76 lines
3.3 KiB
Bash
Executable File
76 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 只采集，不修改。用法: collect.sh [user@]host
|
|
# 输出写到 stdout；完整日志建议重定向到文件。
|
|
set -euo pipefail
|
|
HOST="${1:?usage: collect.sh user@host}"
|
|
SSH=(ssh -o BatchMode=yes -o ConnectTimeout=15 "$HOST")
|
|
|
|
echo "===== host-sec-check collect $(date -u +%Y-%m-%dT%H:%M:%SZ) host=$HOST ====="
|
|
|
|
remote() {
|
|
"${SSH[@]}" bash -s <<'EOS'
|
|
set +e
|
|
echo "----- id / os / uptime -----"
|
|
id; hostname; uname -a
|
|
. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME"
|
|
uptime
|
|
echo "----- mem / hugepage / disk -----"
|
|
free -h
|
|
grep -E "MemAvailable|HugePages_|Hugetlb|SwapTotal" /proc/meminfo
|
|
df -h
|
|
echo "----- addresses -----"
|
|
ip -4 addr; ip -6 addr show scope global
|
|
echo "----- listen (may miss pid without root) -----"
|
|
ss -lntup 2>/dev/null || netstat -lntup 2>/dev/null
|
|
echo "----- docker -----"
|
|
docker ps -a --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null || echo "no docker"
|
|
echo "----- preload (host cat; may be hidden) -----"
|
|
ls -la /etc/ld.so.preload 2>/dev/null
|
|
echo "preload_host=[$(cat /etc/ld.so.preload 2>/dev/null)]"
|
|
echo "----- cron files -----"
|
|
ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily 2>/dev/null
|
|
echo "----- systemd extras -----"
|
|
ls /etc/systemd/system/*.service 2>/dev/null
|
|
echo "----- users uid0 / human -----"
|
|
awk -F: '$3==0 || ($3>=1000 && $3<65534) {print}' /etc/passwd
|
|
echo "----- sshd -----"
|
|
grep -E "^(Port|PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null
|
|
sshd -t 2>&1 && echo "sshd_syntax=ok" || echo "sshd_syntax=failed"
|
|
sshd -T 2>/dev/null | grep -iE "^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|permitempty passwords|maxauthtries|x11forwarding|allowtcpforwarding) "
|
|
systemctl is-active ssh.service sshd.service ssh.socket 2>/dev/null
|
|
systemctl is-enabled ssh.service sshd.service ssh.socket 2>/dev/null
|
|
echo "----- last -----"
|
|
last -a | head -15
|
|
echo "----- failed logins -----"
|
|
lastb -a 2>/dev/null | head -15 || true
|
|
echo "----- firewall -----"
|
|
ufw status verbose 2>/dev/null || true
|
|
firewall-cmd --state 2>/dev/null || true
|
|
nft list ruleset 2>/dev/null | head -160 || true
|
|
iptables -S 2>/dev/null | head -160 || true
|
|
echo "----- fail2ban -----"
|
|
fail2ban-client status 2>/dev/null || echo "fail2ban unavailable"
|
|
echo "----- timers -----"
|
|
systemctl list-timers --all --no-pager 2>/dev/null | head -120
|
|
echo "----- privilege groups -----"
|
|
getent group sudo wheel docker lxd libvirt 2>/dev/null || true
|
|
echo "----- outbound connections (numeric) -----"
|
|
ss -tpn 2>/dev/null | head -160 || true
|
|
echo "----- docker security summary -----"
|
|
docker ps -a --format '{{.Names}} ports={{.Ports}}' 2>/dev/null || true
|
|
docker inspect --format '{{.Name}} privileged={{.HostConfig.Privileged}} pid={{.HostConfig.PidMode}} network={{.HostConfig.NetworkMode}} binds={{len .Mounts}}' $(docker ps -aq 2>/dev/null) 2>/dev/null || true
|
|
EOS
|
|
}
|
|
|
|
remote
|
|
|
|
# docker 组：从容器读 preload 真值
|
|
if "${SSH[@]}" "groups | grep -qw docker" 2>/dev/null; then
|
|
echo "----- preload via alpine (bypass host libc) -----"
|
|
"${SSH[@]}" "docker run --rm --privileged -v /:/host alpine:latest hexdump -C /host/etc/ld.so.preload" 2>/dev/null \
|
|
|| echo "alpine hexdump failed"
|
|
fi
|
|
|
|
echo "===== collect done ====="
|
|
echo "下一步: 按 SKILL.md 解读；不要把本输出里的密钥贴进聊天。"
|