From c15a983bf7731d2a752e04c762004e12ad3ef4d0 Mon Sep 17 00:00:00 2001 From: xzx3344521 Date: Wed, 22 Oct 2025 08:23:00 +0800 Subject: [PATCH] =?UTF-8?q?Update=20=E5=AE=9E=E6=97=B6=20history=20?= =?UTF-8?q?=E7=9B=91=E6=8E=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 实时 history 监控 | 242 +++++++++++++--------------------------------- 1 file changed, 65 insertions(+), 177 deletions(-) diff --git a/实时 history 监控 b/实时 history 监控 index 6f448ef..0240508 100644 --- a/实时 history 监控 +++ b/实时 history 监控 @@ -1,57 +1,25 @@ +# 创建本地安装脚本 +cat > /tmp/local_install.sh << 'EOF' #!/bin/bash -# 命令监控系统安装脚本 -# 功能：监控系统所有用户的命令执行并记录 - -INSTALL_DIR="/root/install" +INSTALL_DIR="/root/monitor" SCRIPT_NAME="cmd_monitor.sh" SCRIPT_PATH="$INSTALL_DIR/$SCRIPT_NAME" LOG_DIR="/root/command_logs" -PID_FILE="/tmp/cmd_monitor.pid" -# 颜色定义 -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[0;34m' -NC='\033[0m' # No Color +# 创建目录 +mkdir -p "$INSTALL_DIR" +mkdir -p "$LOG_DIR" -# 打印颜色信息 -info() { echo -e "${BLUE}[INFO]${NC} $1"; } -success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; } -warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; } -error() { echo -e "${RED}[ERROR]${NC} $1"; } - -# 检查root权限 -check_root() { - if [ "$EUID" -ne 0 ]; then - error "请使用root权限运行此脚本" - exit 1 - fi -} - -# 创建必要的目录 -create_directories() { - info "创建安装目录..." - mkdir -p "$INSTALL_DIR" - mkdir -p "$LOG_DIR" - chmod 755 "$INSTALL_DIR" - chmod 755 "$LOG_DIR" -} - -# 创建监控脚本 -create_monitor_script() { - info "创建监控脚本..." - - cat > "$SCRIPT_PATH" << 'SCRIPT_EOF' +# 创建主监控脚本 +cat > "$SCRIPT_PATH" << 'SCRIPT_EOF' #!/bin/bash -INSTALL_DIR="/root/install" +INSTALL_DIR="/root/monitor" SCRIPT_PATH="$INSTALL_DIR/cmd_monitor.sh" LOG_DIR="/root/command_logs" PID_FILE="/tmp/cmd_monitor.pid" -# 获取客户端IP get_client_ip() { local ip="unknown" [ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}') @@ -59,8 +27,7 @@ get_client_ip() { echo "$ip" } -# 检查to命令 -if [ "$1" = "to" ] || [ "$1" = "TO" ]; then +if [ "$1" = "to" ]; then if [ -f "$PID_FILE" ] && ps -p $(cat "$PID_FILE") >/dev/null 2>&1; then echo "切换到前台模式..." kill $(cat "$PID_FILE") 2>/dev/null @@ -73,33 +40,22 @@ if [ "$1" = "to" ] || [ "$1" = "TO" ]; then exit 0 fi -case "${1:-}" in +case "$1" in background|start) # 设置实时history for user_dir in /home/* /root; do [ -d "$user_dir" ] || continue bashrc="$user_dir/.bashrc" [ -f "$bashrc" ] || continue - if ! grep -q "PROMPT_COMMAND.*history.*a.*c.*r" "$bashrc" 2>/dev/null; then - echo "export PROMPT_COMMAND='history -a; history -c; history -r'" >> "$bashrc" - # 重新加载bashrc - [ -n "$BASH_VERSION" ] && source "$bashrc" 2>/dev/null + if ! grep -q "PROMPT_COMMAND.*history" "$bashrc" 2>/dev/null; then + echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> "$bashrc" fi done # 后台启动 ( - echo "=== 后台监控启动于: $(date) ===" >> "$LOG_DIR/background.log" - echo "监控用户: $(ls /home | tr '\n' ' ') root" >> "$LOG_DIR/background.log" - + echo "=== 后台监控启动: $(date) ===" >> "$LOG_DIR/monitor.log" declare -A last_sizes - # 初始化文件大小 - for user_dir in /home/* /root; do - [ -d "$user_dir" ] || continue - user=$(basename "$user_dir") - history_file="$user_dir/.bash_history" - [ -f "$history_file" ] && last_sizes["$user"]=$(stat -c%s "$history_file" 2>/dev/null || echo 0) - done while true; do for user_dir in /home/* /root; do @@ -112,13 +68,18 @@ case "${1:-}" in last_size=${last_sizes["$user"]:-0} if [ "$current_size" -gt "$last_size" ]; then - new_cmd=$(tail -c $((current_size - last_size)) "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//' | tail -n1) - if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ] && [[ ! "$new_cmd" =~ ^(ls|cd|pwd|ll|history|exit|clear|to|TO|\.\/|sh |bash ) ]]; then - client_ip=$(get_client_ip) - timestamp=$(date '+%Y-%m-%d %H:%M:%S') - log_entry="[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" - echo "$log_entry" >> "$LOG_DIR/background.log" - echo "$log_entry" # 同时输出到控制台 + new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//') + if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then + case "$new_cmd" in + ls|cd|pwd|ll|history|exit|clear|to|"."|"..") + continue + ;; + *) + client_ip=$(get_client_ip) + timestamp=$(date '+%Y-%m-%d %H:%M:%S') + echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" >> "$LOG_DIR/monitor.log" + ;; + esac fi last_sizes["$user"]=$current_size fi @@ -129,26 +90,17 @@ case "${1:-}" in echo $! > "$PID_FILE" echo "后台监控已启动 (PID: $!)" - echo "日志文件: $LOG_DIR/background.log" + echo "日志文件: $LOG_DIR/monitor.log" ;; foreground) - echo "前台监控模式启动..." - echo "输入 'to' 切换到后台模式" - echo "按 Ctrl+C 停止监控" + echo "前台监控模式 - 输入 'to' 切换到后台" + echo "按 Ctrl+C 停止" echo "================================" declare -A last_sizes - # 初始化文件大小 - for user_dir in /home/* /root; do - [ -d "$user_dir" ] || continue - user=$(basename "$user_dir") - history_file="$user_dir/.bash_history" - [ -f "$history_file" ] && last_sizes["$user"]=$(stat -c%s "$history_file" 2>/dev/null || echo 0) - done while true; do - # 监控命令 for user_dir in /home/* /root; do [ -d "$user_dir" ] || continue user=$(basename "$user_dir") @@ -159,11 +111,18 @@ case "${1:-}" in last_size=${last_sizes["$user"]:-0} if [ "$current_size" -gt "$last_size" ]; then - new_cmd=$(tail -c $((current_size - last_size)) "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//' | tail -n1) - if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ] && [[ ! "$new_cmd" =~ ^(ls|cd|pwd|ll|history|exit|clear|to|TO|\.\/|sh |bash ) ]]; then - client_ip=$(get_client_ip) - timestamp=$(date '+%Y-%m-%d %H:%M:%S') - echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" + new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//') + if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then + case "$new_cmd" in + ls|cd|pwd|ll|history|exit|clear|to|"."|"..") + continue + ;; + *) + client_ip=$(get_client_ip) + timestamp=$(date '+%Y-%m-%d %H:%M:%S') + echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" + ;; + esac fi last_sizes["$user"]=$current_size fi @@ -174,30 +133,9 @@ case "${1:-}" in stop) if [ -f "$PID_FILE" ]; then - pid=$(cat "$PID_FILE") - if ps -p "$pid" >/dev/null 2>&1; then - kill "$pid" 2>/dev/null - rm -f "$PID_FILE" - echo "监控已停止 (PID: $pid)" - else - rm -f "$PID_FILE" - echo "监控进程不存在，已清理PID文件" - fi - else - echo "监控未运行" - fi - ;; - - status) - if [ -f "$PID_FILE" ]; then - pid=$(cat "$PID_FILE") - if ps -p "$pid" >/dev/null 2>&1; then - echo "监控运行中 (PID: $pid)" - echo "日志文件: $LOG_DIR/background.log" - else - echo "PID文件存在但进程不存在" - rm -f "$PID_FILE" - fi + kill $(cat "$PID_FILE") 2>/dev/null + rm -f "$PID_FILE" + echo "监控已停止" else echo "监控未运行" fi @@ -205,88 +143,38 @@ case "${1:-}" in install) # 设置开机自启动 - info "设置开机自启动..." (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "@reboot $SCRIPT_PATH background >/dev/null 2>&1") | crontab - # 设置to命令别名 - info "设置命令别名..." - for user_dir in /home/* /root; do - [ -d "$user_dir" ] || continue - bashrc="$user_dir/.bashrc" - [ -f "$bashrc" ] || continue - if ! grep -q "alias to=" "$bashrc" 2>/dev/null; then - echo "alias to='$SCRIPT_PATH to'" >> "$bashrc" - echo "已为 $user_dir 设置别名" - fi - done + echo "alias to='$SCRIPT_PATH to'" >> ~/.bashrc + echo "alias to" >> ~/.bashrc - success "安装完成!" - echo "使用方法:" - echo " to - 切换前后台模式" - echo " $SCRIPT_PATH foreground - 前台模式" - echo " $SCRIPT_PATH background - 后台模式" - echo " $SCRIPT_PATH stop - 停止监控" - echo " $SCRIPT_PATH status - 查看状态" - ;; - - uninstall) - "$SCRIPT_PATH" stop - info "清理文件..." - rm -f "$SCRIPT_PATH" - rm -rf "$INSTALL_DIR" - # 清理crontab - crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH" | crontab - - # 清理别名 - for user_dir in /home/* /root; do - [ -d "$user_dir" ] || continue - bashrc="$user_dir/.bashrc" - [ -f "$bashrc" ] && sed -i "/alias to=.*cmd_monitor/d" "$bashrc" - done - success "卸载完成" + echo "安装完成!" + echo "请运行: source ~/.bashrc" + echo "然后使用: to 命令切换模式" ;; *) - echo "命令监控系统 v1.0" - echo "使用方法: $0 {foreground|background|stop|status|install|uninstall|to}" - echo "" - echo "示例:" - echo " $0 install # 安装并配置" - echo " $0 foreground # 前台监控模式" - echo " $0 background # 后台监控模式" - echo " to # 切换前后台模式" - echo " $0 stop # 停止监控" - echo " $0 status # 查看状态" - echo " $0 uninstall # 卸载" + echo "使用方法: $0 {foreground|background|stop|install|to}" + echo "安装后使用 'to' 命令切换模式" ;; esac SCRIPT_EOF - chmod +x "$SCRIPT_PATH" - success "监控脚本创建完成: $SCRIPT_PATH" -} +chmod +x "$SCRIPT_PATH" # 执行安装 -main() { - echo "==========================================" - echo " 命令监控系统安装程序" - echo "==========================================" - - check_root - create_directories - create_monitor_script - - info "执行安装配置..." - "$SCRIPT_PATH" install - - echo "" - success "安装完成!" - echo "==========================================" - echo "脚本位置: $SCRIPT_PATH" - echo "日志目录: $LOG_DIR" - echo "立即测试: $SCRIPT_PATH foreground" - echo "或使用: to 命令切换模式" - echo "==========================================" -} +echo "开始安装..." +"$SCRIPT_PATH" install -# 执行主函数 -main "$@" +echo "" +echo "=== 安装完成 ===" +echo "脚本位置: $SCRIPT_PATH" +echo "日志目录: $LOG_DIR" +echo "请运行: source ~/.bashrc" +echo "然后测试: to" +EOF + +# 执行本地安装 +chmod +x /tmp/local_install.sh +/tmp/local_install.sh