Do Siki
de0bd2fc07
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
On findings the scan now POSTs a high-priority notification to topic st_security on the host ntfy (127.0.0.1:2586), authenticated with the si_17t_pro token read from /etc/ntfy/credentials/auth.env (never logged). Topic/cred/URL overridable via env for testing.
84 lines
3.5 KiB
Bash
Executable File
84 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Biztonsági monitoring (könnyűsúlyú): kriptominer / backdoor indikátorok
|
|
# detektálása a Docker hoszton és a konténerekben.
|
|
#
|
|
# Cronnal futtatandó (pl. */5 * * * *). Találat esetén exit 1 (a cron MAILTO
|
|
# riasztáshoz használhatja) és a sorok a $LOG fájlba is kerülnek.
|
|
#
|
|
# Env felülírások:
|
|
# SECURITY_SCAN_LOG — log fájl útvonala
|
|
# SECURITY_SCAN_CPU_THRESHOLD — CPU% határ (alap 200)
|
|
# SECURITY_SCAN_NTFY_TOPIC — ntfy topic (alap st_security)
|
|
# SECURITY_SCAN_NTFY_CRED — ntfy credential fájl (alap /etc/ntfy/credentials/auth.env)
|
|
|
|
set -uo pipefail
|
|
|
|
LOG="${SECURITY_SCAN_LOG:-/home/sadmin/websitedev/security-scan.log}"
|
|
CPU_THRESHOLD="${SECURITY_SCAN_CPU_THRESHOLD:-200}"
|
|
NTFY_TOPIC="${SECURITY_SCAN_NTFY_TOPIC:-st_security}"
|
|
NTFY_CRED="${SECURITY_SCAN_NTFY_CRED:-/etc/ntfy/credentials/auth.env}"
|
|
NTFY_URL="${SECURITY_SCAN_NTFY_URL:-http://127.0.0.1:2586}"
|
|
FINDINGS=0
|
|
ALERTS=""
|
|
|
|
alert() {
|
|
printf '[%s] %s\n' "$(date '+%F %T')" "$*" | tee -a "$LOG" >&2
|
|
ALERTS="${ALERTS}${*}\n"
|
|
FINDINGS=$((FINDINGS + 1))
|
|
}
|
|
|
|
# ntfy push — a helyi ntfy szerverre (127.0.0.1:2586), az si_17t_pro user
|
|
# tokenjével (a credential fájlból, sosem kerül kimenetre).
|
|
notify() {
|
|
[ -f "$NTFY_CRED" ] || return 0
|
|
local token
|
|
token="$(grep '^NTFY_SI_TOKEN=' "$NTFY_CRED" 2>/dev/null | cut -d= -f2- | tr -d '"' | tr -d '[:space:]')"
|
|
[ -n "$token" ] || return 0
|
|
curl -s -o /dev/null --max-time 10 \
|
|
-H "Authorization: Bearer $token" \
|
|
-H "Title: mozdIT biztonsági riasztás" \
|
|
-H "Priority: high" \
|
|
-d "🛡 mozdIT monitoring: ${FINDINGS} eltérés — $(date '+%F %T')" \
|
|
"$NTFY_URL/$NTFY_TOPIC" || true
|
|
}
|
|
|
|
printf '[%s] scan start\n' "$(date '+%F %T')" >> "$LOG"
|
|
|
|
# 1) Hoszt: álcázott / ismert miner folyamatnevek
|
|
HOST_HITS="$(ps -eo comm 2>/dev/null | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|\.redis-server' | grep -v grep || true)"
|
|
[ -n "$HOST_HITS" ] && alert "HOST decoy processes: $(printf '%s ' $HOST_HITS)"
|
|
|
|
# 2) Konténerenként: decoy folyamatok + miner-maradványok a /tmp-ben
|
|
for cid in $(docker ps -q 2>/dev/null); do
|
|
name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')"
|
|
[ -n "$name" ] || continue
|
|
|
|
# A legitim redis-konténereket kihagyjuk (pl. plane-plane-redis-1).
|
|
decoys=""
|
|
if [[ "$name" != *redis* ]]; then
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'redis-server|kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh|\.redis-server' | grep -v grep || true)"
|
|
else
|
|
decoys="$(docker top "$cid" 2>/dev/null | tail -n +2 | grep -iE 'kworkerd|xmrig|minerd|kdevtmpfsi|ssl_client|init\.sh' | grep -v grep || true)"
|
|
fi
|
|
[ -n "$decoys" ] && alert "container $name decoy: $(printf '%s' "$decoys" | tr '\n' ' ')"
|
|
|
|
arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>/dev/null || true)"
|
|
[ -n "$arts" ] && alert "container $name /tmp artifacts: $(printf '%s ' $arts)"
|
|
done
|
|
|
|
# 3) Magas CPU-jú konténerek (figyelmeztetés)
|
|
HIGH_CPU="$(docker stats --no-stream --format '{{.Name}} {{.CPUPerc}}' 2>/dev/null \
|
|
| awk -v t="$CPU_THRESHOLD" '{ sub(/%/,"",$2); if ($2+0 > t) printf "%s %.0f%% ", $1, $2 }' || true)"
|
|
[ -n "$HIGH_CPU" ] && alert "high CPU: $HIGH_CPU"
|
|
|
|
# 4) Hoszt /tmp maradványok
|
|
HOST_ARTS="$(ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null || true)"
|
|
[ -n "$HOST_ARTS" ] && alert "HOST /tmp artifacts: $(printf '%s ' $HOST_ARTS)"
|
|
|
|
printf '[%s] scan end (findings=%d)\n' "$(date '+%F %T')" "$FINDINGS" >> "$LOG"
|
|
if [ "$FINDINGS" -gt 0 ]; then
|
|
notify
|
|
exit 1
|
|
fi
|
|
exit 0
|