#!/usr/bin/env bash
# 只采集，不修改。用法: collect.sh [user@]host
# 输出写到 stdout；完整日志建议重定向到文件。
set -euo pipefail
HOST="${1:?usage: collect.sh user@host}"
SSH=(ssh -o BatchMode=yes -o ConnectTimeout=15 "$HOST")

echo "===== host-sec-check collect $(date -u +%Y-%m-%dT%H:%M:%SZ) host=$HOST ====="

remote() {
  "${SSH[@]}" bash -s <<'EOS'
set +e
echo "----- id / os / uptime -----"
id; hostname; uname -a
. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME"
uptime
echo "----- mem / hugepage / disk -----"
free -h
grep -E "MemAvailable|HugePages_|Hugetlb|SwapTotal" /proc/meminfo
df -h
echo "----- addresses -----"
ip -4 addr; ip -6 addr show scope global
echo "----- listen (may miss pid without root) -----"
ss -lntup 2>/dev/null || netstat -lntup 2>/dev/null
echo "----- docker -----"
docker ps -a --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null || echo "no docker"
echo "----- preload (host cat; may be hidden) -----"
ls -la /etc/ld.so.preload 2>/dev/null
echo "preload_host=[$(cat /etc/ld.so.preload 2>/dev/null)]"
echo "----- cron files -----"
ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily 2>/dev/null
echo "----- systemd extras -----"
ls /etc/systemd/system/*.service 2>/dev/null
echo "----- users uid0 / human -----"
awk -F: '$3==0 || ($3>=1000 && $3<65534) {print}' /etc/passwd
echo "----- sshd -----"
grep -E "^(Port|PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null
echo "----- last -----"
last -a | head -15
EOS
}

remote

# docker 组：从容器读 preload 真值
if "${SSH[@]}" "groups | grep -qw docker" 2>/dev/null; then
  echo "----- preload via alpine (bypass host libc) -----"
  "${SSH[@]}" "docker run --rm --privileged -v /:/host alpine:latest hexdump -C /host/etc/ld.so.preload" 2>/dev/null \
    || echo "alpine hexdump failed"
fi

echo "===== collect done ====="
echo "下一步: 按 SKILL.md 解读；不要把本输出里的密钥贴进聊天。"