# 创建独立安装脚本 cat > /tmp/standalone_install.sh << 'EOF' #!/bin/bash INSTALL_DIR="/root/安装" SCRIPT_NAME="cmd_monitor.sh" SCRIPT_PATH="$INSTALL_DIR/$SCRIPT_NAME" LOG_DIR="/root/command_logs" PID_FILE="/tmp/cmd_monitor.pid" # 创建安装目录 mkdir -p "$INSTALL_DIR" mkdir -p "$LOG_DIR" # 创建监控脚本 cat > "$SCRIPT_PATH" << 'SCRIPT_EOF' #!/bin/bash INSTALL_DIR="/root/安装" SCRIPT_PATH="$INSTALL_DIR/cmd_monitor.sh" LOG_DIR="/root/command_logs" PID_FILE="/tmp/cmd_monitor.pid" # 获取客户端IP get_client_ip() { local ip="unknown" [ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}') [ "$ip" = "unknown" ] && [ -n "$SSH_CONNECTION" ] && ip=$(echo "$SSH_CONNECTION" | awk '{print $1}') echo "$ip" } # 检查to命令 if [ "$1" = "to" ] || [ "$1" = "TO" ]; then if [ -f "$PID_FILE" ] && ps -p $(cat "$PID_FILE") >/dev/null 2>&1; then echo "切换到前台模式..." kill $(cat "$PID_FILE") 2>/dev/null rm -f "$PID_FILE" exec "$SCRIPT_PATH" foreground else echo "切换到后台模式..." exec "$SCRIPT_PATH" background fi exit 0 fi case "${1:-}" in background|start) # 设置实时history for user_dir in /home/* /root; do [ -d "$user_dir" ] || continue bashrc="$user_dir/.bashrc" [ -f "$bashrc" ] || continue grep -q "PROMPT_COMMAND" "$bashrc" || echo "export PROMPT_COMMAND='history -a; history -c; history -r'" >> "$bashrc" done # 后台启动 ( echo "后台监控启动于: $(date)" >> "$LOG_DIR/background.log" declare -A last_sizes while true; do for user_dir in /home/* /root; do [ -d "$user_dir" ] || continue user=$(basename "$user_dir") history_file="$user_dir/.bash_history" [ -f "$history_file" ] || continue current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0) last_size=${last_sizes["$user"]:-0} if [ "$current_size" -gt "$last_size" ]; then new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//') if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ] && [[ ! "$new_cmd" =~ ^(ls|cd|pwd|ll|history|exit|clear|to|TO)$ ]]; then client_ip=$(get_client_ip) timestamp=$(date '+%Y-%m-%d %H:%M:%S') echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" >> "$LOG_DIR/background.log" fi last_sizes["$user"]=$current_size fi done sleep 1 done ) & echo $! > "$PID_FILE" echo "后台监控已启动 (PID: $!)" echo "日志: $LOG_DIR/background.log" ;; foreground) echo "前台监控模式 - 输入 'to' 切换到后台" echo "按 Ctrl+C 停止" declare -A last_sizes while true; do # 检查to命令 if read -t 0.1 -n 2 input 2>/dev/null; then if [ "$input" = "to" ] || [ "$input" = "TO" ]; then echo "切换到后台模式..." "$SCRIPT_PATH" background exit 0 fi fi # 监控命令 for user_dir in /home/* /root; do [ -d "$user_dir" ] || continue user=$(basename "$user_dir") history_file="$user_dir/.bash_history" [ -f "$history_file" ] || continue current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0) last_size=${last_sizes["$user"]:-0} if [ "$current_size" -gt "$last_size" ]; then new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//') if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ] && [[ ! "$new_cmd" =~ ^(ls|cd|pwd|ll|history|exit|clear|to|TO)$ ]]; then client_ip=$(get_client_ip) timestamp=$(date '+%Y-%m-%d %H:%M:%S') echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" fi last_sizes["$user"]=$current_size fi done sleep 1 done ;; stop) if [ -f "$PID_FILE" ]; then kill $(cat "$PID_FILE") 2>/dev/null rm -f "$PID_FILE" echo "监控已停止" else echo "监控未运行" fi ;; install) # 设置开机自启动 (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "@reboot $SCRIPT_PATH background >/dev/null 2>&1") | crontab - # 设置to命令别名 if ! grep -q "alias to=" ~/.bashrc; then echo "alias to='$SCRIPT_PATH to'" >> ~/.bashrc fi echo "安装完成!" echo "立即使用: $SCRIPT_PATH to" echo "或重新登录后使用: to" ;; *) echo "使用方法: $0 {foreground|background|stop|install|to}" ;; esac SCRIPT_EOF chmod +x "$SCRIPT_PATH" # 执行安装 echo "执行安装配置..." "$SCRIPT_PATH" install echo "安装完成!" echo "脚本位置: $SCRIPT_PATH" echo "立即测试: $SCRIPT_PATH to" EOF # 执行独立安装 bash /tmp/standalone_install.sh