Do Siki
8ee5befe10
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
The \n in the accumulated alert text was a literal backslash-n, so the details would have rendered as one garbled line. printf -v now appends real newlines; the notification body joins header + details with a real line break.
87 lines
3.7 KiB
Bash
Executable File
87 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Biztonsági monitoring (könnyűsúlyú): kriptominer / backdoor indikátorok
|
|
# detektálása a Docker hoszton és a konténerekben.
|
|
#
|
|
# Cronnal futtatandó (pl. */5 * * * *). Találat esetén exit 1 (a cron MAILTO
|
|
# riasztáshoz használhatja) és a sorok a $LOG fájlba is kerülnek.
|
|
#
|
|
# Env felülírások:
|
|
# SECURITY_SCAN_LOG — log fájl útvonala
|
|
# SECURITY_SCAN_CPU_THRESHOLD — CPU% határ (alap 200)
|
|
# SECURITY_SCAN_NTFY_TOPIC — ntfy topic (alap st_security)
|
|
# SECURITY_SCAN_NTFY_CRED — ntfy credential fájl (alap /etc/ntfy/credentials/auth.env)
|
|
|
|
set -uo pipefail
|
|
|
|
LOG="${SECURITY_SCAN_LOG:-/home/sadmin/websitedev/security-scan.log}"
|
|
CPU_THRESHOLD="${SECURITY_SCAN_CPU_THRESHOLD:-200}"
|
|
NTFY_TOPIC="${SECURITY_SCAN_NTFY_TOPIC:-st_limidev_security}"
|
|
NTFY_CRED="${SECURITY_SCAN_NTFY_CRED:-/etc/ntfy/credentials/auth.env}"
|
|
NTFY_URL="${SECURITY_SCAN_NTFY_URL:-http://127.0.0.1:2586}"
|
|
FINDINGS=0
|
|
ALERTS=""
|
|
|
|
alert() {
|
|
printf '[%s] %s\n' "$(date '+%F %T')" "$*" | tee -a "$LOG" >&2
|
|
printf -v ALERTS '%s%s\n' "$ALERTS" "$*"
|
|
FINDINGS=$((FINDINGS + 1))
|
|
}
|
|
|
|
# ntfy push — a helyi ntfy szerverre (127.0.0.1:2586), az si_17t_pro user
|
|
# tokenjével (a credential fájlból, sosem kerül kimenetre). A body a konkrét
|
|
# találatokat is tartalmazza, ne csak egy számlálót.
|
|
notify() {
|
|
[ -f "$NTFY_CRED" ] || return 0
|
|
local token
|
|
token="$(grep '^NTFY_SI_TOKEN=' "$NTFY_CRED" 2>/dev/null | cut -d= -f2- | tr -d '"' | tr -d '[:space:]')"
|
|
[ -n "$token" ] || return 0
|
|
local body
|
|
body="🛡 mozdIT monitoring: ${FINDINGS} eltérés — $(date '+%F %T')"$'\n'"${ALERTS}"
|
|
curl -s -o /dev/null --max-time 10 \
|
|
-H "Authorization: Bearer $token" \
|
|
-H "Title: mozdIT biztonsági riasztás" \
|
|
-H "Priority: high" \
|
|
-d "$body" \
|
|
"$NTFY_URL/$NTFY_TOPIC" || true
|
|
}
|
|
|
|
printf '[%s] scan start\n' "$(date '+%F %T')" >> "$LOG"
|
|
|
|
# 1) Hoszt: álcázott / ismert miner folyamatnevek
|
|
HOST_HITS="$(ps -eo comm 2>/dev/null | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|\.redis-server' | grep -v grep || true)"
|
|
[ -n "$HOST_HITS" ] && alert "HOST decoy processes: $(printf '%s ' $HOST_HITS)"
|
|
|
|
# 2) Konténerenként: decoy folyamatok + miner-maradványok a /tmp-ben
|
|
for cid in $(docker ps -q 2>/dev/null); do
|
|
name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')"
|
|
[ -n "$name" ] || continue
|
|
|
|
# A legitim redis-konténereket kihagyjuk (pl. plane-plane-redis-1).
|
|
decoys=""
|
|
if [[ "$name" != *redis* ]]; then
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'redis-server|kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh|\.redis-server' | grep -v grep || true)"
|
|
else
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh' | grep -v grep || true)"
|
|
fi
|
|
[ -n "$decoys" ] && alert "container $name decoy: $(printf '%s' "$decoys" | tr '\n' ' ')"
|
|
|
|
arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>&1 | grep -vE 'cannot exec|is not running|No such container|Error response' || true)"
|
|
[ -n "$arts" ] && alert "container $name /tmp artifacts: $(printf '%s ' $arts)"
|
|
done
|
|
|
|
# 3) Magas CPU-jú konténerek (figyelmeztetés)
|
|
HIGH_CPU="$(docker stats --no-stream --format '{{.Name}} {{.CPUPerc}}' 2>/dev/null \
|
|
| awk -v t="$CPU_THRESHOLD" '{ sub(/%/,"",$2); if ($2+0 > t) printf "%s %.0f%% ", $1, $2 }' || true)"
|
|
[ -n "$HIGH_CPU" ] && alert "high CPU: $HIGH_CPU"
|
|
|
|
# 4) Hoszt /tmp maradványok
|
|
HOST_ARTS="$(ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null || true)"
|
|
[ -n "$HOST_ARTS" ] && alert "HOST /tmp artifacts: $(printf '%s ' $HOST_ARTS)"
|
|
|
|
printf '[%s] scan end (findings=%d)\n' "$(date '+%F %T')" "$FINDINGS" >> "$LOG"
|
|
if [ "$FINDINGS" -gt 0 ]; then
|
|
notify
|
|
exit 1
|
|
fi
|
|
exit 0
|