIS基线合规检查

#### 6. Stealth (隐蔽扫描) [v0.0.2新增]
```
隐蔽扫描 192.168.1.1
慢速扫描 target.com
```
- **工具**: nmap (stealth模式)
- **时间**: 5-10分钟
- **用途**: 避免IDS/IPS检测

### 对话输入示例

#### 基础命令
```
"快速扫描 192.168.1.1"
"标准扫描 localhost"
"检查系统安全"
"扫描网站 http://localhost:8080"
"完整安全评估 127.0.0.1"
"基线扫描"
"隐蔽扫描 10.0.0.1"
```

#### LLM 交互式对话
```
"扫描 example.com 并检查SQL注入"
"发现什么漏洞？"
"给我修复建议"
"导出HTML报告"
"系统加固情况如何？"
"Web应用有什么问题？"
```

### 命令行使用

#### 基本扫描
```bash
# 快速扫描
python3 scripts/li_base_scan.py 127.0.0.1 --mode quick

# 标准扫描
python3 scripts/li_base_scan.py 127.0.0.1 --mode standard

# 完整扫描
python3 scripts/li_base_scan.py 127.0.0.1 --mode full
```

#### 对话模式
```bash
python3 scripts/li_base_scan.py -c "快速扫描 127.0.0.1"
```

#### 导出报告 [v0.0.2新增]
```bash
# 导出Markdown报告
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export markdown

# 导出JSON报告
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export json

# 生成HTML报告（通过entrypoint）
python3 scripts/entrypoint.py '{"target": "127.0.0.1", "tools": ["nmap", "lynis"], "format": "html"}'
```

#### 查看历史 [v0.0.2新增]
```bash
python3 scripts/li_base_scan.py --history
```

#### JSON输出
```bash
python3 scripts/li_base_scan.py 127.0.0.1 --mode standard --json
```

### 输出格式

#### 控制台报告
- **执行摘要** - 整体风险评级
- **网络发现** - nmap端口扫描结果
- **系统审计** - lynis合规评分和建议
- **Web安全** - nikto发现的Web漏洞
- **漏洞清单** - trivy发现的CVE
- **修复建议** - 按优先级排序的行动项
- **AI分析区块** - 供大模型分析的原始数据

#### 导出文件 [v0.0.2新增]
报告保存在: `/root/.openclaw/skills/li-base-scan/reports/`
- `scan_<hash>_<timestamp>.md` - Markdown格式
- `scan_<hash>_<timestamp>.json` - JSON格式

#### 历史记录 [v0.0.2新增]
数据库位置: `/root/.openclaw/skills/li-base-scan/history.db`

### v0.0.2 安全增强

#### 1. 安全临时文件
```python
# 使用tempfile.NamedTemporaryFile代替硬编码路径
with tempfile.NamedTemporaryFile(mode='w', suffix='.json', 
                                 delete=False, dir='/tmp') as f:
    temp_file = f.name
os.chmod(temp_file, 0o600)  # 限制权限
```

#### 2. 完善的超时处理
```python
# 子进程超时后正确终止
proc.terminate()
try:
    proc.wait(timeout=5)
except subprocess.TimeoutExpired:
    proc.kill()
```

#### 3. 错误信息脱敏
```python
# 不暴露内部实现细节
return {"error": "扫描执行失败", "tool": "nmap"}
# 详细错误记录到日志
logger.error(f"Nmap scan failed")
```

#### 4. 审计日志
日志位置: `/var/log/li-base-scan.log`
```
2024-01-01 10:00:00 - INFO - Starting scan: mode=quick, target_hash=a1b2c3d4
```

### 依赖工具

```bash
# 安装所有依赖
apt-get update
apt-get install -y nmap lynis nikto sqlmap

# trivy安装
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
```

### 使用建议

#### 快速检查 (日常)
```bash
python3 scripts/li_base_scan.py -c "快速扫描 127.0.0.1"
```

#### 定期深度扫描 (每周)
```bash
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export markdown
```

#### Web应用测试
```bash
python3 scripts/li_base_scan.py http://localhost:8080 --mode web
```

#### 查看历史趋势
```bash
python3 scripts/li_base_scan.py --history
```

### 安全警告

⚠️ **仅扫描您拥有或获得明确授权的系统！**
- 未经授权的扫描可能违反法律
- sqlmap测试需谨慎，可能触发WAF/IDS
- 生产环境请使用--safe-mode避免破坏性测试

### 故障排除

#### 扫描超时
```bash
# 增加超时时间
python3 scripts/li_base_scan.py 127.0.0.1 --timeout 600
```

#### 禁用进度条
```bash
# JSON输出或禁用进度
python3 scripts/li_base_scan.py 127.0.0.1 --json
python3 scripts/li_base_scan.py 127.0.0.1 --no-progress
```

#### 查看日志
```bash
tail -f /var/log/li-base-scan.log
```

---

<a name="english-documentation"></a>
## English Documentation

### ⚠️ Security Restrictions - Important

**This tool supports SINGLE HOST scanning only. The following inputs are REJECTED for security reasons:**
- ❌ CIDR ranges (e.g., 192.168.1.0/24)
- ❌ IP ranges (e.g., 192.168.1.1-254)
- ❌ Multiple targets (e.g., 192.168.1.1,192.168.1.2)

**Allowed target formats:**
- ✅ Single IP: `192.168.1.1`
- ✅ Domain: `scanme.nmap.org`
- ✅ Local address: `127.0.0.1`, `localhost`

### Overview

Li Base Scan is a Linux security baseline scanner integrating multiple tools. Version 0.0.2 includes:
- **Security Hardening** - Secure temp files, proper timeout handling, error sanitization
- **Progress Display** - Real-time progress bar
- **Scan History** - SQLite database for scan history
- **Report Export** - Markdown and JSON export support
- **AI Analysis** - Auto-generated AI analysis blocks

### Integrated Tools

| Tool | Function | Scan Type |
|------|----------|-----------|
| **nmap** | Port scanning, service detection | Network Layer |
| **lynis** | System security audit | Host Layer |
| **nikto** | Web vulnerability scanning | Application Layer |
| **sqlmap** | SQL injection testing | Application Layer |
| **trivy** | Container/filesystem vulnerabilities | Multi-layer |

### Scan Modes

#### 1. Quick Scan
```
quick scan 127.0.0.1
```
- **Tool**: nmap
- **Time**: ~30 seconds
- **Purpose**: Quick port discovery

#### 2. Standard Scan
```
standard scan 127.0.0.1
```
- **Tools**: nmap + lynis
- **Time**: 2-5 minutes
- **Purpose**: Port + system configuration audit

#### 3. Full Scan
```
full scan 127.0.0.1
```
- **Tools**: nmap + lynis + trivy
- **Time**: 5-10 minutes
- **Purpose**: Comprehensive security assessment

#### 4. Web Focused
```
web scan http://localhost
scan website http://example.com
```
- **Tools**: nmap + nikto
- **Time**: 2-3 minutes
- **Purpose**: Web application security detection

#### 5. Compliance
```
compliance scan 127.0.0.1
baseline check localhost
```
- **Tools**: lynis + trivy
- **Time**: 3-5 minutes
- **Purpose**: CIS baseline compliance check

#### 6. Stealth [v0.0.2 New]
```
stealth scan 192.168.1.1
slow scan target.com
```
- **Tool**: nmap (stealth mode)
- **Time**: 5-10 minutes
- **Purpose**: Avoid IDS/IPS detection

### Command Line Usage

#### Basic Scanning
```bash
# Quick scan
python3 scripts/li_base_scan.py 127.0.0.1 --mode quick

# Standard scan
python3 scripts/li_base_scan.py 127.0.0.1 --mode standard

# Full scan
python3 scripts/li_base_scan.py 127.0.0.1 --mode full
```

#### Conversation Mode
```bash
python3 scripts/li_base_scan.py -c "quick scan 127.0.0.1"
```

#### Export Reports [v0.0.2 New]
```bash
# Export Markdown report
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export markdown

# Export JSON report
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export json
```

#### View History [v0.0.2 New]
```bash
python3 scripts/li_base_scan.py --history
```

#### JSON Output
```bash
python3 scripts/li_base_scan.py 127.0.0.1 --mode standard --json
```

### Output Format

#### Console Report
- **Executive Summary** - Overall risk rating
- **Network Discovery** - nmap port scan results
- **System Audit** - lynis compliance score and recommendations
- **Web Security** - Web vulnerabilities found by nikto
- **Vulnerability List** - CVEs discovered by trivy
- **Remediation** - Prioritized action items
- **AI Analysis Block** - Raw data for LLM analysis

#### Exported Files [v0.0.2 New]
Reports saved to: `/root/.openclaw/skills/li-base-scan/reports/`
- `scan_<hash>_<timestamp>.md` - Markdown format
- `scan_<hash>_<timestamp>.json` - JSON format

#### History [v0.0.2 New]
Database location: `/root/.openclaw/skills/li-base-scan/history.db`

### v0.0.2 Security Enhancements

#### 1. Secure Temp Files
```python
# Use tempfile.NamedTemporaryFile instead of hardcoded paths
with tempfile.NamedTemporaryFile(mode='w', suffix='.json', 
                                 delete=False, dir='/tmp') as f:
    temp_file = f.name
os.chmod(temp_file, 0o600)  # Restrict permissions
```

#### 2. Proper Timeout Handling
```python
# Properly terminate subprocess after timeout
proc.terminate()
try:
    proc.wait(timeout=5)
except subprocess.TimeoutExpired:
    proc.kill()
```

#### 3. Error Sanitization
```python
# Don't expose internal implementation details
return {"error": "Scan execution failed", "tool": "nmap"}
# Log detailed errors
logger.error(f"Nmap scan failed")
```

#### 4. Audit Logging
Log location: `/var/log/li-base-scan.log`
```
2024-01-01 10:00:00 - INFO - Starting scan: mode=quick, target_hash=a1b2c3d4
```

### Dependencies

```bash
# Install all dependencies
apt-get update
apt-get install -y nmap lynis nikto sqlmap

# Install trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
```

### Usage Recommendations

#### Quick Check (Daily)
```bash
python3 scripts/li_base_scan.py -c "quick scan 127.0.0.1"
```

#### Periodic Deep Scan (Weekly)
```bash
python3 scripts/li_base_scan.py 127.0.0.1 --mode full --export markdown
```

#### Web Application Testing
```bash
python3 scripts/li_base_scan.py http://localhost:8080 --mode web
```

#### View History Trends
```bash
python3 scripts/li_base_scan.py --history
```

### Security Warning

⚠️ **Only scan systems you own or have explicit authorization to scan!**
- Unauthorized scanning may violate laws
- sqlmap tests should be used cautiously, may trigger WAF/IDS
- Use --safe-mode in production to avoid destructive testing

### Troubleshooting

#### Scan Timeout
```bash
# Increase timeout
python3 scripts/li_base_scan.py 127.0.0.1 --timeout 600
```

#### Disable Progress Bar
```bash
# JSON output or disable progress
python3 scripts/li_base_scan.py 127.0.0.1 --json
python3 scripts/li_base_scan.py 127.0.0.1 --no-progress
```

#### View Logs
```bash
tail -f ~/.openclaw/logs/li-base-scan.log
```

---

## 📞 Contact / 联系方式

**Author**: 北京老李 (Beijing Lao Li)  
**Email**: (请添加您的邮箱)  
**GitHub**: (请添加您的GitHub链接)

---

*Made with ❤️ by 北京老李 (Beijing Lao Li)*