init
This commit is contained in:
condor
+156
@@ -0,0 +1,156 @@
|
||||
[](https://paypal.me/yeho) [](https://static.oneinstack.com/images/alipay.png) [](https://static.oneinstack.com/images/weixin.png)
|
||||
|
||||
This script is written using the shell, in order to quickly deploy `LEMP`/`LAMP`/`LNMP`/`LNMPA`/`LTMP`(Linux, Nginx/Tengine/OpenResty, MySQL in a production environment/MariaDB/Percona, PHP, JAVA), applicable to RHEL 7, 8, 9(including CentOS,RedHat,AlmaLinux,Rocky), Debian 9, 10, 11, Ubuntu 16, 18, 20, 22 and Fedora 27+ of 64.
|
||||
|
||||
Script properties:
|
||||
- Continually updated, Provide Shell Interaction and Autoinstall
|
||||
- Source compiler installation, most stable source is the latest version, and download from the official site
|
||||
- Some security optimization
|
||||
- Providing a plurality of database versions (MySQL-8.0, MySQL-5.7, MySQL-5.6, MySQL-5.5, MariaDB-10.5, MariaDB-10.4, MariaDB-10.3, MariaDB-5.5, Percona-8.0, Percona-5.7, Percona-5.6, Percona-5.5, PostgreSQL, MongoDB)
|
||||
- Providing multiple PHP versions (PHP-8.1, PHP-8.0, PHP-7.4, PHP-7.3, PHP-7.2, PHP-7.1, PHP-7.0, PHP-5.6, PHP-5.5, PHP-5.4, PHP-5.3)
|
||||
- Provide Nginx, Tengine, OpenResty, Apache and ngx_lua_waf
|
||||
- Providing a plurality of Tomcat version (Tomcat-10, Tomcat-9, Tomcat-8, Tomcat-7)
|
||||
- Providing a plurality of JDK version (OpenJDK-8, OpenJDK-11)
|
||||
- According to their needs to install PHP Cache Accelerator provides ZendOPcache, xcache, apcu, eAccelerator. And php extensions,include ZendGuardLoader,ionCube,SourceGuardian,imagick,gmagick,fileinfo,imap,ldap,calendar,phalcon,yaf,yar,redis,memcached,memcache,mongodb,swoole,xdebug
|
||||
- Installation Nodejs, Pureftpd, phpMyAdmin according to their needs
|
||||
- Install memcached, redis according to their needs
|
||||
- Jemalloc optimize MySQL, Nginx
|
||||
- Providing add a virtual host script, include Let's Encrypt SSL certificate
|
||||
- Provide Nginx/Tengine/OpenResty/Apache/Tomcat, MySQL/MariaDB/Percona, PHP, Redis, Memcached, phpMyAdmin upgrade script
|
||||
- Provide local,remote(rsync between servers),Aliyun OSS,Qcloud COS,UPYUN,QINIU,Amazon S3,Google Drive and Dropbox backup script
|
||||
|
||||
## Installation
|
||||
|
||||
Install the dependencies for your distro, download the source and run the installation script.
|
||||
|
||||
#### CentOS/Redhat
|
||||
|
||||
```bash
|
||||
yum -y install wget screen
|
||||
```
|
||||
|
||||
#### Debian/Ubuntu
|
||||
|
||||
```bash
|
||||
apt-get -y install wget screen
|
||||
```
|
||||
|
||||
#### Download Source and Install
|
||||
|
||||
```bash
|
||||
wget http://mirrors.linuxeye.com/oneinstack-full.tar.gz
|
||||
tar xzf oneinstack-full.tar.gz
|
||||
cd oneinstack
|
||||
```
|
||||
|
||||
If you disconnect during installation, you can execute the command `screen -r oneinstack` to reconnect to the install window
|
||||
```bash
|
||||
screen -S oneinstack
|
||||
```
|
||||
|
||||
If you need to modify the directory (installation, data storage, Nginx logs), modify `config/options.conf` file before running install.sh
|
||||
```bash
|
||||
./install.sh
|
||||
```
|
||||
|
||||
## How to install another PHP version
|
||||
|
||||
```bash
|
||||
~/oneinstack/install.sh --mphp_ver 54
|
||||
|
||||
```
|
||||
|
||||
## How to add Extensions
|
||||
|
||||
```bash
|
||||
~/oneinstack/addons.sh
|
||||
|
||||
```
|
||||
|
||||
## How to add a virtual host
|
||||
|
||||
```bash
|
||||
~/oneinstack/vhost.sh
|
||||
```
|
||||
|
||||
## How to delete a virtual host
|
||||
|
||||
```bash
|
||||
~/oneinstack/vhost.sh --del
|
||||
```
|
||||
|
||||
## How to add FTP virtual user
|
||||
|
||||
```bash
|
||||
~/oneinstack/pureftpd_vhost.sh
|
||||
```
|
||||
|
||||
## How to backup
|
||||
|
||||
```bash
|
||||
~/oneinstack/backup_setup.sh // Backup parameters
|
||||
~/oneinstack/backup.sh // Perform the backup immediately
|
||||
crontab -l // Can be added to scheduled tasks, such as automatic backups every day 1:00
|
||||
0 1 * * * cd ~/oneinstack/backup.sh > /dev/null 2>&1 &
|
||||
```
|
||||
|
||||
## How to manage service
|
||||
|
||||
Nginx/Tengine/OpenResty:
|
||||
```bash
|
||||
systemctl {start|stop|status|restart|reload} nginx
|
||||
```
|
||||
MySQL/MariaDB/Percona:
|
||||
```bash
|
||||
systemctl {start|stop|restart|reload|status} mysqld
|
||||
```
|
||||
PostgreSQL:
|
||||
```bash
|
||||
systemctl {start|stop|restart|status} postgresql
|
||||
```
|
||||
MongoDB:
|
||||
```bash
|
||||
systemctl {start|stop|status|restart|reload} mongod
|
||||
```
|
||||
PHP:
|
||||
```bash
|
||||
systemctl {start|stop|restart|reload|status} php-fpm
|
||||
```
|
||||
Apache:
|
||||
```bash
|
||||
systemctl {start|restart|stop} httpd
|
||||
```
|
||||
Tomcat:
|
||||
```bash
|
||||
systemctl {start|stop|status|restart} tomcat
|
||||
```
|
||||
Pure-FTPd:
|
||||
```bash
|
||||
systemctl {start|stop|restart|status} pureftpd
|
||||
```
|
||||
Redis:
|
||||
```bash
|
||||
systemctl {start|stop|status|restart|reload} redis-server
|
||||
```
|
||||
Memcached:
|
||||
```bash
|
||||
systemctl {start|stop|status|restart|reload} memcached
|
||||
```
|
||||
|
||||
## How to upgrade
|
||||
|
||||
```bash
|
||||
~/oneinstack/upgrade.sh
|
||||
```
|
||||
|
||||
## How to uninstall
|
||||
|
||||
```bash
|
||||
~/oneinstack/uninstall.sh
|
||||
```
|
||||
|
||||
## Installation
|
||||
|
||||
For feedback, questions, and to follow the progress of the project: <br />
|
||||
[Telegram Group](https://t.me/oneinstack)<br />
|
||||
[OneinStack](https://oneinstack.com)<br />
|
||||
+211
@@ -0,0 +1,211 @@
|
||||
# ServerStack 脚本使用说明
|
||||
|
||||
> 适用版本：当前项目（重构 + 软件裁剪 + 仅支持 Debian 9-13 / Ubuntu 16-26）。
|
||||
> 所有命令**必须以 root 身份**在目标 Linux 服务器上运行。
|
||||
> 项目根目录约定为 `ServerStack/`，入口脚本都在 `bin/` 下，**请在该项目根目录执行**。
|
||||
|
||||
---
|
||||
|
||||
## 0. 通用说明
|
||||
|
||||
- **交互模式**：直接运行脚本，按菜单提示逐项选择。
|
||||
- **无人值守（CLI）模式**：在脚本后加长选项，可跳过菜单直接安装。
|
||||
- 安装日志：`runtime/install.log`。
|
||||
- 版本与路径配置：`config/versions.txt`、`config/options.conf`。
|
||||
- 若 SSH 端口非 22，安装脚本会提示并写入 `/etc/ssh/sshd_config`（可选防火墙 `--iptables`）。
|
||||
|
||||
---
|
||||
|
||||
## 1. 主安装 `bin/install.sh`
|
||||
|
||||
### 1.1 交互模式
|
||||
```bash
|
||||
cd ServerStack
|
||||
bash bin/install.sh
|
||||
```
|
||||
菜单依次询问（可全部选 `n` 跳过某类）：
|
||||
|
||||
| 步骤 | 选项 | 说明 |
|
||||
|------|------|------|
|
||||
| Web 服务器 | y/n | 是否安装 Web |
|
||||
| Nginx | `1` 安装 / `2` 不安装 | 仅保留 Nginx（已裁剪 Apache/Tengine/OpenResty） |
|
||||
| 数据库 | y/n | 是否安装 DB |
|
||||
| DB 版本 | `1` MySQL-8.0 / `2` MySQL-5.7 / `3` MariaDB-10.11 / `4` MariaDB-11.8 / `5` MariaDB-12.3 / `6` PostgreSQL-15.14 / `7` PostgreSQL-16.10 / `8` PostgreSQL-17.6 / `9` MongoDB | 9 选 1（默认 `2`） |
|
||||
| DB 安装方式 | `1` 二进制包 / `2` 源码编译 | 仅 MySQL/MariaDB 出现（默认 `1`） |
|
||||
| DB 密码 | 输入或回车用随机密码 | MySQL/MariaDB→root；PG→postgres；Mongo→root |
|
||||
| PHP | y/n | 是否安装 PHP |
|
||||
| PHP 版本 | `1` php-7.4 / `2` php-8.0 / `3` php-8.1 | 3 选 1（默认 `1`） |
|
||||
| OPcode 缓存 | y/n → `1` Zend OPcache / `2` APCu | |
|
||||
| PHP 扩展 | 多选编号，如 `4 11 12` | 0 不装；可用 imagick/gmagick/fileinfo/imap/ldap/phalcon/yaf/redis/mongodb/swoole/xdebug 等 |
|
||||
| Node.js | y/n | |
|
||||
| Pure-FTPd | y/n | |
|
||||
| phpMyAdmin | y/n | |
|
||||
| redis-server | y/n | |
|
||||
| iptables | y/n | 是否启用防火墙 |
|
||||
|
||||
### 1.2 无人值守（CLI）示例
|
||||
```bash
|
||||
# 安装 Nginx + MySQL-8.0(二进制) + PHP-8.1(OPcache) + redis，结束不重启
|
||||
bash bin/install.sh --nginx_option 1 --db_option 1 --dbinstallmethod 1 \
|
||||
--dbrootpwd 'YourDBpass123' --php_option 3 --phpcache_option 1 \
|
||||
--php_extensions "fileinfo redis" --redis
|
||||
|
||||
# 只装 PostgreSQL-17.6，并启用防火墙、装完后重启
|
||||
bash bin/install.sh --db_option 8 --dbrootpwd 'PgPass123' \
|
||||
--iptables --reboot
|
||||
```
|
||||
常用 CLI 参数：
|
||||
|
||||
| 参数 | 取值 | 说明 |
|
||||
|------|------|------|
|
||||
| `--nginx_option` | `1`/`2` | 1 安装 Nginx，2 不安装 |
|
||||
| `--php_option` | `1`/`2`/`3` | php-7.4 / 8.0 / 8.1 |
|
||||
| `--mphp_ver` | `74`/`80`/`81` | 多版本 PHP 共存（配合 `--mphp_addons`） |
|
||||
| `--mphp_addons` | 无值 | 为 mphp 版本安装附加组件 |
|
||||
| `--phpcache_option` | 编号 | PHP OPcode 缓存选择 |
|
||||
| `--php_extensions` | 扩展名列表 | 空格分隔，如 `imagick redis swoole` |
|
||||
| `--db_option` | `1`–`9` | 见上表 |
|
||||
| `--dbinstallmethod` | `1`/`2` | 1 二进制，2 源码 |
|
||||
| `--dbrootpwd` | 字符串 | 数据库超级密码（同时用于 PG/Mongo） |
|
||||
| `--pureftpd` | 无值 | 安装 Pure-FTPd |
|
||||
| `--redis` | 无值 | 安装 Redis |
|
||||
| `--phpmyadmin` | 无值 | 安装 phpMyAdmin |
|
||||
| `--python` / `--nodejs` | 无值 | 安装 Python / Node.js |
|
||||
| `--ssh_port` | 端口号 | 修改 SSH 端口 |
|
||||
| `--iptables` | 无值 | 启用 iptables 防火墙 |
|
||||
| `--reboot` | 无值 | 安装完成后重启 |
|
||||
| `-h/--help` | 无值 | 查看帮助 |
|
||||
|
||||
---
|
||||
|
||||
## 2. 卸载 `bin/uninstall.sh`
|
||||
```bash
|
||||
bash bin/uninstall.sh --all # 卸载全部
|
||||
bash bin/uninstall.sh --web # 仅卸载 Nginx
|
||||
bash bin/uninstall.sh --mysql # 卸载 MySQL/MariaDB
|
||||
bash bin/uninstall.sh --postgresql # 卸载 PostgreSQL
|
||||
bash bin/uninstall.sh --mongodb # 卸载 MongoDB
|
||||
bash bin/uninstall.sh --php # 卸载主 PHP
|
||||
bash bin/uninstall.sh --mphp_ver 81 # 卸载某个多版本 PHP（74/80/81）
|
||||
bash bin/uninstall.sh --allphp # 卸载所有 PHP
|
||||
bash bin/uninstall.sh --phpcache # 卸载 PHP OPcode 缓存
|
||||
bash bin/uninstall.sh --php_extensions redis # 卸载指定 PHP 扩展
|
||||
bash bin/uninstall.sh -q # 静默模式
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. 升级 `bin/upgrade.sh`
|
||||
```bash
|
||||
bash bin/upgrade.sh --nginx [版本] # 升级 Nginx
|
||||
bash bin/upgrade.sh --db [版本] # 升级 MySQL/MariaDB
|
||||
bash bin/upgrade.sh --php [版本] # 升级 PHP
|
||||
bash bin/upgrade.sh --redis [版本] # 升级 Redis
|
||||
bash bin/upgrade.sh --phpmyadmin [版本]
|
||||
bash bin/upgrade.sh --oneinstack # 升级 ServerStack 自身到最新
|
||||
bash bin/upgrade.sh --acme.sh # 升级 acme.sh
|
||||
bash bin/upgrade.sh -h
|
||||
```
|
||||
> 版本号省略时自动取官方最新稳定版。
|
||||
|
||||
---
|
||||
|
||||
## 4. 虚拟主机 `bin/vhost.sh`
|
||||
```bash
|
||||
bash bin/vhost.sh --add # 交互式新增站点（含 SSL 选项）
|
||||
bash bin/vhost.sh --list # 列出所有虚拟主机
|
||||
bash bin/vhost.sh --delete # 删除虚拟主机
|
||||
bash bin/vhost.sh --mphp_ver 81 # 指定多版本 PHP（74/80/81）
|
||||
bash bin/vhost.sh --proxy # 反向代理模式
|
||||
bash bin/vhost.sh --httponly # 仅 HTTP
|
||||
bash bin/vhost.sh --selfsigned # 自签名 SSL
|
||||
bash bin/vhost.sh --letsencrypt # Let's Encrypt 免费证书
|
||||
bash bin/vhost.sh --dnsapi # 用 DNS API 自动签发证书
|
||||
```
|
||||
新增站点时会提示：域名、根目录、是否开启 rewrite（内置 discuz/wordpress/typecho/thinkphp 等模板）、PHP 版本、SSL 方式。
|
||||
|
||||
---
|
||||
|
||||
## 5. 扩展/安全组件 `bin/addons.sh`
|
||||
```bash
|
||||
bash bin/addons.sh --install --composer # 安装 Composer
|
||||
bash bin/addons.sh --install --fail2ban # 安装 Fail2ban（SSH 防暴破）
|
||||
bash bin/addons.sh --install --ngx_lua_waf # 安装 Nginx Lua WAF
|
||||
bash bin/addons.sh --install --python # 安装 Python
|
||||
bash bin/addons.sh --uninstall --composer # 卸载对应组件
|
||||
bash bin/addons.sh -h
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. 备份 `bin/backup_setup.sh` + `bin/backup.sh`
|
||||
|
||||
### 6.1 配置备份目标 `backup_setup.sh`
|
||||
```bash
|
||||
bash bin/backup_setup.sh
|
||||
```
|
||||
交互选择备份目的地（1 本机 / 2 远程主机 / 3 阿里云 OSS / 4 腾讯云 COS / 5 又拍云 / 6 七牛 / 7 AWS S3 / 8 Dropbox），并按提示输入对应凭据（均交互输入，不写入脚本）。
|
||||
|
||||
设置会生成 `config_backup.txt`（含远程主机 IP/用户/口令——**明文存储，请妥善保管**）。
|
||||
|
||||
### 6.2 执行备份 `backup.sh`
|
||||
```bash
|
||||
bash bin/backup.sh
|
||||
```
|
||||
按 settings 自动备份：网站目录、数据库（本地+可选远程/对象存储）、并清理过期备份。
|
||||
> 远程/对象存储备份底层会调用 `scripts/` 下的 `db_bk.sh`、`mabs.sh` 等批量运维工具，需 `backup_setup.sh` 已配置好目标。
|
||||
|
||||
---
|
||||
|
||||
## 7. FTP 用户管理 `bin/pureftpd_vhost.sh`
|
||||
```bash
|
||||
bash bin/pureftpd_vhost.sh --add -u ftpuser -p pass -d /data/www # 新增 FTP 用户
|
||||
bash bin/pureftpd_vhost.sh --usermod -u ftpuser -d /new/dir # 改主目录
|
||||
bash bin/pureftpd_vhost.sh --passwd -u ftpuser -p newpass # 改密码
|
||||
bash bin/pureftpd_vhost.sh --delete -u ftpuser # 删用户
|
||||
bash bin/pureftpd_vhost.sh --list # 列出所有用户
|
||||
bash bin/pureftpd_vhost.sh --showuser -u ftpuser # 查看用户详情
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 重置数据库 root 密码 `bin/reset_db_root_password.sh`
|
||||
```bash
|
||||
bash bin/reset_db_root_password.sh -p 'NewPass123' # 用新密码重置
|
||||
bash bin/reset_db_root_password.sh -f # 忘记旧密码，强制重置
|
||||
bash bin/reset_db_root_password.sh -q # 静默
|
||||
bash bin/reset_db_root_password.sh -h
|
||||
```
|
||||
> 默认会生成 8 位随机密码（无 `-p` 时），重置后请在输出中记录。
|
||||
|
||||
---
|
||||
|
||||
## 9. `scripts/` 运维辅助（非安装必需，手动调用）
|
||||
|
||||
| 脚本 | 用途 | 注意 |
|
||||
|------|------|------|
|
||||
| `scripts/db_bk.sh <库名>` | 单库备份 | 被 backup.sh 调用 |
|
||||
| `scripts/website_bk.sh` | 网站目录备份 | 被 backup.sh 调用 |
|
||||
| `scripts/mabs.sh` + `thread.sh` + `mssh.exp` + `mscp.exp` | 多主机批量 SSH/SCP 推送与命令执行 | 需自备 `iplist.txt`/`config.txt`；明文存远程口令；不会自动触发 |
|
||||
| `scripts/ckssh.py` | 检测某 IP 的 SSH 端口是否通 | 仅 TCP 连通性检测 |
|
||||
|
||||
---
|
||||
|
||||
## 10. 注意事项（与上游 OneinStack 的差异）
|
||||
|
||||
1. **仅支持 Debian 9-13 / Ubuntu 16-26**（apt-get 系）；RHEL/CentOS 等会直接退出。
|
||||
2. **软件已裁剪**：Web 仅 Nginx；DB 仅 MySQL/MariaDB/PostgreSQL/MongoDB；缓存仅 Redis；移除 Tengine/OpenResty/Apache/Percona/Memcached/Tomcat/OpenJDK。
|
||||
3. **PHP 仅 7.4 / 8.0 / 8.1**；多版本共存仅支持这三者。
|
||||
4. **Nginx 已精简**：不含 rtmp 流媒体与 fancyindex 目录美化模块。
|
||||
5. 安装日志路径为 `runtime/install.log`（向上游 `install.log` 内容一致）。
|
||||
|
||||
---
|
||||
|
||||
## 11. 快速参考（一条命令装常用栈）
|
||||
```bash
|
||||
# LNMP + Redis + phpMyAdmin，装完重启
|
||||
cd ServerStack
|
||||
bash bin/install.sh --nginx_option 1 --db_option 1 --dbinstallmethod 1 \
|
||||
--dbrootpwd 'DBpass!2026' --php_option 3 --phpcache_option 1 \
|
||||
--php_extensions "fileinfo redis" --redis --phpmyadmin --reboot
|
||||
```
|
||||
@@ -0,0 +1,70 @@
|
||||
# ServerStack 脚本后门专项审计报告
|
||||
|
||||
- 审计日期：2026-07-17
|
||||
- 审计对象：`E:\Desktop\ServerStack`（83 个 .sh 脚本 + .py / .exp / .conf / .service 等配套文件）
|
||||
- 审计方式：针对后门典型特征做定向扫描（grep + 人工阅读命中上下文），区分"正常拉取官方源码"与"可疑外连/执行"
|
||||
- **结论：未发现任何后门（无隐藏外连、反弹 shell、混淆执行、持久化、提权或 SSH 后门）。**
|
||||
|
||||
---
|
||||
|
||||
## 一、已核查的后门特征类别与结果
|
||||
|
||||
| # | 检查项 | 命中情况 | 判定 |
|
||||
|---|--------|----------|------|
|
||||
| 1 | 网络外连 / 远程下载执行（curl/wget/nc/socat/telnet） | 全部为下载官方软件包 | 正常 |
|
||||
| 2 | 反弹 shell（/dev/tcp、bash -i、nc -e、mkfifo） | 0 命中 | 干净 |
|
||||
| 3 | 混淆 / 解码执行（base64 -d、xxd -r、openssl enc、滥用 eval） | 仅 `eval set --`(getopt 解析) 与生成随机密钥的 base64 | 正常 |
|
||||
| 4 | pipe-to-shell（下载输出直接 `\| bash`/`\| sh`） | 2 处：mongo 建用户命令、PHP 升级重建 configure | 正常 |
|
||||
| 5 | 持久化（cron、systemctl enable、rc.local、/etc/profile.d、@reboot） | ntpdate 校时 cron、fail2ban 自启、profile.d 环境变量 | 正常 |
|
||||
| 6 | 提权（useradd、chmod 777、SUID、NOPASSWD sudo、LD_PRELOAD） | 0 命中（SUID/sudo 全空） | 干净 |
|
||||
| 7 | SSH 后门（注入 authorized_keys、改 sshd_config） | 仅改 SSH 端口（用户选项）、清理 known_hosts | 正常 |
|
||||
| 8 | 自启隐藏（nohup、setsid、disown、/tmp 落盘执行） | 0 命中（/dev/shm 均为 PHP-FPM socket 路径） | 干净 |
|
||||
| 9 | 下载源域名白名单 | 全部为官方/主流镜像（见下） | 正常 |
|
||||
| 10 | IP 探测脚本是否回传数据 | 仅 GET 本机公网 IP，无数据外发 | 正常 |
|
||||
| 11 | 主流程隐藏钩子（loader/workflow/menu/installer/init） | 仅安装 wget/curl 软件包 | 正常 |
|
||||
| 12 | 备份脚本硬编码凭据 | 全部交互式 `read -p` 输入 | 正常 |
|
||||
|
||||
---
|
||||
|
||||
## 二、下载源域名白名单（全部可信）
|
||||
|
||||
- 项目站：`oneinstack.com`、`github.com/oneinstack`、`linuxeye.com`、`mirrors.linuxeye.com`
|
||||
- 数据库官方源：`cdn.mysql.com`、`repo.huaweicloud.com`、`mirrors.tuna.tsinghua.edu.cn`、`mirrors.dotsrc.org`、`archive.mariadb.org`、`ftp.postgresql.org`、`ftp.heanet.ie`、`fastdl.mongodb.org`
|
||||
- Web/PHP：`nginx.org`、`php.net`/`secure.php.net`、`pecl.php.net`、`pear.php.net`、`getcomposer.org`/`mirrors.aliyun.com`、`downloads.sourceforge.net`、`nodejs.org`、`www.openssl.org`、`downloads.ioncube.com`、`download.pureftpd.org`
|
||||
- 备份工具（用户主动启用）：`gosspublic.alicdn.com`(阿里云OSS)、`devtools.qiniu.com`(七牛)、`collection.b0.upaiyun.com`(又拍)、`mirrors.linuxeye.com`(Dropbox 客户端 dbxcli)
|
||||
- IP 归属探测（仅用于国内/国外镜像分流）：`ip-api.com`、`ipv4.icanhazip.com`、`pv.sohu.com`
|
||||
- README 链接：`img.shields.io`、`t.me`、`paypal.me`（非脚本执行）
|
||||
|
||||
---
|
||||
|
||||
## 三、双用工具（非后门，但建议知晓）
|
||||
|
||||
`scripts/` 下的批量运维套件**需用户显式提供 `iplist.txt`/`config.txt` 并手动运行**，不会被安装流程静默触发：
|
||||
|
||||
- `ckssh.py`：仅做 TCP 端口连通性检测（connect 后打印 ok/no）。
|
||||
- `mabs.sh` + `thread.sh` + `mssh.exp` + `mscp.exp`：读取 IP/端口/用户/口令列表，向多台主机推送文件或执行命令。口令经 `xxd` 十六进制编码后由 `bc`/`dc` 解码传入 expect（本地编码，非外泄）。
|
||||
- 调用点：仅 `bin/backup.sh:269`（备份到远程）、`bin/backup_setup.sh:167`（备份配置），且均依赖用户填写的配置文件。
|
||||
- **风险点（运维自有风险，非恶意）**：配置文件中以明文存储远程主机口令；该工具可对多主机批量执行命令。请妥善保管 `iplist.txt`/`config_backup.txt`。
|
||||
|
||||
---
|
||||
|
||||
## 四、附带发现（非安全后门，建议修复）
|
||||
|
||||
- `modules/security/fail2ban.sh` 第 23–33 行：仍把 init 脚本拷贝到 `/etc/services/fail2ban`（应为 `/etc/init.d/fail2ban`），属上一轮"仅支持 Debian/Ubuntu"裁剪时遗留的 RHEL 路径笔误（与之前 mysql 的 `/etc/services/mysqld` 同类）。不影响 Debian/Ubuntu 分支，但属功能 bug，建议一并修正。
|
||||
- `src/` 目录残留 `nginx-rtmp-module.tar.gz`、`ngx-fancyindex-0.5.2.tar.xz`（前轮已从 nginx.sh 移除引用），可清理以减少体积。
|
||||
- 项目当前非 git 仓库，无法做提交历史比对；如需验证完整性，建议初始化 git 并定期提交基线。
|
||||
|
||||
---
|
||||
|
||||
## 五、审计命令摘要（可复现）
|
||||
|
||||
```
|
||||
# 外连/反弹 shell
|
||||
grep -rniE "curl |wget |nc |/dev/tcp/|bash -i|socat|mkfifo" --include="*.sh" .
|
||||
# 混淆/动态执行
|
||||
grep -rniE "base64 -d|/dev/tcp/|xxd -r|openssl enc" --include="*.sh" .
|
||||
# 持久化/提权
|
||||
grep -rniE "crontab|@reboot|systemctl enable|ld_preload|useradd|chmod 777|chmod \+s|NOPASSWD" --include="*.sh" .
|
||||
# 全部域名
|
||||
grep -rnoE "https?://[^/]+" --include="*.sh" --include="*.py" . | sort -u
|
||||
```
|
||||
Reference in New Issue
Block a user