自定义PVE巡检脚本

PVE发送邮件配置

巡检报告是通过邮件发送的，所以首先要配置一下PVE的邮件发送功能具体操作如下所示：

安装依赖

apt-get install -y libsasl2-modules postfix

配置 Postfix 信息

修改 /etc/postfix/main.cf 尾部添加：

smtputf8_autodetect_classes = sendmail, verify
smtputf8_enable = no
strict_smtputf8 = no
relayhost = smtp.163.com:465                    #relayhost 需要改为自己的 SMTP 服务和 SSL 端口号
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sender_dependent_authentication = yes
smtp_generic_maps = hash:/etc/postfix/generic
smtp_use_tls = yes
smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

还要将/etc/postfix/main.cf文件中原来的relayhost = 这一行注释

配置 SMTP 信息

修改 /etc/postfix/sasl_passwd 文件，内容格式示例

smtp.exmail.qq.com sendmail@domail.com:password

这里的 SMTP 和和上面的 relayhost 保持一致，但是不需要端口号，sendmail@domail.com 和 password 改为你自己的

修改完成后执行命令：

postmap /etc/postfix/sasl_passwd
chmod 600 /etc/postfix/sasl_passwd

重写发件人

修改 /etc/postfix/generic 文件，内容格式示例：

myhostname sendmail@domail.com

其中 myhostname 跟 /etc/postfix/main.cf 内的值保持一致
修改完成后执行命令：

postmap /etc/postfix/generic

重启 Postfix 服务

执行命令

systemctl reload postfix

也可执行

postfix reload

测试发送邮件

执行命令

echo "Test mail from postfix" | mail -s "Test Postfix" test@test.com

上面最后的 test@test.com 改为你自己的，如果没有收到邮件，检查 /var/log/mail.info 文件查看是否有相关报错。

编写巡检脚本

脚本有依赖，使用前手动安装一下下面的这几个包：

lsscsi、sysstat，net-tools

巡检脚本如下:

#!/bin/bash
#主机信息每日巡检
IPADDR=$(ifconfig enp3s0|grep 'inet addr'|awk -F '[ :]' '{print $13}')
#环境变量PATH没设好，在cron里执行时有很多命令会找不到
export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
source /etc/profile

[ $(id -u) -gt 0 ] && echo "请用root用户执行此脚本！" && exit 1
pveVersion=$(uname -a |awk '{print $3}')
VERSION="2021-12-19 v1"

#日志相关
PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
[ -f $PROGPATH ] && PROGPATH="."
LOGPATH="$PROGPATH/log"
[ -e $LOGPATH ] || mkdir $LOGPATH
RESULTFILE="$LOGPATH/HostDailyCheck-$IPADDR-`date +%Y%m%d`.txt"

function version(){
echo ""
echo "系统巡检脚本：Version $VERSION"
}

function getSystemStatus(){
echo ""
echo "##### KVM系统信息 #####"
if [ -e /etc/sysconfig/i18n ];then
default_LANG="$(grep "LANG=" /etc/sysconfig/i18n | grep -v "^#" | awk -F '"' '{print $2}')"
else
default_LANG=$LANG
fi
export LANG="en_US.UTF-8"
Release=$(uname -a |awk -F'#' '{print $1}')
Kernel=$(uname -r)
OS=$(uname -o)
Hostname=$(uname -n)
LastReboot=$(who -b | awk '{print $3,$4}')
uptime=$(uptime | sed 's/.*up \([^,]*\), .*/\1/')
echo "系统：$OS"
echo "发行版本：$Release"
echo "内核：$Kernel"
echo "主机名：$Hostname"
echo "语言/编码：$default_LANG"
echo "当前时间：$(date +'%F %T')"
echo "最后启动：$LastReboot"
echo "运行时间：$uptime"
}

function getVmStatus(){
echo ""
echo "##### 虚拟机运行情况 #####"
VmNumber=$(qm list|awk 'NR!=1 { print }'|wc -l)
VmRuning=$(qm list|awk 'NR!=1 { print }'|grep running|wc -l)
#VmRuningList=$(qm list|awk 'NR!=1 { print }'|grep running|awk '{print $2}'|tr -s '\n')
VmRunStop=$(qm list|awk 'NR!=1 { print }'|grep stopped|wc -l)
echo "虚拟机总数：$VmNumber"
echo "运行中的虚拟机：$VmRuning"
echo "停止的虚拟机：$VmRunStop"
}

function getCpuStatus(){
echo ""
echo "##### CPU检查 #####"
Physical_CPUs=$(grep "physical id" /proc/cpuinfo| sort | uniq | wc -l)
Virt_CPUs=$(grep "processor" /proc/cpuinfo | wc -l)
CPU_Kernels=$(grep "cores" /proc/cpuinfo|uniq| awk -F ': ' '{print $2}')
CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)
CPU_Arch=$(uname -m)
CPU_15_Average=$(uptime |awk -F',' '{print $6}')
CPU_Average_idle=$(sar -u |grep Average|awk '{print $8}')
CPU_Used=$(echo 100 - $CPU_Average_idle|bc)"%"

echo "物理CPU个数：$Physical_CPUs"
echo "逻辑CPU个数：$Virt_CPUs"
echo "每CPU核心数：$CPU_Kernels"
echo "CPU型号：$CPU_Type"
echo "CPU架构：$CPU_Arch"
echo "CPU 15分钟平均负载：$CPU_15_Average"
echo "CPU 利用率：$CPU_Used"
}

function getMemStatus(){
echo ""
echo "###### 内存检查 #####"
MemTotal=$(grep MemTotal /proc/meminfo| awk '{print $2}') #KB
MemFree=$(grep MemFree /proc/meminfo| awk '{print $2}') #KB
let MemUsed=MemTotal-MemFree
MemPercent=$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}")
report_MemTotal="$((MemTotal/1024/1024))""GB" #内存总容量(GB)
report_MemFree="$((MemFree/1024/1024))""GB" #内存剩余(GB)
report_MemUsedPercent="$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}")""%" #内存使用率%

echo "内存总容量：$report_MemTotal"
echo "内存剩余：$report_MemFree"
echo "内存使用率：$report_MemUsedPercent"
}

function getDiskStatus(){
echo ""
echo "##### 磁盘检查 #####"
DiskNum=$(lsscsi | awk -F'/' '{print $(NF)}'|wc -l)
DiskTotal=$(lsscsi -s | awk -F'/' '{print $NF}')
df -hiP | sed 's/Mounted on/Mounted/'> /tmp/inode
df -hTP | sed 's/Mounted on/Mounted/'> /tmp/disk 
join /tmp/disk /tmp/inode | awk '{print $1,$2,"|",$3,$4,$5,$6,"|",$8,$9,$10,$11,"|",$12}'| column -t
diskdata=$(df -TP | sed '1d' | awk '$2!="tmpfs"{print}') #KB
disktotal=$(echo "$diskdata" | awk '{total+=$3}END{print total}') #KB
diskused=$(echo "$diskdata" | awk '{total+=$4}END{print total}') #KB
diskfree=$((disktotal-diskused)) #KB
diskusedpercent=$(echo $disktotal $diskused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}') 
inodedata=$(df -iTP | sed '1d' | awk '$2!="tmpfs"{print}')
inodetotal=$(echo "$inodedata" | awk '{total+=$3}END{print total}')
inodeused=$(echo "$inodedata" | awk '{total+=$4}END{print total}')
inodefree=$((inodetotal-inodeused))
inodeusedpercent=$(echo $inodetotal $inodeused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}')
report_DiskTotal=$((disktotal/1024/1024))"GB" #硬盘总容量(GB)
report_DiskFree=$((diskfree/1024/1024))"GB" #硬盘剩余(GB)
report_DiskUsedPercent="$diskusedpercent""%" #硬盘使用率%
report_InodeTotal=$((inodetotal/1000))"K" #Inode总量
report_InodeFree=$((inodefree/1000))"K" #Inode剩余
report_InodeUsedPercent="$inodeusedpercent""%" #Inode使用率%

echo ""
echo "共有硬盘$DiskNum块"
echo "硬盘物理容量：$DiskTotal"
echo "硬盘总容量：$report_DiskTotal"
echo "硬盘剩余：$report_DiskFree"
echo "硬盘使用率：$report_DiskUsedPercent"
echo "Inode总量：$report_InodeTotal"
echo "Inode剩余：$report_InodeFree"
echo "Inode使用率：$report_InodeUsedPercent"
}

function getNetworkStatus(){
echo ""
echo "##### 网络检查 #####"
GATEWAY=$(ip route | grep default | awk '{print $3}')
DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' ',' | sed 's/,$//')
IP=$(ip -f inet addr | grep -v 127.0.0.1 | grep inet | awk '{print $NF,$2}' | tr '\n' ',' | sed 's/,$//')

echo "IP地址：$IP"
echo "网关：$GATEWAY "
echo " DNS：$DNS"

}

function getLoginStatus(){
echo ""
echo "##### 登录检查 #####"
last | head
}

function getHowLongAgo(){
# 计算一个时间戳离现在有多久了
datetime="$*"
[ -z "$datetime" ] && echo "错误的参数：getHowLongAgo() $*"
Timestamp=$(date +%s -d "$datetime") #转化为时间戳
Now_Timestamp=$(date +%s)
Difference_Timestamp=$(($Now_Timestamp-$Timestamp))
days=0;hours=0;minutes=0;
sec_in_day=$((60*60*24));
sec_in_hour=$((60*60));
sec_in_minute=60
while (( $(($Difference_Timestamp-$sec_in_day)) > 1 ))
do
let Difference_Timestamp=Difference_Timestamp-sec_in_day
let days++
done
while (( $(($Difference_Timestamp-$sec_in_hour)) > 1 ))
do
let Difference_Timestamp=Difference_Timestamp-sec_in_hour
let hours++
done
echo "$days 天 $hours 小时前"
}

function getUserLastLogin(){
# 获取用户最近一次登录的时间，含年份
# 很遗憾last命令不支持显示年份，只有"last -t YYYYMMDDHHMMSS"表示某个时间之间的登录，我
# 们只能用最笨的方法了，对比今天之前和今年元旦之前（或者去年之前和前年之前……）某个用户
# 登录次数，如果登录统计次数有变化，则说明最近一次登录是今年。
username=$1
: ${username:="`whoami`"}
thisYear=$(date +%Y)
oldesYear=$(last | tail -n1 | awk '{print $NF}')
while(( $thisYear >= $oldesYear));do
loginBeforeToday=$(last $username | grep $username | wc -l)
loginBeforeNewYearsDayOfThisYear=$(last $username -t $thisYear"0101000000" | grep $username | wc -l)
if [ $loginBeforeToday -eq 0 ];then
echo "从未登录过"
break
elif [ $loginBeforeToday -gt $loginBeforeNewYearsDayOfThisYear ];then
lastDateTime=$(last -i $username | head -n1 | awk '{for(i=4;i<(NF-2);i++)printf"%s ",$i}')" $thisYear" #格式如: Sat Nov 2 20:33 2015
lastDateTime=$(date "+%Y-%m-%d %H:%M:%S" -d "$lastDateTime")
echo "$lastDateTime"
break
else
thisYear=$((thisYear-1))
fi
done

}

function getUserStatus(){
echo ""
echo "##### 用户检查 #####"
#/etc/passwd 最后修改时间
pwdfile="$(cat /etc/passwd)"
Modify=$(stat /etc/passwd | grep Modify | tr '.' ' ' | awk '{print $2,$3}')

echo "/etc/passwd 最后修改时间：$Modify ($(getHowLongAgo $Modify))"
echo ""
echo "特权用户"
echo "--------"
RootUser=""
for user in $(echo "$pwdfile" | awk -F: '{print $1}');do
if [ $(id -u $user) -eq 0 ];then
echo "$user"
RootUser="$RootUser,$user"
fi
done
echo ""
echo "用户列表"
echo "--------"
USERs=0
echo "$(
echo "用户名 UID GID HOME SHELL 最后一次登录"
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for username in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do
userLastLogin="$(getUserLastLogin $username)"
echo "$pwdfile" | grep -w "$username" |grep -w "$shell"| awk -F: -v lastlogin="$(echo "$userLastLogin" | tr ' ' '_')" '{print $1,$3,$4,$6,$7,lastlogin}'
done
let USERs=USERs+$(echo "$pwdfile" | grep "$shell"| wc -l)
done
)" | column -t
echo ""
echo "空密码用户"
echo "----------"
USEREmptyPassword=""
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do
r=$(awk -F: '$2=="!!"{print $1}' /etc/shadow | grep -w $user)
if [ ! -z $r ];then
echo $r
USEREmptyPassword="$USEREmptyPassword,"$r
fi
done 
done
echo ""
echo "相同ID的用户"
echo "------------"
USERTheSameUID=""
UIDs=$(cut -d: -f3 /etc/passwd | sort | uniq -c | awk '$1>1{print $2}')
for uid in $UIDs;do
echo -n "$uid";
USERTheSameUID="$uid"
r=$(awk -F: 'ORS="";$3=='"$uid"'{print ":",$1}' /etc/passwd)
echo "$r"
echo ""
USERTheSameUID="$USERTheSameUID $r,"
done

}

function getPasswordStatus {
echo ""
echo "##### 密码检查 #####"
pwdfile="$(cat /etc/passwd)"
echo ""
echo "密码过期检查"
echo "------------"
result=""
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do
get_expiry_date=$(/usr/bin/chage -l $user | grep 'Password expires' | cut -d: -f2)
if [[ $get_expiry_date = ' never' || $get_expiry_date = 'never' ]];then
printf "%-15s 永不过期\n" $user
result="$result,$user:never"
else
password_expiry_date=$(date -d "$get_expiry_date" "+%s")
current_date=$(date "+%s")
diff=$(($password_expiry_date-$current_date))
let DAYS=$(($diff/(60*60*24)))
printf "%-15s %s天后过期\n" $user $DAYS
result="$result,$user:$DAYS days"
fi
done
done
report_PasswordExpiry=$(echo $result | sed 's/^,//')

echo ""
echo "密码策略检查"
echo "------------"
grep -v "#" /etc/login.defs | grep -E "PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE"

}

function getProcessStatus(){
echo ""
echo "##### 进程检查 ######"
if [ $(ps -ef | grep defunct | grep -v grep | wc -l) -ge 1 ];then
echo ""
echo "僵尸进程";
echo "--------"
ps -ef | head -n1
ps -ef | grep defunct | grep -v grep
fi
echo ""
echo "内存占用TOP10"
echo "-------------"
echo -e "PID %MEM RSS COMMAND
$(ps aux | awk '{print $2, $4, $6, $11}' | sort -k3rn | head -n 10 )"| column -t 
echo ""
echo "CPU占用TOP10"
echo "------------"
top b -n1 | head -17 | tail -11
}

function getState(){
if [[ $pveVersion < 7 ]];then
if [ -e "/etc/init.d/$1" ];then
if [ `/etc/init.d/$1 status 2>/dev/null | grep -E "is running|正在运行" | wc -l` -ge 1 ];then
r="active"
else
r="inactive"
fi
else
r="unknown"
fi
else
r="$(systemctl is-active $1 2>&1)"
fi
echo "$r"
}

function getSSHStatus(){
#SSHD服务状态，配置,受信任主机等
echo ""
echo "##### SSH检查 #####"
#检查受信任主机
pwdfile="$(cat /etc/passwd)"
echo "服务状态：$(getState sshd)"
Protocol_Version=$(cat /etc/ssh/sshd_config | grep Protocol | awk '{print $2}')
echo "SSH协议版本：$Protocol_Version"
echo ""
echo "信任主机"
echo "--------"
authorized=0
for user in $(echo "$pwdfile" | grep /bin/bash | awk -F: '{print $1}');do
authorize_file=$(echo "$pwdfile" | grep -w $user | awk -F: '{printf $6"/.ssh/authorized_keys"}')
authorized_host=$(cat $authorize_file 2>/dev/null | awk '{print $3}' | tr '\n' ',' | sed 's/,$//')
if [ ! -z $authorized_host ];then
echo "$user 授权 \"$authorized_host\" 无密码访问"
fi
let authorized=authorized+$(cat $authorize_file 2>/dev/null | awk '{print $3}'|wc -l)
done

echo ""
echo "是否允许ROOT远程登录"
echo "--------------------"
config=$(cat /etc/ssh/sshd_config | grep PermitRootLogin)
firstChar=${config:0:1}
if [ $firstChar == "#" ];then
PermitRootLogin="yes" #默认是允许ROOT远程登录的
else
PermitRootLogin=$(echo $config | awk '{print $2}')
fi
echo "PermitRootLogin $PermitRootLogin"

echo ""
echo "/etc/ssh/sshd_config"
echo "--------------------"
cat /etc/ssh/sshd_config | grep -v "^#" | sed '/^$/d'

}

function getchage_file_24h(){
echo ""
echo ""
echo "##### 文件检查 #####"
check2=$(find / -name '*.sh' -mtime -1)
check21=$(find / -name '*.asp' -mtime -1)
check22=$(find / -name '*.php' -mtime -1)
check23=$(find / -name '*.aspx' -mtime -1)
check24=$(find / -name '*.jsp' -mtime -1)
check25=$(find / -name '*.html' -mtime -1)
check26=$(find / -name '*.htm' -mtime -1)
check9=$(find / -name core -exec ls -l {} \;)
check10=$(cat /etc/crontab)
check12=$(ls -alt /usr/bin | head -10)
cat <<EOF

##### 查看所有被修改过的文件返回最近24小时内的 #####
${check2}
${check21}
${check22}
${check23}
${check24}
${check25}
${check26}
${line}

##### 检查定时文件的完整性 ######
${check10}
${line}

##### 查看系统命令是否被替换 #####
${check12}
${line}
EOF
}

function getCronStatus(){
echo ""
echo "###### 计划任务检查 #####"
Crontab=0
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do
crontab -l -u $user >/dev/null 2>&1
status=$?
if [ $status -eq 0 ];then
echo "$user"
echo "--------"
crontab -l -u $user
let Crontab=Crontab+$(crontab -l -u $user | wc -l)
echo ""
fi
done
done
#计划任务
find /etc/cron* -type f | xargs -i ls -l {} | column -t
let Crontab=Crontab+$(find /etc/cron* -type f | wc -l)
}

function check(){
version
getSystemStatus
getVmStatus
getCpuStatus
getMemStatus
getDiskStatus
getNetworkStatus
getLoginStatus
getUserStatus
getPasswordStatus
getProcessStatus
getSSHStatus
getchage_file_24h
getCronStatus
}

#执行检查并保存检查结果
check > $RESULTFILE

echo -e "`date "+%Y-%m-%d %H:%M:%S"` KVM母机每周巡检报告"  | mail -s "KVM母机每周巡检报告" xxxx@qq.com < $RESULTFILE

设置定时任务

执行crontab -e在末尾添加一行

0 10 * * 6 sh /data/kvm_mail.sh 2>/dev/null

这里就只设置在每周六上午10点发送巡检报告