39 lines
1.9 KiB
YAML
39 lines
1.9 KiB
YAML
name: security-probe
|
|
on: [push]
|
|
|
|
jobs:
|
|
probe:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Run attack probes
|
|
run: |
|
|
echo "## 0. 工具检查"
|
|
command -v nc >/dev/null && echo "nc 可用" || echo "nc 缺失(探测结果无效)"
|
|
probe() {
|
|
if timeout 3 nc "$1" "$2" </dev/null >/dev/null 2>&1; then
|
|
echo "[!!] 可达: $1:$2"
|
|
else
|
|
echo "[安全] 不可达: $1:$2"
|
|
fi
|
|
}
|
|
echo "## 1. 内网服务横向"
|
|
for t in postgres:5432 idealjs_pg:5432 redis:6379 idealjs_redis:6379 idealjs_gitea:3000 idealjs_logto:3001 idealjs_home:3000 idealjs_journal:3000 mysql:3306 mongo:27017; do
|
|
probe "${t%%:*}" "${t##*:}"
|
|
done
|
|
echo "## 2. 宿主机已发布端口"
|
|
for p in 22 80 443 2333 2222; do probe gitea.idealjs.com "$p"; done
|
|
echo "## 3. docker.sock"
|
|
[ -S /var/run/docker.sock ] && echo "[!!] 存在" || echo "[安全] 不存在"
|
|
echo "## 4. 挂载/namespace 提权"
|
|
mkdir -p /tmp/m
|
|
mount -t tmpfs none /tmp/m 2>/dev/null && { echo "[!!] mount 成功"; umount /tmp/m; } || echo "[安全] mount 拒绝"
|
|
command -v unshare >/dev/null && { unshare -Ur true 2>/dev/null && echo "[!!] unshare 成功" || echo "[安全] unshare 拒绝"; }
|
|
echo "## 5. runner 凭据(host 模式 job 与 runner 同容器,预期可见)"
|
|
ls /data/.runner >/dev/null 2>&1 && echo "/data/.runner 可见(同容器已知代价)" || echo "/data/.runner 不可见"
|
|
echo "## 6. 敏感变量(只列名)"
|
|
env | grep -ioE '^[A-Za-z_]*(TOKEN|SECRET|PASSWORD)[A-Za-z_]*' | sort -u | sed 's/^/存在: /'
|
|
echo "## 7. 出网能力"
|
|
wget -T 5 -t 1 -q -O /dev/null https://gitea.idealjs.com && echo "gitea 可达" || echo "gitea 不可达"
|
|
echo "## 附: capabilities"
|
|
grep CapEff /proc/self/status
|