OS – Page 2 – 一江春水向东流

OS

聊一聊Linux下进程隐藏的常见手法及侦测手段

0x00.前言进程隐藏是恶意软件隐藏自身痕迹逃避系统管理人员发现的常用伎俩之一，当然，安全防护人员有时候也会使用到，比如隐藏蜜罐中的监控进程而不被入侵者觉察等。笔者也曾在多次安全应急响应经历中遇到过多各式各样的进程隐藏伎俩，了解进程隐藏的常见手法及发现手段是每一位安全运维工程师所应掌握的知识点。本文抛砖引玉，浅谈我所了解的Linux下进程隐藏手段及发现技巧，也希望读者能够积极分享自己相关经验与技巧。 0x01.我所了解的 Linux下进程隐藏手段及侦测方法 Linux 下进程隐藏手法大体上分为两种，一种是基于用户态隐藏；一种是直接操控内核进行隐藏。一、基于用户空间进程隐藏手法 1、偷梁换柱型 1）隐藏原理道理很简单，通过替换系统中常见的进程查看工具（比如ps、top、lsof）的二进制程序，导致原先查看进程相关信息的工具（ps、top、lsof等）都被调包了，当然看不到 2）防护手段 I、从干净的系统上拷贝这些工具的备份至当前系统，对比前后的输出是否一致，不一致，则说明被替换了 II、检测这些工具的hash值是否与系统初始化的时候值不一致，是，则说明被替换了 III、专业一点话，使用一些系统完整性检查工具，比如tripwrie、aide等 IV、部署主机入侵检查工具（比如ossec），监控系统文件是否被替换，如有替换，则会报警记录 2、HooK系统调用型 1）隐藏原理先说下ps、top等工具的工作原理以ps 工作原理为例说明这些进程信息查看工具的原理我们知道/proc是一个虚拟文件系统，是VFS的一个实现形式，/proc中包含了内核信息，硬件信息，进程信息等，ps等工具就是通过分析/proc文件系统中进程相关目录的信息获取进程信息汇总。HooK系统调用型的进程隐藏方式都是通过拦截或者迷惑ps等工具从/proc获取分析结果的过程，而不是针对/proc/文件系统生成本身。 ps 首先会调用openat 系统函数获取/proc目录的文件句柄，然后调用系统函数 getdents 递归获取/proc目录下所有文件信息（包括子目录），然后开始open函数打开/proc/进程pid/stat,/proc/进程pid/status, /proc/进程pid/cmdline 文件开始获取进程信息，然后打印给你看攻击者通过劫持getdents 等系统调用函数或libc中的readdir 函数，实现对特定进程名进程的隐藏，以达到进程隐藏目的劫持getdents 等系统调用函数或libc中的readdir 函数等系统调用函数一般来说有3个途径 I、修改内核调用，比如getdents 的源码 II、修改libc库中readdir 函数的源码 III、利用环境变量LD_PRELOAD 或者配置ld.so.preload文件以使的恶意的动态库先于系统标准库加载，以达到架空系统标准库中相关函数的目的，最终实现对特定进程的隐藏这3个原理类似，III相对于I、II比较简单，在此以III为例进行演示（劫持libc 中的readdir函数）演示（利用LD_PRELOAD这个环境变量进行进程信息隐藏），比如隐藏ping这个进程： Read more…

By sean, 5 years ago

OS

Linux登录提示信息动态显示

2023-10-10更新：用tput sgr0进行属性还原时，在web页面输出会显示出一个(B符号，如下：参考https://github.com/rburns/ansi-to-html/issues/25 解决方法是，增加一个变量：TERM=ansi 整体脚本如下：

#!/usr/bin/env bash

# author: sean
# date: 2023-10-10
# function: show dynamic information after login server

# Change TERM value that is 'xterm' because it leads to extra '(B' chars after sgr0
TERM=ansi
# ---- Set Colors
bold=$(tput bold) # 加粗字体
# half_bright=$(tput dim) # turn on half-bright mode
blink=$(tput blink)  # Set blink mode
# underline=$(tput smul) # Set underline mode
# exit_underline=$(tput rmul) # Exit underline mode
# reverse=$(tput rev) # Turn on reverse mode，突出模式，所有输出字符都突出显示。
# exit_reverse=$(tput rmso) # Exit standout mode，退出突出显示。
reset_attr=$(tput sgr0) # Turn off all attributes，取消所有属性。

# tput setab [0-7] – 设置背景色。
# tput setaf [0-7] – 设置前景色。
# black=$(tput setaf 0)
red=$(tput setaf 1)
green=$(tput setaf 2)
yellow=$(tput setaf 3)
blue=$(tput setaf 4)
magenta=$(tput setaf 5) #洋红
cyan=$(tput setaf 6) #青色
white=$(tput setaf 7)
reset_color=$(tput setaf 9) # Reset to default color = 9
# ---- get infos
OS=$(uname -o)
USER=`whoami`
FROM=`who am i | grep -Po "(?<=\().*(?=\))"`
HOSTNAME_FQDN=`hostname`
HOSTNAME=`hostname -s`
SELinux=$(/usr/sbin/sestatus 2>/dev/null | grep "SELinux status: " | awk '{print $3}')
LastReboot=$(who -b | awk '{print $3,$4}')
# IP=`ip addr | awk '/inet/ && ! /\/32/ {ip[$NF] = $2; sub(/\/.*$/,"",ip[$NF])} END {for(i in ip){if(i ~ "en|eth0") print ip[i]}}'`
IP=$(hostname -I|awk '{print $1}')

if [ -f /etc/redhat-release ]; then
    RELEASE=`cat /etc/redhat-release`
elif [ -f /etc/os-release ]; then
    RELEASE=$(cat /etc/os-release | sed -n 's/^NAME=\(.*\)/\1/p;s/^VERSION=\(.*\)/" "\1/p' | awk '{gsub(/"|,|^\s+|/, "");print}' | sed ":a;N;s/\n//g;ta")
fi

KERNEL_VERSION=`uname -r`
CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)
CPU_Arch=$(uname -m)

PSA=`ps -Afl | wc -l`
FORMATEDTIME=`date +"%Y-%m-%d %T"`
# Time of day
HOUR=$(date +"%H")
if [ $HOUR -lt 12  -a $HOUR -ge 0 ]; then
    TIME="上午好"
elif [ $HOUR -lt 17 -a $HOUR -ge 12 ]; then
    TIME="下午好"
else
    TIME="晚上好"
fi

#### System uptime ####
uptime=`cat /proc/uptime | cut -f1 -d.`
upDays=$((uptime/60/60/24))
upHours=$((uptime/60/60%24))
upMins=$((uptime/60%60))
upSecs=$((uptime%60))
SYS_UPTIME="$upDays days $upHours hours $upMins minutes $upSecs seconds $RESET_COLORS"
#### 网络检查 ####
DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' '|' | sed 's/|$//')

#### 进程检查 ####
# 僵尸进程
defunct=$(ps -A -o stat,ppid,pid,cmd | grep -e '^[Zz]' | wc -l)

########## 资源统计 ########
# 列表显示系统资源使用情况
#memory
MEMORY=`free -m|awk 'NR==2 {printf("内存 %.2f%% %sM %sM\n",100-($7*100/$2),$2,$3,$7)}'`

#disk
DISK_DATA=`df -Ph | egrep '/$|/data$' |awk '{printf "区[%s] %s %s %s\n", $6,$5,$3,$4}'`

#load负载情况
up_time=`uptime`
cpu_nums=`grep -c 'processor' /proc/cpuinfo`
load_1min=`echo $up_time | awk '{print $(NF-2)}'|sed 's/,//g'`
load_5min=`echo $up_time | awk '{print $(NF-1)}'|sed 's/,//g'`
load_15min=`echo $up_time | awk '{print $NF}'|sed 's/,//g'`
use_percent1=$(echo "$load_1min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent5=$(echo "$load_5min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent15=$(echo "$load_15min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent1=$([ `echo $use_percent1|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent1" || echo -n 100)
use_percent5=$([ `echo $use_percent5|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent5" || echo -n 100)
use_percent15=$([ `echo $use_percent15|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent15" || echo -n 100)
LOAD="负载1/5/15分钟 $use_percent1/$use_percent5/$use_percent15 - -"

disk_use_warning=`df -Ph | egrep -v '/$|/data$' | sed '1d;/ /!N;s/\n//;s/ \+/ /;' | awk 'sub (/%/, "", $5){if ($5*1 > 89) printf "区[%s] %s %s %s\n", substr($6,1,10),$5,$3,$4}'`
cpu_use_warning=$(top b -n1 |awk '/^ \s+PID/,/NF/'|head -n20 | awk 'NR>1{if ($9*1 > 30) printf "CPU高@'${cyan}'CPU:'${blink}${red}'%s'${reset_attr}${cyan}'% '${cyan}'MEM:'${green}'%s% '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $9,$10,$1,substr($NF,1,20)}')
mem_use_warning=$(ps aux | awk '{print $2, $3, $4, $6, $11}' | sort -k4rn | head -n 20| awk '{if ($3*1 > 20) printf "内存高@'${cyan}'CPU:'${green}'%s'${cyan}'% '${cyan}'MEM:'${blink}${red}'%s'${reset_attr}${cyan}'% '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $2,$3,$1,substr($5,1,20)}')
######## 汇总显示项 ########
#system base info
SYS_INFO="主机名@${HOSTNAME_FQDN}\nIP地址@${IP}\n系统@${OS}\n发行版本@${RELEASE}\n内核@${KERNEL_VERSION}\n核心@${cpu_nums}\nCPU型号@${CPU_Type}\nCPU架构@${CPU_Arch}\n当前时间@${FORMATEDTIME}\n最后启动@${LastReboot}\n运行时间@${SYS_UPTIME}\nDNS@${DNS}\n进程数@${PSA}"
## extra system base info
if [ "$SELinux" != "" -a "$SELinux" != "disabled" ]; then
    SYS_INFO="${SYS_INFO}\nSELinux@${SELinux}"
fi
if [ $defunct -gt 0 ]; then
    SYS_INFO="${SYS_INFO}\n僵尸进程@${defunct}"
fi
if [ "X$cpu_use_warning" != "X" ]; then
    SYS_INFO="${SYS_INFO}\n${cpu_use_warning}"
fi
if [ "X$mem_use_warning" != "X" ]; then
    SYS_INFO="${SYS_INFO}\n${mem_use_warning}"
fi
#usage info
USAGE_INFO="${LOAD}\n${MEMORY}\n${DISK_DATA}"
## extra usage info
if [ "X$disk_use_warning" != "X" ]; then
    USAGE_INFO="${USAGE_INFO}\n${disk_use_warning}"
fi

#################### 显示 ########################
printf "${bold}${cyan}*************************************************\n"
printf "${bold}${cyan}*  $TIME ${yellow}$USER${cyan}!${blink}${red} ❤ ${reset_attr}[ ${blue}${bold}技 术 中 台 诊 断 信 息 ${white} ]${bold}${cyan}  *\n"
printf "${bold}${cyan}*************************************************\n"

# 显示hostname
WIDTH=$(tput cols)
printf "${bold}${magenta}"
if hash figlet 2>/dev/null; then
    if [ ! -z "$WIDTH" ];then
        figlet $HOSTNAME -k -w $WIDTH 2>/dev/null
    else
        figlet $HOSTNAME 2>/dev/null
    fi
fi
printf "${reset_attr}"

#----------显示监控信息------------------
echo -e "$SYS_INFO" | awk -F'@' -f /usr/local/bin/color.awk -e '
BEGIN{
    title = BG_CYAN("项目            系统信息                                         ");
    print title;
}
{
    if($1=="主机名"){
        $2 = BRIGHT_MAGENTA($2)
    } else if($1=="IP地址"){
        $2 = BRIGHT_YELLOW($2)
    } else if($1=="僵尸进程" || $1=="SELinux"){
        $2 = BRIGHT_YELLOW($2)
    } else{
        $2 = GREEN($2);
    }
    $1 = BRIGHT_CYAN($1);
    printf "%-20s\t%-40s\t\n", $1,$2;
}'


echo -e "$USAGE_INFO" | awk -f /usr/local/bin/color.awk -e '
BEGIN{
    line = CYAN("-----------------------------------------------------------------");
    title = BG_CYAN("项目            使用率          已用    空闲          图示       ");
    print;
    print title;
    print line;
}
{
    sub (/%/, "", $2);
    $5 = percent_bar($2)
    if($2*1 > 80 && $2*1 <= 89){     
        $1 = BRIGHT_YELLOW($1)
        $2 = BL_BRIGHT_YELLOW($2)BRIGHT_CYAN("%")
        $3 = BRIGHT_YELLOW($3);
        $4 = BRIGHT_YELLOW($4);
    } else if($2*1 > 89){
        $1 = BRIGHT_RED($1)
        $2 = BL_BRIGHT_RED($2)BRIGHT_CYAN("%")
        $3 = BRIGHT_RED($3);
        $4 = BRIGHT_RED($4);
    } else{
        $1 = BRIGHT_CYAN($1)
        $2 = BRIGHT_GREEN($2)BRIGHT_CYAN("%")
        $3 = BRIGHT_CYAN($3);
        $4 = GREEN($4);
    }
    printf "%-20s\t%-30s\t%-5s\t%-5s\t%-17s\t\n", $1,$2,$3,$4,$5;
    print line
}'

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

#!/usr/bin/env bash

# author: sean

# date: 2023-10-10

# function: show dynamic information after login server

# Change TERM value that is 'xterm' because it leads to extra '(B' chars after sgr0

TERM=ansi

# ---- Set Colors

bold=$(tput bold) # 加粗字体

# half_bright=$(tput dim) # turn on half-bright mode

blink=$(tput blink) # Set blink mode

# underline=$(tput smul) # Set underline mode

# exit_underline=$(tput rmul) # Exit underline mode

# reverse=$(tput rev) # Turn on reverse mode，突出模式，所有输出字符都突出显示。

# exit_reverse=$(tput rmso) # Exit standout mode，退出突出显示。

reset_attr=$(tput sgr0) # Turn off all attributes，取消所有属性。

# tput setab [0-7] – 设置背景色。

# tput setaf [0-7] – 设置前景色。

# black=$(tput setaf 0)

red=$(tput setaf 1)

green=$(tput setaf 2)

yellow=$(tput setaf 3)

blue=$(tput setaf 4)

magenta=$(tput setaf 5) #洋红

cyan=$(tput setaf 6) #青色

white=$(tput setaf 7)

reset_color=$(tput setaf 9) # Reset to default color = 9

# ---- get infos

OS=$(uname -o)

USER=`whoami`

FROM=`who am i | grep -Po "(?<=$).*(?=$)"`

HOSTNAME_FQDN=`hostname`

HOSTNAME=`hostname -s`

SELinux=$(/usr/sbin/sestatus 2>/dev/null | grep "SELinux status: " | awk '{print $3}')

LastReboot=$(who -b | awk '{print $3,$4}')

# IP=`ip addr | awk '/inet/ && ! /\/32/ {ip[$NF] = $2; sub(/\/.*$/,"",ip[$NF])} END {for(i in ip){if(i ~ "en|eth0") print ip[i]}}'`

IP=$(hostname -I|awk '{print $1}')

if [ -f /etc/redhat-release ]; then

RELEASE=`cat /etc/redhat-release`

elif [ -f /etc/os-release ]; then

RELEASE=$(cat /etc/os-release | sed -n 's/^NAME=$.*$/\1/p;s/^VERSION=$.*$/" "\1/p' | awk '{gsub(/"|,|^\s+|/, "");print}' | sed ":a;N;s/\n//g;ta")

KERNEL_VERSION=`uname -r`

CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)

CPU_Arch=$(uname -m)

PSA=`ps -Afl | wc -l`

FORMATEDTIME=`date +"%Y-%m-%d %T"`

# Time of day

HOUR=$(date +"%H")

if [ $HOUR -lt 12 -a $HOUR -ge 0 ]; then

TIME="上午好"

elif [ $HOUR -lt 17 -a $HOUR -ge 12 ]; then

TIME="下午好"

else

TIME="晚上好"

#### System uptime ####

uptime=`cat /proc/uptime | cut -f1 -d.`

upDays=$((uptime/60/60/24))

upHours=$((uptime/60/60%24))

upMins=$((uptime/60%60))

upSecs=$((uptime%60))

SYS_UPTIME="$upDays days $upHours hours $upMins minutes $upSecs seconds $RESET_COLORS"

#### 网络检查 ####

DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' '|' | sed 's/|$//')

#### 进程检查 ####

# 僵尸进程

defunct=$(ps -A -o stat,ppid,pid,cmd | grep -e '^[Zz]' | wc -l)

########## 资源统计 ########

# 列表显示系统资源使用情况

#memory

MEMORY=`free -m|awk 'NR==2 {printf("内存 %.2f%% %sM %sM\n",100-($7*100/$2),$2,$3,$7)}'`

#disk

DISK_DATA=`df -Ph | egrep '/$|/data$' |awk '{printf "区[%s] %s %s %s\n", $6,$5,$3,$4}'`

#load负载情况

up_time=`uptime`

cpu_nums=`grep -c 'processor' /proc/cpuinfo`

load_1min=`echo $up_time | awk '{print $(NF-2)}'|sed 's/,//g'`

load_5min=`echo $up_time | awk '{print $(NF-1)}'|sed 's/,//g'`

load_15min=`echo $up_time | awk '{print $NF}'|sed 's/,//g'`

use_percent1=$(echo "$load_1min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')

use_percent5=$(echo "$load_5min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')

use_percent15=$(echo "$load_15min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')

use_percent1=$([ `echo $use_percent1|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent1" || echo -n 100)

use_percent5=$([ `echo $use_percent5|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent5" || echo -n 100)

use_percent15=$([ `echo $use_percent15|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent15" || echo -n 100)

LOAD="负载1/5/15分钟 $use_percent1/$use_percent5/$use_percent15 - -"

disk_use_warning=`df -Ph | egrep -v '/$|/data$' | sed '1d;/ /!N;s/\n//;s/ \+/ /;' | awk 'sub (/%/, "", $5){if ($5*1 > 89) printf "区[%s] %s %s %s\n", substr($6,1,10),$5,$3,$4}'`

cpu_use_warning=$(top b -n1 |awk '/^ \s+PID/,/NF/'|head -n20 | awk 'NR>1{if ($9*1 > 30) printf "CPU高@'${cyan}'CPU:'${blink}${red}'%s'${reset_attr}${cyan}'% '${cyan}'MEM:'${green}'%s% '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $9,$10,$1,substr($NF,1,20)}')

mem_use_warning=$(ps aux | awk '{print $2, $3, $4, $6, $11}' | sort -k4rn | head -n 20| awk '{if ($3*1 > 20) printf "内存高@'${cyan}'CPU:'${green}'%s'${cyan}'% '${cyan}'MEM:'${blink}${red}'%s'${reset_attr}${cyan}'% '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $2,$3,$1,substr($5,1,20)}')

######## 汇总显示项 ########

#system base info

SYS_INFO="主机名@${HOSTNAME_FQDN}\nIP地址@${IP}\n系统@${OS}\n发行版本@${RELEASE}\n内核@${KERNEL_VERSION}\n核心@${cpu_nums}\nCPU型号@${CPU_Type}\nCPU架构@${CPU_Arch}\n当前时间@${FORMATEDTIME}\n最后启动@${LastReboot}\n运行时间@${SYS_UPTIME}\nDNS@${DNS}\n进程数@${PSA}"

## extra system base info

if [ "$SELinux" != "" -a "$SELinux" != "disabled" ]; then

SYS_INFO="${SYS_INFO}\nSELinux@${SELinux}"

if [ $defunct -gt 0 ]; then

SYS_INFO="${SYS_INFO}\n僵尸进程@${defunct}"

if [ "X$cpu_use_warning" != "X" ]; then

SYS_INFO="${SYS_INFO}\n${cpu_use_warning}"

if [ "X$mem_use_warning" != "X" ]; then

SYS_INFO="${SYS_INFO}\n${mem_use_warning}"

#usage info

USAGE_INFO="${LOAD}\n${MEMORY}\n${DISK_DATA}"

## extra usage info

if [ "X$disk_use_warning" != "X" ]; then

USAGE_INFO="${USAGE_INFO}\n${disk_use_warning}"

#################### 显示 ########################

printf "${bold}${cyan}*************************************************\n"

printf "${bold}${cyan}* $TIME ${yellow}$USER${cyan}!${blink}${red} ❤ ${reset_attr}[ ${blue}${bold}技术中台诊断信息 ${white} ]${bold}${cyan} *\n"

printf "${bold}${cyan}*************************************************\n"

# 显示hostname

WIDTH=$(tput cols)

printf "${bold}${magenta}"

if hash figlet 2>/dev/null; then

if [ ! -z "$WIDTH" ];then

figlet $HOSTNAME -k -w $WIDTH 2>/dev/null

else

figlet $HOSTNAME 2>/dev/null

printf "${reset_attr}"

#----------显示监控信息------------------

echo -e "$SYS_INFO" | awk -F'@' -f /usr/local/bin/color.awk -e '

BEGIN{

title = BG_CYAN("项目系统信息 ");

print title;

}

{

if($1=="主机名"){

$2 = BRIGHT_MAGENTA($2)

} else if($1=="IP地址"){

$2 = BRIGHT_YELLOW($2)

} else if($1=="僵尸进程" || $1=="SELinux"){

$2 = BRIGHT_YELLOW($2)

} else{

$2 = GREEN($2);

}

$1 = BRIGHT_CYAN($1);

printf "%-20s\t%-40s\t\n", $1,$2;

echo -e "$USAGE_INFO" | awk -f /usr/local/bin/color.awk -e '

BEGIN{

line = CYAN("-----------------------------------------------------------------");

title = BG_CYAN("项目使用率已用空闲图示 ");

print;

print title;

print line;

}

{

sub (/%/, "", $2);

$5 = percent_bar($2)

if($2*1 > 80 && $2*1 <= 89){

$1 = BRIGHT_YELLOW($1)

$2 = BL_BRIGHT_YELLOW($2)BRIGHT_CYAN("%")

$3 = BRIGHT_YELLOW($3);

$4 = BRIGHT_YELLOW($4);

} else if($2*1 > 89){

$1 = BRIGHT_RED($1)

$2 = BL_BRIGHT_RED($2)BRIGHT_CYAN("%")

$3 = BRIGHT_RED($3);

$4 = BRIGHT_RED($4);

} else{

$1 = BRIGHT_CYAN($1)

$2 = BRIGHT_GREEN($2)BRIGHT_CYAN("%")

$3 = BRIGHT_CYAN($3);

$4 = GREEN($4);

}

printf "%-20s\t%-30s\t%-5s\t%-5s\t%-17s\t\n", $1,$2,$3,$4,$5;

print line

2023-8-1更新： dymotd:

#!/usr/bin/env bash

# author: sean
# date: 2023-08-01
# function: show dynamic information after login server

# ---- Set Colors
bold=$(tput bold) # 加粗字体
# half_bright=$(tput dim) # turn on half-bright mode
blink=$(tput blink)  # Set blink mode
# underline=$(tput smul) # Set underline mode
# exit_underline=$(tput rmul) # Exit underline mode
# reverse=$(tput rev) # Turn on reverse mode，突出模式，所有输出字符都突出显示。
# exit_reverse=$(tput rmso) # Exit standout mode，退出突出显示。
reset_attr=$(tput sgr0) # Turn off all attributes，取消所有属性。

# tput setab [0-7] – 设置背景色。
# tput setaf [0-7] – 设置前景色。
# black=$(tput setaf 0)
red=$(tput setaf 1)
green=$(tput setaf 2)
yellow=$(tput setaf 3)
blue=$(tput setaf 4)
magenta=$(tput setaf 5) #洋红
cyan=$(tput setaf 6) #青色
white=$(tput setaf 7)
reset_color=$(tput setaf 9) # Reset to default color = 9
# ---- get infos
OS=$(uname -o)
USER=`whoami`
FROM=`who am i | grep -Po "(?<=\().*(?=\))"`
HOSTNAME_FQDN=`hostname`
HOSTNAME=`hostname -s`
SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}')
LastReboot=$(who -b | awk '{print $3,$4}')
IP=`ip addr | awk '/inet/ && ! /\/32/ {ip[$NF] = $2; sub(/\/.*$/,"",ip[$NF])} END {for(i in ip){if(i ~ "en|eth0") print ip[i]}}'`
if [ -f /etc/redhat-release ]; then
    RELEASE=`cat /etc/redhat-release`
elif [ -f /etc/os-release ]; then
    RELEASE=$(cat /etc/os-release | sed -n 's/^NAME=\(.*\)/\1/p;s/^VERSION=\(.*\)/" "\1/p' | awk '{gsub(/"|,|^\s+|/, "");print}' | sed ":a;N;s/\n//g;ta")
fi

KERNEL_VERSION=`uname -r`
CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)
CPU_Arch=$(uname -m)

PSA=`ps -Afl | wc -l`
FORMATEDTIME=`date +"%Y-%m-%d %T"`
# Time of day
HOUR=$(date +"%H")
if [ $HOUR -lt 12  -a $HOUR -ge 0 ]; then
    TIME="上午好"
elif [ $HOUR -lt 17 -a $HOUR -ge 12 ]; then
    TIME="下午好"
else
    TIME="晚上好"
fi

#### System uptime ####
uptime=`cat /proc/uptime | cut -f1 -d.`
upDays=$((uptime/60/60/24))
upHours=$((uptime/60/60%24))
upMins=$((uptime/60%60))
upSecs=$((uptime%60))
SYS_UPTIME="$upDays days $upHours hours $upMins minutes $upSecs seconds $RESET_COLORS"
#### 网络检查 ####
DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' '|' | sed 's/|$//')

#### 进程检查 ####
# 僵尸进程
defunct=$(ps -ef | grep defunct | grep -v grep | wc -l)

########## 资源统计 ########
# 列表显示系统资源使用情况
#memory
MEMORY=`free -m|awk 'NR==2 {printf("内存 %.2f%% %sM %sM\n",100-($7*100/$2),$2,$3,$7)}'`

#disk
DISK_DATA=`df -Ph | egrep '/$|/data$' |awk '{printf "区[%s] %s %s %s\n", $6,$5,$3,$4}'`

#load负载情况
up_time=`uptime`
cpu_nums=`grep -c 'processor' /proc/cpuinfo`
load_1min=`echo $up_time | awk '{print $(NF-2)}'|sed 's/,//g'`
load_5min=`echo $up_time | awk '{print $(NF-1)}'|sed 's/,//g'`
load_15min=`echo $up_time | awk '{print $NF}'|sed 's/,//g'`
use_percent1=$(echo "$load_1min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent5=$(echo "$load_5min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent15=$(echo "$load_15min $cpu_nums" | awk '{printf ("%.1f\n",$1*100/$2)}')
use_percent1=$([ `echo $use_percent1|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent1" || echo -n 100)
use_percent5=$([ `echo $use_percent5|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent5" || echo -n 100)
use_percent15=$([ `echo $use_percent15|awk '{print int($0)}'` -lt 100 ] && echo -n "$use_percent15" || echo -n 100)
LOAD="负载1/5/15分钟 $use_percent1/$use_percent5/$use_percent15 - -"

disk_use_warning=`df -Ph | egrep -v '/$|/data$' | sed '1d;/ /!N;s/\n//;s/ \+/ /;' | awk 'sub (/%/, "", $5){if ($5*1 > 89) printf "区[%s] %s %s %s\n", substr($6,1,10),$5,$3,$4}'`
cpu_use_warning=$(top b -n1 |awk '/^ \s+PID/,/NF/'|head -n20 | awk 'NR>2{if ($9*1 > 30) printf "CPU占用@'${cyan}'CPU:'${blink}${red}'%s'${reset_attr}'% '${cyan}'MEM:'${green}'%s% '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $9,$10,$1,substr($NF,1,20)}')
mem_use_warning=$(ps aux | awk '{print $2, $3, $4, $6, $11}' | sort -k4rn | head -n 20| awk 'NR>2{if ($3*1 > 30) printf "内存占用@'${cyan}'CPU:'${green}'%s% '${cyan}'MEM:'${blink}${red}'%s'${reset_attr}'% '${cyan}'RSS:'${green}'%s '${cyan}'PID:'${green}'%s '${cyan}'命令:'${green}'%s\n", $2,$3,$4,$1,substr($5,1,20)}')
######## 汇总显示项 ########
#system base info
SYS_INFO="主机名@${HOSTNAME_FQDN}\nIP地址@${IP}\n系统@${OS}\n发行版本@${RELEASE}\n内核@${KERNEL_VERSION}\n核心@${cpu_nums}\nCPU型号@${CPU_Type}\nCPU架构@${CPU_Arch}\n当前时间@${FORMATEDTIME}\n最后启动@${LastReboot}\n运行时间@${SYS_UPTIME}\nDNS@${DNS}\n进程数@${PSA}"
## extra system base info
if [ "$SELinux" != "disabled" ]; then
    SYS_INFO="${SYS_INFO}\nSELinux@${SELinux}"
fi
if [ $defunct -gt 0 ]; then
    SYS_INFO="${SYS_INFO}\n僵尸进程@${defunct}"
fi
if [ "X$cpu_use_warning" != "X" ]; then
    SYS_INFO="${SYS_INFO}\n${cpu_use_warning}"
fi
if [ "X$mem_use_warning" != "X" ]; then
    SYS_INFO="${SYS_INFO}\n${mem_use_warning}"
fi
#usage info
USAGE_INFO="${LOAD}\n${MEMORY}\n${DISK_DATA}"
## extra usage info
if [ "X$disk_use_warning" != "X" ]; then
    USAGE_INFO="${USAGE_INFO}\n${disk_use_warning}"
fi

#################### 显示 ########################
# 显示hostname
WIDTH=$(tput cols)
printf "${bold}${magenta}"
if hash figlet 2>/dev/null; then
    if [ ! -z "$WIDTH" ];then
        figlet $HOSTNAME -k -w $WIDTH 2>/dev/null
    else 
        figlet $HOSTNAME 2>/dev/null
    fi
fi
printf "${bold}${cyan}$TIME ${yellow}$USER${cyan}!  ${white}【 ${blue}${bold}技 术 中 台 诊 断 信 息 ${white}】\n"

#----------显示监控信息------------------
echo -e "$SYS_INFO" | awk -F'@' -f /usr/local/bin/color.awk -e '
BEGIN{
    separater = BRIGHT_CYAN("~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~");
    line = CYAN("-----------------------------------------------------------------");
    title = BG_CYAN("项目            系统信息                                         ");
    print separater;
    print title;
    print line;
}
{
    if($1=="主机名"){
        $2 = BRIGHT_MAGENTA($2)
    } else if($1=="IP地址"){
        $2 = BRIGHT_YELLOW($2)
    } else if($1=="僵尸进程" || $1=="SELinux"){
        $2 = BL_BRIGHT_YELLOW($2)
    } else{
        $2 = GREEN($2);
    }
    $1 = BRIGHT_CYAN($1);
    printf "%-20s\t%-40s\t\n", $1,$2;
}'


echo -e "$USAGE_INFO" | awk -f /usr/local/bin/color.awk -e '
BEGIN{
    separater = BRIGHT_CYAN("~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~");
    line = CYAN("-----------------------------------------------------------------");
    title = BG_CYAN("项目            使用率          已用    空闲          图示       ");
    print separater;
    print title;
    print line;
}
{
    sub (/%/, "", $2);
    $5 = percent_bar($2)
    if($2*1 > 80 && $2*1 <= 89){     
        $1 = BRIGHT_YELLOW($1)
        $2 = BL_BRIGHT_YELLOW($2)"%"
        $3 = BRIGHT_YELLOW($3);
        $4 = BRIGHT_YELLOW($4);
    } else if($2*1 > 89){
        $1 = BRIGHT_RED($1)
        $2 = BL_BRIGHT_RED($2)"%"
        $3 = BRIGHT_RED($3);
        $4 = BRIGHT_RED($4);
    } else{
        $1 = BRIGHT_CYAN($1)
        $2 = BRIGHT_WHITE($2)"%"
        $3 = BRIGHT_CYAN($3);
        $4 = GREEN($4);
    }
    printf "%-20s\t%-20s\t%-5s\t%-5s\t%-17s\t\n", $1,$2,$3,$4,$5;
    print line
}'

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

#!/usr/bin/env bash

# author: sean

# date: 2023-08-01

# function: show dynamic information after login server

# ---- Set Colors

bold=$(tput bold) # 加粗字体

# half_bright=$(tput dim) # turn on half-bright mode

blink=$(tput blink) # Set blink mode

# underline=$(tput smul) # Set underline mode

# exit_underline=$(tput rmul) # Exit underline mode

# reverse=$(tput rev) # Turn on reverse mode，突出模式，所有输出字符都突出显示。

# exit_reverse=$(tput rmso) # Exit standout mode，退出突出显示。

reset_attr=$(tput sgr0) # Turn off all attributes，取消所有属性。

# tput setab [0-7] – 设置背景色。

# tput setaf [0-7] – 设置前景色。

# black=$(tput setaf 0)

red=$(tput setaf 1)

green=$(tput setaf 2)

yellow=$(tput setaf 3)

blue=$(tput setaf 4)

magenta=$(tput setaf 5) #洋红

cyan=$(tput setaf 6) #青色

white=$(tput setaf 7)

reset_color=$(tput setaf 9) # Reset to default color = 9

# ---- get infos

OS=$(uname -o)

USER=`whoami`

FROM=`who am i | grep -Po "(?<=$).*(?=$)"`

HOSTNAME_FQDN=`hostname`

HOSTNAME=`hostname -s`

SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}')

LastReboot=$(who -b | awk '{print $3,$4}')

IP=`ip addr | awk '/inet/ && ! /\/32/ {ip[$NF] = $2; sub(/\/.*$/,"",ip[$NF])} END {for(i in ip){if(i ~ "en|eth0") print ip[i]}}'`

if [ -f /etc/redhat-release ]; then

RELEASE=`cat /etc/redhat-release`

elif [ -f /etc/os-release ]; then

RELEASE=$(cat /etc/os-release | sed -n 's/^NAME=$.*$/\1/p;s/^VERSION=$.*$/" "\1/p' | awk '{gsub(/"|,|^\s+|/, "");print}' | sed ":a;N;s/\n//g;ta")

KERNEL_VERSION=`uname -r`

CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)

CPU_Arch=$(uname -m)

PSA=`ps -Afl | wc -l`

FORMATEDTIME=`date +"%Y-%m-%d %T"`

# Time of day

HOUR=$(date +"%H")

if [ $HOUR -lt 12 -a $HOUR -ge 0 ]; then

TIME="上午好"

elif [ $HOUR -lt 17 -a $HOUR -ge 12 ]; then

TIME="下午好"

else

TIME="晚上好"

#### System uptime ####

uptime=`cat /proc/uptime | cut -f1 -d.`

upDays=$((uptime/60/60/24))

upHours=$((uptime/60/60%24))

upMins=$((uptime/60%60))

upSecs=$((uptime%60))

SYS_UPTIME="$upDays days $upHours hours $upMins minutes $upSecs seconds $RESET_COLORS"

#### 网络检查 ####

DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' '|' | sed 's/|$//')

#### 进程检查 ####

# 僵尸进程

defunct=$(ps -ef | grep defunct | grep -v grep | wc -l)