#!/bin/bash
# 服务器安全体检（只读，不做任何修改）
echo "################ 1. 账号与提权 ################"
echo "--- UID 0 账号（应只有 root）---"
awk -F: '$3==0{print "  " $1}' /etc/passwd
echo "--- 可登录 shell 的账号 ---"
grep -E "/(bash|sh|zsh)$" /etc/passwd | awk -F: '{print "  " $1 " (uid=" $3 ")"}'
echo "--- 空密码账号（应为空）---"
awk -F: '($2==""){print "  !! " $1}' /etc/shadow 2>/dev/null || echo "  (无法读取)"
echo "--- /home 目录（按修改时间）---"
ls -lt /home/ 2>/dev/null | head -6
echo "--- sudoers 非默认条目 ---"
grep -rhE "^[[:space:]]*[^#[:space:]]" /etc/sudoers /etc/sudoers.d/ 2>/dev/null | grep -vE "^Defaults|^root[[:space:]]|^%wheel|^#|^$" | sed 's/^/  /' || echo "  (仅默认)"

echo
echo "################ 2. 全部 SSH 授权公钥 ################"
find / -xdev -name authorized_keys -path "*ssh*" 2>/dev/null | while read f; do
  echo "--- $f ---"
  awk 'NF>=3{print "  " $3 "  [" substr($1,1,20) "...]"}' "$f"
done

echo
echo "################ 3. sshd 生效配置 ################"
sshd -T 2>/dev/null | grep -iE "^port |^permitrootlogin|^passwordauthentication|^pubkeyauthentication|^authorizedkeysfile|^permitemptypasswords|^allowusers|^x11forwarding" | sed 's/^/  /'

echo
echo "################ 4. 最近登录记录 ################"
echo "--- 成功登录（最近）---"
last -n 12 2>/dev/null | head -14 | sed 's/^/  /'
echo "--- 失败登录尝试（最近，需 root）---"
lastb -n 8 2>/dev/null | head -10 | sed 's/^/  /' || echo "  (无 btmp 记录)"

echo
echo "################ 5. 定时任务持久化 ################"
for u in root xxcool; do
  echo "--- crontab[$u] ---"
  crontab -u $u -l 2>/dev/null | grep -vE "^#|^$" | sed 's/^/  /' || echo "  (空)"
done
echo "--- /var/spool/cron 下的用户 ---"; ls /var/spool/cron/ 2>/dev/null | sed 's/^/  /'
echo "--- /etc/cron.d 文件 ---"; ls /etc/cron.d/ 2>/dev/null | sed 's/^/  /'
echo "--- 周期目录内容 ---"; ls /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly 2>/dev/null | grep -v ":" | sed 's/^/  /'
echo "--- systemd timers ---"; systemctl list-timers --all --no-pager 2>/dev/null | head -6 | sed 's/^/  /'

echo
echo "################ 6. 劫持/预加载类后门 ################"
echo "--- /etc/ld.so.preload ---"
[ -s /etc/ld.so.preload ] && cat /etc/ld.so.preload | sed 's/^/  !! /' || echo "  (空/不存在 = 正常)"
echo "--- /etc/rc.local ---"
[ -s /etc/rc.local ] && grep -vE "^#|^$" /etc/rc.local | sed 's/^/  /' || echo "  (空 = 正常)"
echo "--- shell 配置中的下载/反弹特征（curl|wget|/dev/tcp|base64|bash -i）---"
HITS=$(grep -rnE "curl[^|]*(sh|base64)|wget[^|]*\.sh|/dev/tcp/|bash -i" /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /etc/profile.d/ /etc/profile /etc/bashrc 2>/dev/null | grep -vE "server-monitor")
[ -n "$HITS" ] && echo "$HITS" | sed 's/^/  !! /' || echo "  (无明显特征)"
echo "--- /etc/hosts（DNS 劫持检查）---"
grep -vE "^#|^$" /etc/hosts | sed 's/^/  /'

echo
echo "################ 7. 进程 TOP（CPU） ################"
ps aux --sort=-%cpu | head -10 | awk '{printf "  %-8s %5s%% %5s%% %s\n", $1, $3, $4, $11" "$12}' | head -10

echo
echo "################ 8. 监听端口（对外） ################"
ss -tulnp 2>/dev/null | awk 'NR==1{print "  "$0} $1=="tcp"||$1=="udp"{print "  "$0}' | head -22

echo
echo "################ 9. 对外连接（ESTABLISHED） ################"
ss -tnp state established 2>/dev/null | head -15 | sed 's/^/  /'

echo
echo "################ 10. 临时目录可疑文件 ################"
find /tmp /var/tmp /dev/shm -maxdepth 2 -type f 2>/dev/null | head -12 | sed 's/^/  /'
echo "  (以上应仅为正常的临时文件)"

echo
echo "################ 11. 系统关键目录近期改动的文件（近 30 天） ################"
find /usr/bin /usr/sbin /bin /sbin /etc/init.d /etc/systemd/system -newermt "-30 days" -type f 2>/dev/null | head -18 | sed 's/^/  /'

echo
echo "################ 12. SUID 文件（非标准位置需警惕） ################"
find /tmp /var/tmp /dev/shm /home -perm -4000 -type f 2>/dev/null | head -8 | sed 's/^/  !! /'
echo "  (以上为空 = 正常)"

echo
echo "################ 13. Docker 容器 ################"
docker ps -a --format "  {{.Names}} | {{.Image}} | {{.Status}}" 2>/dev/null
echo "--- 特权/危险配置容器 ---"
for c in $(docker ps -q 2>/dev/null); do
  docker inspect -f '  {{.Name}} privileged={{.HostConfig.Privileged}} netmode={{.HostConfig.NetworkMode}} pid={{.HostConfig.PidMode}}' "$c" 2>/dev/null
done
echo "--- 本地镜像列表 ---"
docker images --format "  {{.Repository}}:{{.Tag}}" 2>/dev/null | head -14

echo
echo "################ 14. 内核模块 ################"
lsmod 2>/dev/null | awk 'NR>1{print "  "$1}' | head -20

echo
echo "################ 15. 云安全 agent 状态 ################"
for s in yunjing barad_agent sgagent tat_agent; do
  st=$(systemctl is-active $s 2>/dev/null)
  echo "  $s: ${st:-未安装/未知}"
done
echo
echo "################ 体检结束 ################"