腾讯云镜主机安全——安装脚本分析

#!/bin/bash
if [ `id -u` -ne 0 ];then 
     echo "Yunjing software must run as root. Please check your account"
     exit 0
fi
system_info=`uname -a`
Is64BitSystem=` echo $system_info | grep -c "x86_64" `
if [ $Is64BitSystem -le 0 ]; then
    echo "Your system is not 64-Bit. That Yunjing is not support yet."
    exit 0
fi

1-11行分析：

1) .首先判断当前用户是不是root用户，获取当前系统信息，并判断是否为64位系统，如果不是则退出安装。

---

stop_server="service YDService stop"
reload_server=""
regist_server="chkconfig --add YDService"
init_d_path="/etc/rc.d/init.d"
service_script_name="YDService"
rc_local_path="/etc/rc.d/rc.local"

12-19行分析：

2) .对变量赋值。 

---

if type systemctl >/dev/null 2>&1; then 
  init_d_path="/usr/lib/systemd/system" 
  service_script_name="YDService.service"
  stop_server="systemctl stop YDService.service"
  reload_server="systemctl daemon-reload"
  regist_server="systemctl enable YDService.service"
fi

 20-27行分析：

3) .判断systemctl命令是否存在，如果存在则需要对步骤二变量进行调整

---

#ubuntu or debian no gawk command
IsUbuntuOrDebian=` echo $system_info | grep -i -c "ubuntu\|debian" ` 
if [ $IsUbuntuOrDebian -gt 0 ]; then
version() { echo "$@" | awk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }'; }
init_d_path="/etc/init.d"
rc_local_path="/etc/rc.local"
service_script_name="YDService"
stop_server=""
regist_server="update-rc.d YDService defaults"
  if type systemctl >/dev/null 2>&1; then
    init_d_path="/lib/systemd/system"
    service_script_name="YDService.service"
    stop_server=""
    reload_server=""
    regist_server="systemctl enable YDService.service"
  fi
else
version() { echo "$@" | gawk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }'; }
fi

28-46行分析：

4) .判断系统是否为Ubuntu或者Debian系统如果是则修改变量值

---

IsSuse=` echo $system_info | grep -c "sles" ` 
if [ $IsSuse -gt 0 ]; then
init_d_path="/etc/init.d"
  if type systemctl >/dev/null 2>&1; then
    init_d_path="/etc/systemd/system"
  fi
fi

47-54行分析：

5) .判断是否为suse系统，如果是则修改变量

---

if type rc-update >/dev/null 2>&1; then 
  init_d_path="/etc/init.d" 
  service_script_name="YDGentooService"
  stop_server=""
  regist_server="rc-update add YDGentooService default"
fi

55-62行分析：

6) .判断rc-update命令是否存在，如果存在则修改启动项添加方式

---

add_crontab=""
if [ -e '/usr/share/coreos/lsb-release' ]; then
  init_d_path="/etc/systemd/system" 
  service_script_name="YDCoreService.service"
  stop_server=""
  regist_server="systemctl enable YDCoreService.service"
fi

63-71行分析：

7）.判断/usr/share/coreos/lsb-release文件是否存在，如果存在修改变量的值

---

first_version=2.6.32
second_version=`uname -r`
if [ "$(version "$first_version")" -gt "$(version "$second_version")" ]; then
     echo "Your system version is too old. That Yunjing is not support yet."
     exit 0
fi

72-77行分析：

8) .判断内核版本是否为2.6.32以上，如果不是则退出安装。

---

if [ -w '/usr' ]; then
    myPath="/usr/local/qcloud"
else
    myPath="/var/lib/qcloud"
fi
CURPATH="$( cd "$( dirname $0 )" && pwd )"
echo "checking the md5 file..."
md5_local=`md5sum ${CURPATH}/ydeyesinst_linux64.tar.gz | awk '{print $1}' `
md5_server=`head -1 ${CURPATH}/ydeyesinst_linux64.md5 | awk '{print $1}' `

78-86行分析：

9) .判断/usr路径是否存在，如果存在安装路径的值为/usr/local/qcloud，否则为/var/lib/qcloud。获取当前脚本绝对路径CURPATH。检测安装包MD5值，并获取安装包中记录的MD5进行比较。

---

if [ "$md5_local"x = "$md5_server"x ]
then
	echo "check package success"

	if [ ! -e "$myPath" ]; then
    mkdir -p "$myPath"
	fi   
	if [ ! -e "$myPath/YunJing" ]; then
    mkdir -p "$myPath/YunJing"
	fi 
	
	tar -zxvf ${CURPATH}/ydeyesinst_linux64.tar.gz -C $myPath/YunJing >/dev/null 2>&1
	#delete crontab
	if ! [ -e '/usr/share/coreos/lsb-release' ]; 
	then
	    chmod 700 $myPath/YunJing/YDDelCrontab.sh
	    $myPath/YunJing/YDDelCrontab.sh
	    add_crontab="$myPath/YunJing/YDAddCrontab.sh"  
	    if [ $? -ne 0 ];then
	        line="$myPath/YunJing/YDCrontab.sh"
	        (crontab -u root -l | grep -v "$line") | crontab -u root -
	    fi
	fi
	

	if [ -f "${CURPATH}/ydeyes.xml" ]
	then 
	cp -rf ${CURPATH}/ydeyes.xml $myPath/YunJing/conf/ydeyes.xml
	fi
	if [ -f "${CURPATH}/security.dat" ]
	then 
	cp -rf ${CURPATH}/security.dat $myPath/YunJing/conf/security.dat
	fi

87-119行分析：

10) .判断安装包MD5值与记录中是否匹配，如果匹配则继续进行，创建$myPath/YunJing安装目录，并把安装包ydeyesinst_linux64.tar.gz解压至$myPath/YunJing路径下。

       判断/usr/share/coreos/lsb-release文件是否存在，如果不存在则修改脚本YDDelCrontab.sh权限为700，并执行该脚本（注：该脚本稍后分析）。如果执行失败直接执行YDCrontab.sh脚本，进行定时任务添加。

       判断ydeyes.xml文件是否存在，如果存在则把安装包中所带的ydeyes.xml文件内容拷贝至$myPath/YunJing/conf/ydeyes.xml文件中

       判断security.dat文件是否存在，如果存在则把安装包中所带的security.dat文件内容拷贝至$myPath/YunJing/conf/security.dat文件中

---

	chmod 700 $myPath/YunJing/conf
	chmod 700 $myPath/YunJing/YDLive
	chmod 700 $myPath/YunJing/YDEyes
	chmod 600 $myPath/YunJing/conf/ydeyes.xml
	chmod 700 $myPath/YunJing/YDLive/YDLive
	chmod 700 $myPath/YunJing/YDEyes/YDService
	chmod 700 $myPath/YunJing/uninst.sh
	chmod 700 $myPath/YunJing/startYD.sh
	chmod 700 $myPath/YunJing/YDCrontab.sh
	chmod 700 $myPath/YunJing
    chmod 700 $myPath/YunJing/YDEdr
	chmod 700 $myPath/YunJing/YDAddCrontab.sh
	
    if [ -e "$init_d_path" ]
    then
        if [ -f "$init_d_path" ] && [ "$init_d_path" == "/usr/lib/systemd/system" ]
        then
            echo "repair invalid service root: $init_d_path"
            rm -f $init_d_path
        fi
    fi
        
    if [ ! -e "$init_d_path" ]
    then
        echo "create service root $init_d_path"
        mkdir -p $init_d_path
    fi
    
    if [ -d "$init_d_path" ]
    then
        echo "register service to $init_d_path"
        cp  $myPath/YunJing/$service_script_name $init_d_path
    fi

120-153行分析;

11） .修改文件权限为700.把YDCoreService.service服务添加至自启动列表

---

  if [ "$service_script_name"x = "YDService.service"x ]
  then 
    chmod 644 $init_d_path/$service_script_name
  else
    chmod 744 $init_d_path/$service_script_name
  fi

  if [ "$service_script_name"x = "YDCoreService.service"x ]
  then
    chmod 644 $init_d_path/$service_script_name
  fi  
  
  rm -f $myPath/YunJing/$service_script_name 
  $reload_server
  sleep 2
  $stop_server
	sleep 3
	ProcVer=`pidof YDService`
	if [ $ProcVer ]; then
	$myPath/YunJing/YDEyes/YDService -kill $ProcVer
	fi
	ProcVer=`pidof YDLive`
	if [ $ProcVer ]; then
	$myPath/YunJing/YDEyes/YDService -kill $ProcVer
	fi
	ProcVer=`pidof YDService`
	if [ $ProcVer ]; then
	$myPath/YunJing/YDEyes/YDService -kill $ProcVer
	fi
	ProcVer=`pidof YDEdr`
	if [ $ProcVer ]; then
	$myPath/YunJing/YDEyes/YDService -kill $ProcVer
	fi

154-186行分析：

12) .判断服务名称并赋予相应的权限，并重新加载执行。2秒后关闭然后进行进程查询如果存在则使用kill杀掉。

---

 if [ "$service_script_name"x = "YDCoreService.service"x ]; then
  systemctl start YDCoreService.service
  else  
	$myPath/YunJing/YDEyes/YDService&
	sleep 1
	$myPath/YunJing/YDLive/YDLive &
  fi

  $regist_server
  $add_crontab
  sed -i '/YunJing\/YDEyes\/YDService/d' $rc_local_path
  sed -i '/YunJing\/YDLive\/YDLive/d' $rc_local_path
  
	
	echo "install package success"
else
	echo "package is invalidate"
fi
rm -f ${CURPATH}/ydeyesinst_linux64.tar.gz
rm -f ${CURPATH}/ydeyesinst_linux64.md5
rm -f ${CURPATH}/yunjinginstall_linux64.sh
rm -f ${CURPATH}/ydeyes.xml
rm -f ${CURPATH}/self_cloud_install_linux64.sh

187-209行分析：

      判断服务执行权限并执行相应服务，注册服务至服务管理列表中，添加服务到定时启动列表