99 lines
3.4 KiB
PowerShell
99 lines
3.4 KiB
PowerShell
# 只读排查：同事公钥是否在 authorized_keys、本机防火墙/SSH 相关线索
|
|
# 不改任何配置，不输出私钥。
|
|
|
|
$ErrorActionPreference = 'Continue'
|
|
Write-Output '=== host ==='
|
|
whoami
|
|
hostname
|
|
|
|
$ak = Join-Path $env:USERPROFILE '.ssh\authorized_keys'
|
|
Write-Output "=== authorized_keys: $ak ==="
|
|
if (-not (Test-Path $ak)) {
|
|
Write-Output 'NO_AUTHORIZED_KEYS_FILE'
|
|
exit 0
|
|
}
|
|
|
|
$lines = Get-Content $ak | Where-Object { $_ -and $_.Trim() -notmatch '^#' }
|
|
Write-Output ("key_lines=" + $lines.Count)
|
|
|
|
$needle = 'IFBmb3YG1ZOJ3kaj8z3H55GXmv+hPIbYgN298VKorgFv'
|
|
$commentNeedle = 'ytd-external-developer'
|
|
$hit = $false
|
|
foreach ($line in $lines) {
|
|
if ($line -like "*$needle*") {
|
|
Write-Output 'PUBKEY_FOUND=yes'
|
|
Write-Output ("PUBKEY_LINE_PREFIX=" + $line.Substring(0, [Math]::Min(60, $line.Length)))
|
|
$hit = $true
|
|
}
|
|
if ($line -like "*$commentNeedle*") {
|
|
Write-Output 'COMMENT_FOUND=yes'
|
|
}
|
|
}
|
|
if (-not $hit) {
|
|
Write-Output 'PUBKEY_FOUND=no'
|
|
Write-Output 'PUBKEY_NOT_IN_AUTHORIZED_KEYS'
|
|
}
|
|
|
|
Write-Output '=== key comments (safe) ==='
|
|
foreach ($line in $lines) {
|
|
if ($line -match '^ssh-\S+\s+\S+\s+(.+)$') {
|
|
Write-Output ("comment=" + $Matches[1])
|
|
} elseif ($line -match '^ssh-\S+\s+\S+$') {
|
|
Write-Output 'comment=(none)'
|
|
} else {
|
|
Write-Output 'line=(unparsed-or-options)'
|
|
}
|
|
}
|
|
|
|
Write-Output '=== OpenSSH firewall rules (OpenSSH/22) ==='
|
|
try {
|
|
Get-NetFirewallRule -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.DisplayName -match 'OpenSSH|SSH' -or $_.Name -match 'OpenSSH|SSH' } |
|
|
Select-Object -First 20 DisplayName, Enabled, Direction, Action, Profile |
|
|
Format-Table -AutoSize | Out-String | Write-Output
|
|
} catch {
|
|
Write-Output ("firewall_query_err=" + $_.Exception.Message)
|
|
}
|
|
|
|
Write-Output '=== firewall rules mentioning 38.175.103.103 ==='
|
|
try {
|
|
$addrRules = Get-NetFirewallAddressFilter -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.RemoteAddress -match '38\.175\.103\.103' -or ($_.RemoteAddress -is [array] -and ($_.RemoteAddress -contains '38.175.103.103')) }
|
|
if ($addrRules) {
|
|
foreach ($af in $addrRules) {
|
|
$rule = Get-NetFirewallRule -AssociatedNetFirewallAddressFilter $af -ErrorAction SilentlyContinue
|
|
if ($rule) {
|
|
Write-Output ("rule=" + $rule.DisplayName + "; enabled=" + $rule.Enabled + "; action=" + $rule.Action + "; dir=" + $rule.Direction + "; remote=" + ($af.RemoteAddress -join ','))
|
|
}
|
|
}
|
|
} else {
|
|
Write-Output 'NO_FIREWALL_RULE_WITH_THAT_IP'
|
|
}
|
|
} catch {
|
|
Write-Output ("addr_filter_err=" + $_.Exception.Message)
|
|
}
|
|
|
|
Write-Output '=== inbound allow rules on local port 22 (if any) ==='
|
|
try {
|
|
Get-NetFirewallPortFilter -Protocol TCP -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.LocalPort -eq 22 -or $_.LocalPort -eq '22' } |
|
|
ForEach-Object {
|
|
$rule = Get-NetFirewallRule -AssociatedNetFirewallPortFilter $_ -ErrorAction SilentlyContinue
|
|
if ($rule) {
|
|
$af = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $rule -ErrorAction SilentlyContinue
|
|
Write-Output ("rule=" + $rule.DisplayName + "; enabled=" + $rule.Enabled + "; action=" + $rule.Action + "; remote=" + (($af.RemoteAddress) -join ','))
|
|
}
|
|
}
|
|
} catch {
|
|
Write-Output ("port22_err=" + $_.Exception.Message)
|
|
}
|
|
|
|
Write-Output '=== sshd service ==='
|
|
try {
|
|
Get-Service sshd -ErrorAction SilentlyContinue | Format-List Name, Status, StartType | Out-String | Write-Output
|
|
} catch {
|
|
Write-Output ("sshd_err=" + $_.Exception.Message)
|
|
}
|
|
|
|
Write-Output 'DONE'
|