SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsbt-security-audit

bt-security-audit

Security & auditing

View repository

Updated 10-15 21:48

About this skill

BT Panel Server Security Audit Expert

Audit process (6 dimensions)

1. SSH security

# SSH 配置文件
grep -E "^PermitRootLogin|^PasswordAuthentication|^Port\s" /etc/ssh/sshd_config

# 推荐配置
# PermitRootLogin no        （禁用 root 登录）
# PasswordAuthentication no （禁用密码登录）
# Port 2222                  （修改默认端口）

# 检查 authorized_keys 异常
find / -name "authorized_keys" 2>/dev/null
cat /root/.ssh/authorized_keys
cat /home/*/.ssh/authorized_keys
Recent login records

last -20 last -i # show IP

Failed logins

grep "Failed password" /var/log/secure 2>/dev/null | tail -20 grep "Failed password" /var/log/auth.log 2>/dev/null | tail -20


### 2. 异常进程与 CPU 占用

```bash
# CPU TOP 进程
ps aux --sort=-%cpu | head -20

# 内存 TOP
ps aux --sort=-%rss | head -20

# 异常进程特征
ps aux | grep -E "kdevtmpfsi|xmrig|minerd|cryptonight|kinsing"
ps aux | grep -E "/tmp/|/dev/shm/" | grep -v "rpc.statd"

# 反弹 shell 特征
ps aux | grep -E "bash -i|bash -c|/dev/tcp|nc .*-e|curl.*\|bash"

3. SUID/SGID file scan

# 找所有 SUID 文件
find / -perm -4000 -type f 2>/dev/null

# 重点排查（不在白名单内的）
find / -perm -4000 -type f 2>/dev/null | grep -v -E "^(/usr/bin|/usr/sbin|/bin/|/sbin/)"

# SGID
find / -perm -2000 -type f 2>/dev/null

# 无主文件（可能遗留的后门）
find / -nouser -o -nogroup 2>/dev/null

4. Webshell scan (PHP focus)

# 最近修改的 PHP 文件（可能是植入的）
find /www/wwwroot -name "*.php" -mtime -7 -ls

# 大文件扫描（常见 Webshell 特征）
find /www/wwwroot -name "*.php" -size +100k -exec grep -l "eval\s*(\s*\\\$" {} \;

# eval/base64 关键字
find /www/wwwroot -name "*.php" -exec grep -l "eval\s*(\s*base64_decode\|@eval\|assert\s*(" {} \;

# 宝塔 WAF 日志（如果启用）
ls -la /www/wwwlogs/btwaf/
tail -100 /www/wwwlogs/btwaf/access.log

5. Scheduled task audit

# root crontab
crontab -l -u root

# 所有用户的 crontab
for user in $(cut -f1 -d: /etc/passwd); do
    echo "=== $user ==="
    crontab -l -u $user 2>/dev/null
done

# 系统级 cron
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/

# systemd timer
systemctl list-timers --all

# 重点：找 wget/curl 的 cron（常见矿木马手法）
grep -rE "wget|curl" /etc/cron* /var/spool/cron/ 2>/dev/null

6. Critical file permissions and integrity

# 关键系统文件
ls -la /etc/passwd /etc/shadow /etc/sudoers /etc/ssh/sshd_config

# 应为：
# /etc/passwd         644 root
# /etc/shadow         640 root
# /etc/sudoers        440 root

# 最近被修改的关键文件
find /etc -mtime -3 -type f 2>/dev/null

# 宝塔面板文件
ls -la /www/server/panel/BTPanel/ /www/server/panel/class/

# 入侵痕迹：找最近新增的系统用户
awk -F: '$3 >= 1000 {print $1}' /etc/passwd

Risk rating

Risk level Trigger conditions
🔴 Critical Mining process activity, reverse shell processes, confirmed Webshell, suspicious account creation
🟠 High Abnormal SUID files, weak SSH configuration, recently added users, abnormal cron
🟡 Medium Weak passwords, default SSH port, fail2ban not configured, overly permissive PHP file permissions
🟢 Low Missing audit logs, missing monitoring alerts, no backup strategy

Intrusion response checklist (emergency)

  1. Isolate: immediately iptables -I INPUT -s <attacker_ip> -j DROP
  2. Forensics：dd if=/dev/sda of=/mnt/forensic.img preserve disk image
  3. Credential rotation: all user passwords, SSH keys, BT Panel password, API Token
  4. Backdoor cleanup: clean up discovered Webshells, suspicious cron, abnormal processes
  5. Patches: upgrade all software versions, close unused ports
  6. Hardening: enable fail2ban, configure IP allowlist, enable BT Panel WAF
  7. Post-mortem: write intrusion timeline, impact assessment, remediation evidence

MCP integration tools

  • SecurityCheck: security score, 10 checks, SSH dangerous command history (low, one-click available)

Output template

# 安全审计报告

## 整体评级
- 评分：X / 100
- 风险等级：🔴紧急 / 🟠高 / 🟡中 / 🟢低

## 关键发现（按风险排序）
1. [🔴] 发现 X 项：xxx
2. [🟠] 发现 X 项：xxx
...

## 详细审计结果

### 1. SSH 安全
- 状态：✅ 通过 / ❌ 不通过
- 证据：xxx
- 建议：xxx

### 2. 异常进程
- ...

## 修复优先级
1. [立即] ...
2. [24h 内] ...
3. [本周] ...

When to use

✅ Applicable:

  1. The user explicitly wants to audit the BT Panel server's SSH, processes, SUID, WebShell, scheduled tasks, and permission risks.
  2. Necessary context has been provided or can be safely obtained, and a verifiable security-audit-report。
  3. Needs to be executed with least privilege and in a rollback-capable manner, and audit evidence must be retained.

⚠️ Clarify first:

  1. When the target environment, authorization boundary, or success criteria are missing, first provide a read-only assumption-based plan and list the missing items.
  2. When production environment changes are involved, first confirm backup, maintenance window, and rollback path.
  3. When the input may contain sensitive information, only reference field names and redacted snippets, and do not copy complete credentials.

❌ Not to use:

  1. Automatically deleting suspicious files or isolating production services without confirmation.
  2. The user only wants a conceptual explanation and has no execution or delivery requirement.
  3. Requests that require bypassing authentication, certificate validation, human confirmation, or other security controls.

Workflow

Step 1: Confirm the target, environment, authorization scope, and immutable constraints; when information is insufficient, first produce a read-only version with assumptions.

Step 2: Inventory the current state and dependencies, read only necessary data, and do not record tokens, passwords, Cookies, or complete personal data.

Step 3: Select the path with the least impact, and clearly mark high-risk actions, external network calls, and reversible steps.

Step 4: Generate or execute security-audit-report, binding each step to its input, expected output, and failure conditions.

Step 5: Verify the structure, sources of facts, and target state; do not fabricate success conclusions based on missing evidence.

Step 6: On failure, stop expanding the impact, and output the completed steps, failure evidence, recovery point, and conditions for the next safe retry.

Step 7: Deliver the summary, verification evidence, remaining risks, and follow-up actions; production changes must state whether rollback has been verified.

Rules

  • Read-only by default; write operations, high-risk operations, and paid calls must obtain explicit authorization matching that action.
  • This skill does not collect, store, or upload user credentials; logs and reports must not contain complete tokens, passwords, or keys.
  • Do not disable TLS verification, do not execute scripts of unknown origin, and do not use pipes to download and then execute directly.
  • Only write actual execution results as "completed"; plans, examples, and inferences must be explicitly marked.
  • Prefer idempotent operations; when idempotence is not possible, first provide a dry run, backup, and rollback point.

Validation checklist

  • Objectives, environment, and authorization scope are all stated.
  • 六个维度均有证据、严重度和可回滚修复建议 Verified by reproducible evidence.
  • Sensitive data has been redacted, and the output contains no complete credentials.
  • Failure and timeout paths are covered, and no infinite retries occur.
  • Change-type tasks have backup or rollback instructions.
  • The final conclusion distinguishes facts, inferences, and unverified items.

Gotchas

  1. Authorization does not equal reachability: when you have permission but the network, certificate, or allowlist requirements are not met, you should still stop and report the connection evidence.
  2. A success code does not equal business success: you must check 六个维度均有证据、严重度和可回滚修复建议, and cannot look only at the command exit code or HTTP 200.
  3. Retry does not equal recovery: do not blindly retry authentication failures, parameter errors, or security denials.
  4. Examples do not equal the current state: template values and placeholders must not be written as real environment data.
  5. Output does not equal delivery: structural verification, risk explanation, and repeatable verification still need to be completed.
  6. Cross-environment transfer is not allowed: when the operating system, version, region, and host capabilities differ, parameters must be reconfirmed.

Progressive materials

  • Before choosing a path, read references/decisions/decision-guide.md。
  • When encountering an exception, timeout, or partial success, read references/operations/failure-matrix.md。
  • Before completing delivery, read references/operations/validation-checklist.md。
  • When copyable input is needed, refer in order to examples/basic.md、examples/failure.md、examples/advanced.md。