e9ceedb3bf
- 创建 /api/enhance 路由，实现图片变清晰API集成 - 在图片标注组件中添加变清晰按钮（Sparkles图标） - 在相册页面添加变清晰按钮 - 系统设置：将抠图设置改名为本地AI设置，添加变清晰API配置 - 支持同步和异步两种模式 - 自动上传到S3存储桶并保存到数据库 - 在相册和出图记录中显示处理后的图片
209 lines
7.4 KiB
Bash
Executable File
209 lines
7.4 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# SSH配置保护脚本
|
||
# 用于防止恶意程序修改或阻止SSH连接
|
||
|
||
set -e
|
||
|
||
echo "=================================================================================="
|
||
echo "🛡️ SSH配置保护脚本"
|
||
echo "=================================================================================="
|
||
|
||
# 1. 设置SSH配置文件为不可变（immutable）
|
||
echo ""
|
||
echo "1. 设置SSH配置文件为不可变..."
|
||
if command -v chattr >/dev/null 2>&1; then
|
||
# 移除现有的不可变标志（如果存在）
|
||
chattr -i /etc/ssh/sshd_config 2>/dev/null || true
|
||
|
||
# 设置不可变标志
|
||
chattr +i /etc/ssh/sshd_config
|
||
echo " ✅ SSH配置文件已设置为不可变（immutable）"
|
||
|
||
# 验证设置
|
||
if lsattr /etc/ssh/sshd_config | grep -q 'i'; then
|
||
echo " ✅ 验证成功：文件已设置为不可变"
|
||
else
|
||
echo " ⚠️ 警告：无法验证不可变标志"
|
||
fi
|
||
else
|
||
echo " ⚠️ chattr命令不可用，跳过不可变标志设置"
|
||
fi
|
||
|
||
# 2. 设置SSH目录权限
|
||
echo ""
|
||
echo "2. 设置SSH目录权限..."
|
||
chmod 755 /etc/ssh
|
||
chmod 600 /etc/ssh/sshd_config
|
||
chown root:root /etc/ssh/sshd_config
|
||
echo " ✅ SSH目录和文件权限已设置"
|
||
|
||
# 3. 创建SSH配置备份
|
||
echo ""
|
||
echo "3. 创建SSH配置备份..."
|
||
BACKUP_DIR="/root/ssh_backups"
|
||
mkdir -p "$BACKUP_DIR"
|
||
cp /etc/ssh/sshd_config "$BACKUP_DIR/sshd_config.$(date +%Y%m%d_%H%M%S)"
|
||
# 只保留最近10个备份
|
||
ls -t "$BACKUP_DIR"/sshd_config.* 2>/dev/null | tail -n +11 | xargs rm -f 2>/dev/null || true
|
||
echo " ✅ SSH配置已备份到 $BACKUP_DIR"
|
||
|
||
# 4. 创建SSH配置监控脚本
|
||
echo ""
|
||
echo "4. 创建SSH配置监控脚本..."
|
||
cat > /usr/local/bin/monitor-ssh-config.sh << 'MONITOREOF'
|
||
#!/bin/bash
|
||
# SSH配置监控脚本
|
||
# 检测SSH配置文件是否被修改
|
||
|
||
SSH_CONFIG="/etc/ssh/sshd_config"
|
||
BACKUP_DIR="/root/ssh_backups"
|
||
LOG_FILE="/var/log/ssh-config-monitor.log"
|
||
|
||
# 创建日志文件（如果不存在）
|
||
touch "$LOG_FILE"
|
||
|
||
# 获取当前配置文件的MD5值
|
||
CURRENT_MD5=$(md5sum "$SSH_CONFIG" 2>/dev/null | awk '{print $1}')
|
||
|
||
# 获取最新备份的MD5值
|
||
LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/sshd_config.* 2>/dev/null | head -1)
|
||
if [ -n "$LATEST_BACKUP" ]; then
|
||
BACKUP_MD5=$(md5sum "$LATEST_BACKUP" | awk '{print $1}')
|
||
|
||
# 如果MD5不匹配，说明文件被修改
|
||
if [ "$CURRENT_MD5" != "$BACKUP_MD5" ]; then
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ⚠️ 警告：SSH配置文件被修改！" >> "$LOG_FILE"
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] 当前MD5: $CURRENT_MD5" >> "$LOG_FILE"
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] 备份MD5: $BACKUP_MD5" >> "$LOG_FILE"
|
||
|
||
# 尝试恢复配置文件
|
||
if [ -f "$LATEST_BACKUP" ]; then
|
||
# 临时移除不可变标志
|
||
chattr -i "$SSH_CONFIG" 2>/dev/null || true
|
||
cp "$LATEST_BACKUP" "$SSH_CONFIG"
|
||
chmod 600 "$SSH_CONFIG"
|
||
chown root:root "$SSH_CONFIG"
|
||
chattr +i "$SSH_CONFIG" 2>/dev/null || true
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✅ 已恢复SSH配置文件" >> "$LOG_FILE"
|
||
|
||
# 重启SSH服务
|
||
systemctl restart sshd 2>/dev/null || service sshd restart 2>/dev/null || true
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
# 检查SSH服务是否运行
|
||
if ! systemctl is-active --quiet sshd && ! service sshd status >/dev/null 2>&1; then
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ⚠️ 警告：SSH服务未运行！" >> "$LOG_FILE"
|
||
# 尝试启动SSH服务
|
||
systemctl start sshd 2>/dev/null || service sshd start 2>/dev/null || true
|
||
fi
|
||
MONITOREOF
|
||
|
||
chmod +x /usr/local/bin/monitor-ssh-config.sh
|
||
echo " ✅ SSH配置监控脚本已创建"
|
||
|
||
# 5. 设置定时监控任务
|
||
echo ""
|
||
echo "5. 设置定时监控任务..."
|
||
# 移除现有的监控任务（如果存在）
|
||
crontab -l 2>/dev/null | grep -v "monitor-ssh-config" | crontab - 2>/dev/null || true
|
||
|
||
# 添加新的监控任务（每5分钟检查一次）
|
||
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/local/bin/monitor-ssh-config.sh") | crontab -
|
||
echo " ✅ 定时监控任务已设置（每5分钟检查一次）"
|
||
|
||
# 6. 创建SSH服务保护脚本
|
||
echo ""
|
||
echo "6. 创建SSH服务保护脚本..."
|
||
cat > /usr/local/bin/protect-ssh-service.sh << 'PROTECTEOF'
|
||
#!/bin/bash
|
||
# SSH服务保护脚本
|
||
# 确保SSH服务始终运行
|
||
|
||
SSH_SERVICE="sshd"
|
||
|
||
# 检查SSH服务状态
|
||
if ! systemctl is-active --quiet "$SSH_SERVICE" && ! service "$SSH_SERVICE" status >/dev/null 2>&1; then
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ⚠️ 警告：SSH服务未运行，正在启动..." | tee -a /var/log/ssh-service-protect.log
|
||
|
||
# 尝试启动SSH服务
|
||
systemctl start "$SSH_SERVICE" 2>/dev/null || service "$SSH_SERVICE" start 2>/dev/null || true
|
||
|
||
# 等待服务启动
|
||
sleep 2
|
||
|
||
# 再次检查
|
||
if systemctl is-active --quiet "$SSH_SERVICE" || service "$SSH_SERVICE" status >/dev/null 2>&1; then
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✅ SSH服务已启动" | tee -a /var/log/ssh-service-protect.log
|
||
else
|
||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ❌ SSH服务启动失败！" | tee -a /var/log/ssh-service-protect.log
|
||
fi
|
||
fi
|
||
PROTECTEOF
|
||
|
||
chmod +x /usr/local/bin/protect-ssh-service.sh
|
||
echo " ✅ SSH服务保护脚本已创建"
|
||
|
||
# 7. 设置SSH服务保护定时任务
|
||
echo ""
|
||
echo "7. 设置SSH服务保护定时任务..."
|
||
# 移除现有的保护任务（如果存在）
|
||
crontab -l 2>/dev/null | grep -v "protect-ssh-service" | crontab - 2>/dev/null || true
|
||
|
||
# 添加新的保护任务（每2分钟检查一次）
|
||
(crontab -l 2>/dev/null; echo "*/2 * * * * /usr/local/bin/protect-ssh-service.sh") | crontab -
|
||
echo " ✅ SSH服务保护定时任务已设置（每2分钟检查一次）"
|
||
|
||
# 8. 配置SSH服务自动启动
|
||
echo ""
|
||
echo "8. 配置SSH服务自动启动..."
|
||
systemctl enable sshd 2>/dev/null || chkconfig sshd on 2>/dev/null || true
|
||
echo " ✅ SSH服务已设置为开机自启"
|
||
|
||
# 9. 验证SSH配置
|
||
echo ""
|
||
echo "9. 验证SSH配置..."
|
||
if sshd -t 2>/dev/null; then
|
||
echo " ✅ SSH配置语法正确"
|
||
else
|
||
echo " ⚠️ 警告：SSH配置语法可能有误"
|
||
fi
|
||
|
||
# 10. 重启SSH服务（应用配置）
|
||
echo ""
|
||
echo "10. 重启SSH服务..."
|
||
systemctl restart sshd 2>/dev/null || service sshd restart 2>/dev/null || true
|
||
sleep 2
|
||
|
||
if systemctl is-active --quiet sshd || service sshd status >/dev/null 2>&1; then
|
||
echo " ✅ SSH服务已重启并运行正常"
|
||
else
|
||
echo " ⚠️ 警告：SSH服务重启后状态异常"
|
||
fi
|
||
|
||
echo ""
|
||
echo "=================================================================================="
|
||
echo "✅ SSH配置保护已完成！"
|
||
echo "=================================================================================="
|
||
echo ""
|
||
echo "📋 保护措施总结："
|
||
echo " 1. ✅ SSH配置文件已设置为不可变（immutable）"
|
||
echo " 2. ✅ SSH目录和文件权限已设置"
|
||
echo " 3. ✅ SSH配置已备份"
|
||
echo " 4. ✅ SSH配置监控脚本已创建（每5分钟检查）"
|
||
echo " 5. ✅ SSH服务保护脚本已创建（每2分钟检查）"
|
||
echo " 6. ✅ SSH服务已设置为开机自启"
|
||
echo ""
|
||
echo "📝 查看监控日志："
|
||
echo " - SSH配置监控: tail -f /var/log/ssh-config-monitor.log"
|
||
echo " - SSH服务保护: tail -f /var/log/ssh-service-protect.log"
|
||
echo ""
|
||
echo "⚠️ 重要提示："
|
||
echo " - 如果需要修改SSH配置，请先运行: chattr -i /etc/ssh/sshd_config"
|
||
echo " - 修改完成后，请运行: chattr +i /etc/ssh/sshd_config"
|
||
echo " - 配置文件备份位置: /root/ssh_backups/"
|
||
echo ""
|
||
|