From 28778aef88e9fddafb380fc365908881838ec990 Mon Sep 17 00:00:00 2001
From: Do Siki <dosiki852@gmail.com>
Date: Sat, 22 Aug 2026 13:39:39 +0200
Subject: [PATCH] feat(security): lightweight cryptominer/backdoor detection
 script

Periodic host+container sweep for the exact indicators seen in the staging
miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/
init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU
containers. Findings are logged and exit 1 for cron MAILTO alerting.

Closes MITHOME-82
---
 scripts/security-scan.sh | 58 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100755 scripts/security-scan.sh

diff --git a/scripts/security-scan.sh b/scripts/security-scan.sh
new file mode 100755
index 0000000..5df5def
--- /dev/null
+++ b/scripts/security-scan.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Biztonsági monitoring (könnyűsúlyú): kriptominer / backdoor indikátorok
+# detektálása a Docker hoszton és a konténerekben.
+#
+# Cronnal futtatandó (pl. */5 * * * *). Találat esetén exit 1 (a cron MAILTO
+# riasztáshoz használhatja) és a sorok a $LOG fájlba is kerülnek.
+#
+# Env felülírások:
+#   SECURITY_SCAN_LOG           — log fájl útvonala
+#   SECURITY_SCAN_CPU_THRESHOLD — CPU% határ (alap 200)
+
+set -uo pipefail
+
+LOG="${SECURITY_SCAN_LOG:-/home/sadmin/websitedev/security-scan.log}"
+CPU_THRESHOLD="${SECURITY_SCAN_CPU_THRESHOLD:-200}"
+FINDINGS=0
+
+alert() {
+  printf '[%s] %s\n' "$(date '+%F %T')" "$*" | tee -a "$LOG" >&2
+  FINDINGS=$((FINDINGS + 1))
+}
+
+printf '[%s] scan start\n' "$(date '+%F %T')" >> "$LOG"
+
+# 1) Hoszt: álcázott / ismert miner folyamatnevek
+HOST_HITS="$(ps -eo comm 2>/dev/null | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|\.redis-server' | grep -v grep || true)"
+[ -n "$HOST_HITS" ] && alert "HOST decoy processes: $(printf '%s ' $HOST_HITS)"
+
+# 2) Konténerenként: decoy folyamatok + miner-maradványok a /tmp-ben
+for cid in $(docker ps -q 2>/dev/null); do
+  name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')"
+  [ -n "$name" ] || continue
+
+  # A legitim redis-konténereket kihagyjuk (pl. plane-plane-redis-1).
+  decoys=""
+  if [[ "$name" != *redis* ]]; then
+    decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'redis-server|kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh|\.redis-server' | grep -v grep || true)"
+  else
+    decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh' | grep -v grep || true)"
+  fi
+  [ -n "$decoys" ] && alert "container $name decoy: $(printf '%s' "$decoys" | tr '\n' ' ')"
+
+  arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>/dev/null || true)"
+  [ -n "$arts" ] && alert "container $name /tmp artifacts: $(printf '%s ' $arts)"
+done
+
+# 3) Magas CPU-jú konténerek (figyelmeztetés)
+HIGH_CPU="$(docker stats --no-stream --format '{{.Name}} {{.CPUPerc}}' 2>/dev/null \
+  | awk -v t="$CPU_THRESHOLD" '{ sub(/%/,"",$2); if ($2+0 > t) printf "%s %.0f%% ", $1, $2 }' || true)"
+[ -n "$HIGH_CPU" ] && alert "high CPU: $HIGH_CPU"
+
+# 4) Hoszt /tmp maradványok
+HOST_ARTS="$(ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null || true)"
+[ -n "$HOST_ARTS" ] && alert "HOST /tmp artifacts: $(printf '%s ' $HOST_ARTS)"
+
+printf '[%s] scan end (findings=%d)\n' "$(date '+%F %T')" "$FINDINGS" >> "$LOG"
+[ "$FINDINGS" -eq 0 ] && exit 0
+exit 1