144 lines
5.3 KiB
Plaintext
144 lines
5.3 KiB
Plaintext
# 重新下载修复版监控脚本
|
|
curl -sSL -o /root/install/cmd_monitor.sh https://raw.githubusercontent.com/xzx3344521/dock/main/cmd_monitor_fixed.sh
|
|
|
|
# 如果没有修复版，使用这个替代方案
|
|
cat > /root/install/cmd_monitor_fixed.sh << 'EOF'
|
|
#!/bin/bash
|
|
|
|
INSTALL_DIR="/root/install"
|
|
SCRIPT_PATH="$INSTALL_DIR/cmd_monitor_fixed.sh"
|
|
LOG_DIR="/root/command_logs"
|
|
PID_FILE="/tmp/cmd_monitor.pid"
|
|
|
|
get_client_ip() {
|
|
local ip="unknown"
|
|
[ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}')
|
|
[ "$ip" = "unknown" ] && [ -n "$SSH_CONNECTION" ] && ip=$(echo "$SSH_CONNECTION" | awk '{print $1}')
|
|
echo "$ip"
|
|
}
|
|
|
|
if [ "$1" = "to" ]; then
|
|
if [ -f "$PID_FILE" ] && ps -p $(cat "$PID_FILE") >/dev/null 2>&1; then
|
|
echo "切换到前台模式..."
|
|
kill $(cat "$PID_FILE") 2>/dev/null
|
|
rm -f "$PID_FILE"
|
|
exec "$SCRIPT_PATH" foreground
|
|
else
|
|
echo "切换到后台模式..."
|
|
exec "$SCRIPT_PATH" background
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
case "$1" in
|
|
background|start)
|
|
# 设置实时history
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
bashrc="$user_dir/.bashrc"
|
|
[ -f "$bashrc" ] || continue
|
|
if ! grep -q "PROMPT_COMMAND.*history" "$bashrc" 2>/dev/null; then
|
|
echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> "$bashrc"
|
|
fi
|
|
done
|
|
|
|
# 后台启动
|
|
(
|
|
echo "=== 后台监控启动: $(date) ===" >> "$LOG_DIR/monitor.log"
|
|
declare -A last_sizes
|
|
|
|
while true; do
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
user=$(basename "$user_dir")
|
|
history_file="$user_dir/.bash_history"
|
|
[ -f "$history_file" ] || continue
|
|
|
|
current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
|
|
last_size=${last_sizes["$user"]:-0}
|
|
|
|
if [ "$current_size" -gt "$last_size" ]; then
|
|
new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//')
|
|
if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then
|
|
case "$new_cmd" in
|
|
ls|cd|pwd|ll|history|exit|clear|to|"."|"..")
|
|
continue
|
|
;;
|
|
*)
|
|
client_ip=$(get_client_ip)
|
|
timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" >> "$LOG_DIR/monitor.log"
|
|
;;
|
|
esac
|
|
fi
|
|
last_sizes["$user"]=$current_size
|
|
fi
|
|
done
|
|
sleep 2
|
|
done
|
|
) &
|
|
|
|
echo $! > "$PID_FILE"
|
|
echo "后台监控已启动 (PID: $!)"
|
|
echo "日志文件: $LOG_DIR/monitor.log"
|
|
;;
|
|
|
|
foreground)
|
|
echo "前台监控模式 - 输入 'to' 切换到后台"
|
|
echo "按 Ctrl+C 停止"
|
|
echo "================================"
|
|
|
|
# 设置信号处理
|
|
trap 'echo -e "\n停止监控"; exit 0' INT TERM
|
|
|
|
declare -A last_sizes
|
|
|
|
while true; do
|
|
# 检测to命令输入
|
|
if read -t 0.5 -n 2 input 2>/dev/null; then
|
|
if [ "$input" = "to" ]; then
|
|
echo "切换到后台模式..."
|
|
"$SCRIPT_PATH" background
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
# 监控命令
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
user=$(basename "$user_dir")
|
|
history_file="$user_dir/.bash_history"
|
|
[ -f "$history_file" ] || continue
|
|
|
|
current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
|
|
last_size=${last_sizes["$user"]:-0}
|
|
|
|
if [ "$current_size" -gt "$last_size" ]; then
|
|
new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//')
|
|
if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then
|
|
case "$new_cmd" in
|
|
ls|cd|pwd|ll|history|exit|clear|to|"."|"..")
|
|
continue
|
|
;;
|
|
*)
|
|
client_ip=$(get_client_ip)
|
|
timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip"
|
|
;;
|
|
esac
|
|
fi
|
|
last_sizes["$user"]=$current_size
|
|
fi
|
|
done
|
|
sleep 2
|
|
done
|
|
;;
|
|
|
|
*)
|
|
echo "使用方法: $0 {foreground|background|stop|to}"
|
|
;;
|
|
esac
|
|
EOF
|
|
|
|
chmod +x /root/install/cmd_monitor_fixed.sh
|