Cостояние системы
Помимо поиска троянов также следует:
- проверить, нет ли запущенных подозрительных процессов на сервере;
- проверить, нет ли посторонних заданий в crontab;
- нет ли посторонних ssh-ключей.
> whoami
bitrix
> ps ux -u `whoami`
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
bitrix 2100955 1.0 0.3 46444 24940 ? S 16:53 2:03 nginx: worker process
bitrix 2100956 0.9 0.3 46188 24800 ? S 16:53 1:55 nginx: worker process
bitrix 2100957 0.9 0.3 45932 24720 ? S 16:53 1:55 nginx: worker process
bitrix 2100958 0.9 0.3 46444 24964 ? S 16:53 2:00 nginx: worker process
bitrix 2109763 9.3 3.2 1369676 259376 ? S 20:07 0:51 /usr/sbin/httpd -DFOREGROUND
bitrix 2109962 8.7 2.6 1368456 215284 ? S 20:12 0:23 /usr/sbin/httpd -DFOREGROUND
bitrix 2110151 10.4 1.8 1372544 148416 ? S 20:16 0:05 /usr/sbin/httpd -DFOREGROUND
bitrix 2110155 11.4 1.6 1368452 134048 ? S 20:16 0:04 /usr/sbin/httpd -DFOREGROUND
bitrix 2110158 10.6 0.0 0 0 ? Z 20:16 0:04 [httpd] <defunct>
bitrix 2110160 10.6 1.5 1368276 128136 ? S 20:16 0:04 /usr/sbin/httpd -DFOREGROUND
bitrix 2110162 9.3 1.7 1370368 137376 ? S 20:16 0:01 /usr/sbin/httpd -DFOREGROUND
bitrix 2110163 10.3 1.7 1371440 141724 ? S 20:16 0:01 /usr/sbin/httpd -DFOREGROUND
bitrix 2110167 9.3 1.6 1369524 133392 ? S 20:16 0:00 /usr/sbin/httpd -DFOREGROUND
bitrix 2110169 0.0 0.0 7060 3212 ? R 20:16 0:00 ps ux -u bitrix
> crontab -l
# Jobs moved to /etc/crontab
> last -i `whoami`
bitrix pts/0 46.159.116.161 Tue Oct 27 12:10 - 14:13 (02:03)
bitrix pts/1 46.158.121.179 Wed Oct 21 11:09 - 11:50 (00:41)
bitrix pts/1 46.158.121.179 Wed Oct 21 09:56 - 10:22 (00:25)
bitrix pts/0 46.158.121.179 Tue Oct 20 09:36 - 10:38 (01:01)
bitrix pts/0 46.158.121.179 Mon Oct 19 11:34 - 11:51 (00:17)
wtmp begins Thu Oct 15 09:26:20 2026
> cat ~/.bashrc
# .bashrc
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
# User specific environment
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]
then
PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=
# User specific aliases and functions
if [ -d ~/.bashrc.d ]; then
for rc in ~/.bashrc.d/*; do
if [ -f "$rc" ]; then
. "$rc"
fi
done
fi
unset rc> stat ~/.bashrc
File: /home/bitrix/.bashrc
Size: 492 Blocks: 8 IO Block: 4096 regular file
Device: fd03h/64771d Inode: 138412747 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 600/ bitrix) Gid: ( 600/ bitrix)
Access: 2026-11-11 17:39:31.401125176 +0300
Modify: 2024-04-30 17:14:04.000000000 +0300
Change: 2026-10-15 09:28:49.492499730 +0300
Birth: 2026-10-15 09:28:49.492499730 +0300
> cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBE8kG0EfvUFfNZApbbbohlTpzpvANo1Gm37zLH6MxFG9qm8rApxZ/c3hrx7INEH9YsYmUOXcGnI+QW94eMjNXtTryWn5V3rUWKqoXiblvArum892XS1Pvd7EKADBQS+Y4aC5W75zjLbA/5IFPINmdzfyDPrJYGoNWdJXsEiWlJMbwvu7RgQ0lBgwF5vJ5+5iE1xSxQr7zRM8S65TA0dI2sfBDxslnnkw3UIds60AOeWZgqu2rEqDPRxO+Y19We/5RpBlv72d7Os9T4TJGx8vRK2n3iIDCNafqvRnjCgscrdzC1atoc7b9tLLZCbBOsH7xPV48BAnD4hG9fl9cfjRr gitlab-runner@git.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWBj5z1qHWJMAH0kul4OKbwAoZgf0/4ipYhME2mZ6YRAADN9cTkyKr2w9ZIuX0mVptN7xgJbN9My2mnjpFqmWieXrAN+PBmmO/tT+vtzZTGG+dUnjXirAkE9YF/WEGvXw+j/1Ze47im1AHhXT9C3yHI7CD9ac1GqRLitofIkTz80xTMvQrWVxLa1tNvro+rtlKlBIp5jN9y0EyMpa3Ipn4jvh1NOEUMVVlwqUwU1wf+a9Wx1WDw6Do4LneS8sy9tqEaY3uBniSk/2LS32kX2yUR3ABP4MFfbUc1KmzwfGowNQzdMdiC1MfCq4kG8oBWM5duda3X24Cgxxy5x6PvPFj adminka@ansible.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm8UKWDUnUMINQsr76HsSqu1WnKPKinbmbydCaZVi4oxLZxwMpMIVUGrgJuKX+M7FGZ4+NfroxaLH83TyrSbKQ3OokKdF87nO61tQYq6w9uBUrye5jiv819YgK49CeQmvnXy48Cmb7z6j8EMM70eSvHHCRFKPZkKAqAAH/S8Bt50nPhI89bgz9Ou4RL1WAjlP06WuXzDdwhixV5Uiem4tnqU5XN0RnqWnIIkB9a+chWpia9UE8Ar8m57z6E2EKEn67a8GYq9tzht92+YSbAfn1hxpTXr/fiTdju+t3zLResOiZzh485Ge+NyXnuKv8CP8eCMvbcRLLnzQThNHsdn7OsGdmlkWy+vkz/khwE1rVDYRjqKYyvel6xG0PfH+WbBmbp6r1lyAZm81sGvxds4whK8488w54mCHQ4SdBdw6eyREFbJF4KG03ruMiqCmBWBCzURWQvkZn+3krgdY5kEZ0Gpv0ra5nGcaOGcGgibkzADH88H8HGF5yNml32TTQAVE= tumerov@gmail.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNj85F84SDfkvLoCEqTrYqkbGyulyWGKHLolGRp1KX0Hcu8lTxcpuBNC2YEER21FRMVW2P/O395UGDZN4ApkScRpv4FMide5YH6jBlos/eD5CeWnwC8R2ftwNbALHcJB3e37qmdRwWkapZggRmTOiQtQLzAynM3UXuXVWOLYZKY7RU4A+CCBbZvwDaKvVzi6UwOFcJk5zmb3/pIhMznJrseAu3qr4Os8HHuM8aYHCHZp9mYuyq38ByeiOV+FnYYt5uxPA82x1iNW3+UR4bB2hsrSrq14YDiNogDvmf0XeDKMmICm7J5gQB9Pn4h9yBeqFTpoMN5cfCjdTD70BUYQ/dvu209az0saYRQILnS55Yp9NWdmnceXK0wVnAZ76vxekyykZoGPojQ5HLASdqr0qgElX6Ausy5+BoLEE06bHvz9wQI92pDVeRNRoZRC0wMv0/0s4ksrzi1YDYE1WBCMWbZ8dZytKZQRgPfvjxV1l7yxHxPgdHl6Ws5jT0a2Iy/z8= dmitriev@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNT6eo6Um6boPiRC8/ReQv4sOwMu4S+Ib+gXzrrE/N9hOZXDXFAtAWKuwv8NZWfsQx6DFjMppa3RyN2DEhhzvE+CEfqSyrBaVYXbhi5nIChRNtFLzSf97zMJ9F7y23X2rNoullI6YSLBhNM9PnovG3xXwgzb8mh84FbIct1TgKsOfEkHwgB77Zc1eKUgmGElsF5rJt+cBTNm9tQAXdGjEH86fc4d2WxFYKas3nTOMAIFEIfNhaqXP3UVJv2osfBVafFJIuN7QEmbfXgHuT0qWVO4mXC8eCbLTkcukdPtWyr2RNzcD7YT87RYVlOlUdAWjM4jOF1HsaYpjQj0tnzyrXd423dyTfltgouQXsjYqF3HPasG2kfm77MWff01Hy2d5O0ZZ/BHSm4zgiSESQ6wpcKiGYcl+24i6xvDZP4hTo4VDDGUKcZh3o7m2u+hWw4Zeq/cBclx/7wJ2tMgueH/JPnAiUz3a8wdW7Y9qJazqGbIXohSENaDYKs828e+Yl+dE= shuvalov@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDN/kd2fVsgRSGoEyvBO9m6OP/2rUSt3fJbuzIwlZChU6C5NjAmGNg8MxDe62vItkrMyFZ9DUo502T5DMedodEhoBFMd5o1PMw7gVXC3AVhxr2FYE+8HnoiqH1EHQNW4SzlH9H/EiJ/0sYpER2Qc3qiQX+6Hm3Z1EMskKzp9QWUVaGA5bqpOFALvibbgG4T7i/9Jko63XYdAYa3JGRnTQ4NuUOqwgtksCehu3QcgFVjo6x+YCT5DxPBXs9htKbTFGkDvFTgQ1u/PmT602vw+mj2PNLfcI2oiE5vBXSRQg6nzTpVErFLOnmRIDpjqI9qxte3l15V5bbcCJmBbbfKwNbePK/K5aY0uFeCJ5plaR4IF1L4860dbvZjNVh/BTO6Lo8D81jhiswMDlGhShsYIP49tqgaOrR8eA2oc+dyQeDCSpurWkdy5DVYGtcb/RgExX3UoSsiAoXv/gO9r1YwHQngEvj5I+0wivnOxM6rXEZUXdOxIg/+hbLR2+uFGvqtyC0= stepanov@o2k.ru
> stat ~/.ssh/authorized_keys
File: /home/bitrix/.ssh/authorized_keys
Size: 3088 Blocks: 8 IO Block: 4096 regular file
Device: fd03h/64771d Inode: 114317332 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 600/ bitrix) Gid: ( 600/ bitrix)
Access: 2026-11-11 17:39:31.403125145 +0300
Modify: 2026-07-03 08:01:23.872782118 +0300
Change: 2026-10-15 13:45:16.568481814 +0300
Birth: 2026-10-15 13:45:16.568481814 +0300
Эта установка предназначена для разработки на базе продукта "1С-Битрикс: Управление сайтом". Она не должна использоваться в качестве рабочего (боевого) сайта.