dock/实时 history 监控

# 创建本地安装脚本
cat > /tmp/local_install.sh << 'EOF'
#!/bin/bash

INSTALL_DIR="/root/monitor"
SCRIPT_NAME="cmd_monitor.sh" 
SCRIPT_PATH="$INSTALL_DIR/$SCRIPT_NAME"
LOG_DIR="/root/command_logs"

# 创建目录
mkdir -p "$INSTALL_DIR"
mkdir -p "$LOG_DIR"

# 创建主监控脚本
cat > "$SCRIPT_PATH" << 'SCRIPT_EOF'
#!/bin/bash

INSTALL_DIR="/root/monitor"
SCRIPT_PATH="$INSTALL_DIR/cmd_monitor.sh"
LOG_DIR="/root/command_logs"
PID_FILE="/tmp/cmd_monitor.pid"

get_client_ip() {
    local ip="unknown"
    [ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}')
    [ "$ip" = "unknown" ] && [ -n "$SSH_CONNECTION" ] && ip=$(echo "$SSH_CONNECTION" | awk '{print $1}')
    echo "$ip"
}

if [ "$1" = "to" ]; then
    if [ -f "$PID_FILE" ] && ps -p $(cat "$PID_FILE") >/dev/null 2>&1; then
        echo "切换到前台模式..."
        kill $(cat "$PID_FILE") 2>/dev/null
        rm -f "$PID_FILE"
        exec "$SCRIPT_PATH" foreground
    else
        echo "切换到后台模式..."
        exec "$SCRIPT_PATH" background
    fi
    exit 0
fi

case "$1" in
    background|start)
        # 设置实时history
        for user_dir in /home/* /root; do
            [ -d "$user_dir" ] || continue
            bashrc="$user_dir/.bashrc"
            [ -f "$bashrc" ] || continue
            if ! grep -q "PROMPT_COMMAND.*history" "$bashrc" 2>/dev/null; then
                echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> "$bashrc"
            fi
        done
        
        # 后台启动
        (
            echo "=== 后台监控启动: $(date) ===" >> "$LOG_DIR/monitor.log"
            declare -A last_sizes
            
            while true; do
                for user_dir in /home/* /root; do
                    [ -d "$user_dir" ] || continue
                    user=$(basename "$user_dir")
                    history_file="$user_dir/.bash_history"
                    [ -f "$history_file" ] || continue
                    
                    current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
                    last_size=${last_sizes["$user"]:-0}
                    
                    if [ "$current_size" -gt "$last_size" ]; then
                        new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//')
                        if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then
                            case "$new_cmd" in
                                ls|cd|pwd|ll|history|exit|clear|to|"."|"..")
                                    continue
                                    ;;
                                *)
                                    client_ip=$(get_client_ip)
                                    timestamp=$(date '+%Y-%m-%d %H:%M:%S')
                                    echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip" >> "$LOG_DIR/monitor.log"
                                    ;;
                            esac
                        fi
                        last_sizes["$user"]=$current_size
                    fi
                done
                sleep 2
            done
        ) &
        
        echo $! > "$PID_FILE"
        echo "后台监控已启动 (PID: $!)"
        echo "日志文件: $LOG_DIR/monitor.log"
        ;;
        
    foreground)
        echo "前台监控模式 - 输入 'to' 切换到后台"
        echo "按 Ctrl+C 停止"
        echo "================================"
        
        declare -A last_sizes
        
        while true; do
            for user_dir in /home/* /root; do
                [ -d "$user_dir" ] || continue
                user=$(basename "$user_dir")
                history_file="$user_dir/.bash_history"
                [ -f "$history_file" ] || continue
                
                current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
                last_size=${last_sizes["$user"]:-0}
                
                if [ "$current_size" -gt "$last_size" ]; then
                    new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//')
                    if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then
                        case "$new_cmd" in
                            ls|cd|pwd|ll|history|exit|clear|to|"."|"..")
                                continue
                                ;;
                            *)
                                client_ip=$(get_client_ip)
                                timestamp=$(date '+%Y-%m-%d %H:%M:%S')
                                echo "[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip"
                                ;;
                        esac
                    fi
                    last_sizes["$user"]=$current_size
                fi
            done
            sleep 2
        done
        ;;
        
    stop)
        if [ -f "$PID_FILE" ]; then
            kill $(cat "$PID_FILE") 2>/dev/null
            rm -f "$PID_FILE"
            echo "监控已停止"
        else
            echo "监控未运行"
        fi
        ;;
        
    install)
        # 设置开机自启动
        (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "@reboot $SCRIPT_PATH background >/dev/null 2>&1") | crontab -
        
        # 设置to命令别名
        echo "alias to='$SCRIPT_PATH to'" >> ~/.bashrc
        echo "alias to" >> ~/.bashrc
        
        echo "安装完成!"
        echo "请运行: source ~/.bashrc"
        echo "然后使用: to 命令切换模式"
        ;;
        
    *)
        echo "使用方法: $0 {foreground|background|stop|install|to}"
        echo "安装后使用 'to' 命令切换模式"
        ;;
esac
SCRIPT_EOF

chmod +x "$SCRIPT_PATH"

# 执行安装
echo "开始安装..."
"$SCRIPT_PATH" install

echo ""
echo "=== 安装完成 ==="
echo "脚本位置: $SCRIPT_PATH"
echo "日志目录: $LOG_DIR"
echo "请运行: source ~/.bashrc"
echo "然后测试: to"
EOF

# 执行本地安装
chmod +x /tmp/local_install.sh
/tmp/local_install.sh