53 lines
2.1 KiB
Bash
53 lines
2.1 KiB
Bash
|
#!/bin/bash
|
|||
|
|
# C 项：测试环境服务降权（User=root → User=pms），失败立即回滚该单元
|
|||
|
|
set -e
|
|||
|
|
BK=/root/sec-hardening-backup-20260920-014533
|
|||
|
|
mkdir -p "$BK/units"
|
|||
|
|
|
|||
|
|
for u in pms-api-test pms-device-test; do
|
|||
|
|
f=/etc/systemd/system/$u.service
|
|||
|
|
[ -f "$f" ] || { echo "MISSING $f"; exit 1; }
|
|||
|
|
cp -a "$f" "$BK/units/$u.service.bak"
|
|||
|
|
sed -i 's/^User=root$/User=pms/' "$f"
|
|||
|
|
grep -q '^Group=' "$f" || sed -i 's/^User=pms$/User=pms\nGroup=pms/' "$f"
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
systemctl daemon-reload
|
|||
|
|
systemctl restart pms-api-test pms-device-test
|
|||
|
|
sleep 4
|
|||
|
|
|
|||
|
|
fail=0
|
|||
|
|
for u in pms-api-test pms-device-test; do
|
|||
|
|
st=$(systemctl is-active "$u")
|
|||
|
|
pid=$(systemctl show -p MainPID --value "$u")
|
|||
|
|
usr=$(ps -o user= -p "$pid" 2>/dev/null | tr -d ' ')
|
|||
|
|
echo "$u active=$st pid=$pid user=$usr"
|
|||
|
|
[ "$st" = "active" ] || fail=1
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
if [ $fail -ne 0 ]; then
|
|||
|
|
echo "!!! 测试环境降权失败，立即回滚单元 !!!"
|
|||
|
|
for u in pms-api-test pms-device-test; do
|
|||
|
|
cp -a "$BK/units/$u.service.bak" /etc/systemd/system/$u.service
|
|||
|
|
done
|
|||
|
|
systemctl daemon-reload
|
|||
|
|
systemctl restart pms-api-test pms-device-test
|
|||
|
|
sleep 3
|
|||
|
|
echo "回滚后状态: $(systemctl is-active pms-api-test) $(systemctl is-active pms-device-test)"
|
|||
|
|
journalctl -u pms-api-test -n 25 --no-pager
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
echo "=== 单元文件 User/Group ==="
|
|||
|
|
grep -H 'User=\|Group=' /etc/systemd/system/pms-api-test.service /etc/systemd/system/pms-device-test.service
|
|||
|
|
echo "=== 健康检查 ==="
|
|||
|
|
curl -s -o /dev/null -w 'api-test /api/health -> %{http_code}\n' http://127.0.0.1:3000/api/health
|
|||
|
|
curl -s http://127.0.0.1:3000/api/health; echo
|
|||
|
|
echo "=== 端口 ==="
|
|||
|
|
ss -ltnp | grep -E ':(3000|3001)\b'
|
|||
|
|
echo "=== pms 用户写权限 ==="
|
|||
|
|
su -s /bin/bash pms -c 'touch /data/pms_dev/api-server/uploads/.write-probe && echo "uploads writable" && rm -f /data/pms_dev/api-server/uploads/.write-probe'
|
|||
|
|
su -s /bin/bash pms -c 'touch /data/pms_dev/api-server/exports/.write-probe && echo "exports writable" && rm -f /data/pms_dev/api-server/exports/.write-probe'
|
|||
|
|
echo "=== 日志尾部 ==="
|
|||
|
|
journalctl -u pms-api-test -n 8 --no-pager
|