w1cee/serverscout

# serverscout 基于 SSH 的轻量级 Linux 服务器安全扫描器。 检查开放端口、防火墙规则、SSH 配置和恶意软件持久化 —— 无需安装 agent。 ## 安装 ``` pip install serverscout ``` ## CLI 用法 ``` serverscout --host 1.2.3.4 --key ~/.ssh/id_rsa serverscout --host 1.2.3.4 --password mypass ``` ## Python 用法 ``` from serverscout import scan results = scan([ {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"}, {"host": "5.6.7.8", "password": "mypass"}, ]) ``` 禁用 Rich 输出并自行处理结果： ``` results = scan(servers, report=False) for host, data in results.items(): if data["status"] == "error": print(f"{host}: connection failed — {data['error']}") continue criticals = [ msg for section in data["results"].values() for severity, msg in section if severity == "critical" ] if criticals: print(f"{host}: {len(criticals)} critical issues") ``` ## 并行扫描 ``` from serverscout import scan from concurrent.futures import ThreadPoolExecutor servers = [{"host": f"10.0.0.{i}", "key": "~/.ssh/id_rsa"} for i in range(1, 20)] with ThreadPoolExecutor(max_workers=10) as executor: futures = [executor.submit(scan, [s], report=False) for s in servers] results = {} for f in futures: results.update(f.result()) ``` ## 检查内容 | 类别 | 检查项 | |---|---| | 端口 | 暴露在互联网上的危险端口（Redis、Postgres、MongoDB 等） | | 防火墙 | iptables/nftables 规则、fail2ban | | SSH 配置 | Root 登录、密码认证、空密码、X11 转发 | | 持久化 | /tmp 中的可执行文件、postgres crontab、已知恶意软件进程、可疑的外发连接 |

标签：IP 地址批量处理, Linux运维, Python, SSH, 内存分配, 安全基线检查, 安全扫描, 无后门, 时序注入, 逆向工具