Do Siki
28778aef88
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
Periodic host+container sweep for the exact indicators seen in the staging miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/ init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU containers. Findings are logged and exit 1 for cron MAILTO alerting. Closes MITHOME-82
59 lines
2.5 KiB
Bash
Executable File
59 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Biztonsági monitoring (könnyűsúlyú): kriptominer / backdoor indikátorok
|
|
# detektálása a Docker hoszton és a konténerekben.
|
|
#
|
|
# Cronnal futtatandó (pl. */5 * * * *). Találat esetén exit 1 (a cron MAILTO
|
|
# riasztáshoz használhatja) és a sorok a $LOG fájlba is kerülnek.
|
|
#
|
|
# Env felülírások:
|
|
# SECURITY_SCAN_LOG — log fájl útvonala
|
|
# SECURITY_SCAN_CPU_THRESHOLD — CPU% határ (alap 200)
|
|
|
|
set -uo pipefail
|
|
|
|
LOG="${SECURITY_SCAN_LOG:-/home/sadmin/websitedev/security-scan.log}"
|
|
CPU_THRESHOLD="${SECURITY_SCAN_CPU_THRESHOLD:-200}"
|
|
FINDINGS=0
|
|
|
|
alert() {
|
|
printf '[%s] %s\n' "$(date '+%F %T')" "$*" | tee -a "$LOG" >&2
|
|
FINDINGS=$((FINDINGS + 1))
|
|
}
|
|
|
|
printf '[%s] scan start\n' "$(date '+%F %T')" >> "$LOG"
|
|
|
|
# 1) Hoszt: álcázott / ismert miner folyamatnevek
|
|
HOST_HITS="$(ps -eo comm 2>/dev/null | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|\.redis-server' | grep -v grep || true)"
|
|
[ -n "$HOST_HITS" ] && alert "HOST decoy processes: $(printf '%s ' $HOST_HITS)"
|
|
|
|
# 2) Konténerenként: decoy folyamatok + miner-maradványok a /tmp-ben
|
|
for cid in $(docker ps -q 2>/dev/null); do
|
|
name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')"
|
|
[ -n "$name" ] || continue
|
|
|
|
# A legitim redis-konténereket kihagyjuk (pl. plane-plane-redis-1).
|
|
decoys=""
|
|
if [[ "$name" != *redis* ]]; then
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'redis-server|kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh|\.redis-server' | grep -v grep || true)"
|
|
else
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh' | grep -v grep || true)"
|
|
fi
|
|
[ -n "$decoys" ] && alert "container $name decoy: $(printf '%s' "$decoys" | tr '\n' ' ')"
|
|
|
|
arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>/dev/null || true)"
|
|
[ -n "$arts" ] && alert "container $name /tmp artifacts: $(printf '%s ' $arts)"
|
|
done
|
|
|
|
# 3) Magas CPU-jú konténerek (figyelmeztetés)
|
|
HIGH_CPU="$(docker stats --no-stream --format '{{.Name}} {{.CPUPerc}}' 2>/dev/null \
|
|
| awk -v t="$CPU_THRESHOLD" '{ sub(/%/,"",$2); if ($2+0 > t) printf "%s %.0f%% ", $1, $2 }' || true)"
|
|
[ -n "$HIGH_CPU" ] && alert "high CPU: $HIGH_CPU"
|
|
|
|
# 4) Hoszt /tmp maradványok
|
|
HOST_ARTS="$(ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null || true)"
|
|
[ -n "$HOST_ARTS" ] && alert "HOST /tmp artifacts: $(printf '%s ' $HOST_ARTS)"
|
|
|
|
printf '[%s] scan end (findings=%d)\n' "$(date '+%F %T')" "$FINDINGS" >> "$LOG"
|
|
[ "$FINDINGS" -eq 0 ] && exit 0
|
|
exit 1
|