54 lines
2.0 KiB
Bash
Executable File
54 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 只采集，不修改。用法: collect.sh [user@]host
|
|
# 输出写到 stdout；完整日志建议重定向到文件。
|
|
set -euo pipefail
|
|
HOST="${1:?usage: collect.sh user@host}"
|
|
SSH=(ssh -o BatchMode=yes -o ConnectTimeout=15 "$HOST")
|
|
|
|
echo "===== host-sec-check collect $(date -u +%Y-%m-%dT%H:%M:%SZ) host=$HOST ====="
|
|
|
|
remote() {
|
|
"${SSH[@]}" bash -s <<'EOS'
|
|
set +e
|
|
echo "----- id / os / uptime -----"
|
|
id; hostname; uname -a
|
|
. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME"
|
|
uptime
|
|
echo "----- mem / hugepage / disk -----"
|
|
free -h
|
|
grep -E "MemAvailable|HugePages_|Hugetlb|SwapTotal" /proc/meminfo
|
|
df -h
|
|
echo "----- addresses -----"
|
|
ip -4 addr; ip -6 addr show scope global
|
|
echo "----- listen (may miss pid without root) -----"
|
|
ss -lntup 2>/dev/null || netstat -lntup 2>/dev/null
|
|
echo "----- docker -----"
|
|
docker ps -a --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null || echo "no docker"
|
|
echo "----- preload (host cat; may be hidden) -----"
|
|
ls -la /etc/ld.so.preload 2>/dev/null
|
|
echo "preload_host=[$(cat /etc/ld.so.preload 2>/dev/null)]"
|
|
echo "----- cron files -----"
|
|
ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily 2>/dev/null
|
|
echo "----- systemd extras -----"
|
|
ls /etc/systemd/system/*.service 2>/dev/null
|
|
echo "----- users uid0 / human -----"
|
|
awk -F: '$3==0 || ($3>=1000 && $3<65534) {print}' /etc/passwd
|
|
echo "----- sshd -----"
|
|
grep -E "^(Port|PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null
|
|
echo "----- last -----"
|
|
last -a | head -15
|
|
EOS
|
|
}
|
|
|
|
remote
|
|
|
|
# docker 组：从容器读 preload 真值
|
|
if "${SSH[@]}" "groups | grep -qw docker" 2>/dev/null; then
|
|
echo "----- preload via alpine (bypass host libc) -----"
|
|
"${SSH[@]}" "docker run --rm --privileged -v /:/host alpine:latest hexdump -C /host/etc/ld.so.preload" 2>/dev/null \
|
|
|| echo "alpine hexdump failed"
|
|
fi
|
|
|
|
echo "===== collect done ====="
|
|
echo "下一步: 按 SKILL.md 解读；不要把本输出里的密钥贴进聊天。"
|