Сайт под защитой
6 Настройки
Имя ФамилияВыйтиRU Помощь

Cостояние системы

Помимо поиска троянов также следует:
  • проверить, нет ли запущенных подозрительных процессов на сервере;
  • проверить, нет ли посторонних заданий в crontab;
  • нет ли посторонних ssh-ключей.

> whoami

bitrix

> ps ux -u `whoami`

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
bitrix   2100955  1.0  0.3  46444 25016 ?        S    16:53   2:14 nginx: worker process
bitrix   2100956  0.9  0.3  46444 24952 ?        S    16:53   1:59 nginx: worker process
bitrix   2100957  0.9  0.3  46444 25008 ?        S    16:53   1:58 nginx: worker process
bitrix   2100958  0.9  0.3  46188 24724 ?        S    16:53   2:06 nginx: worker process
bitrix   2110228  8.8  2.9 1370692 239956 ?      S    20:18   0:35 /usr/sbin/httpd -DFOREGROUND
bitrix   2110441 10.0  2.1 1370716 175464 ?      S    20:23   0:10 /usr/sbin/httpd -DFOREGROUND
bitrix   2110457 10.1  2.0 1369332 166656 ?      S    20:24   0:09 /usr/sbin/httpd -DFOREGROUND
bitrix   2110462  9.7  1.8 1371776 151524 ?      S    20:24   0:05 /usr/sbin/httpd -DFOREGROUND
bitrix   2110580 10.1  1.8 1374476 149804 ?      S    20:25   0:03 /usr/sbin/httpd -DFOREGROUND
bitrix   2110581 10.4  1.8 1369404 148320 ?      S    20:25   0:03 /usr/sbin/httpd -DFOREGROUND
bitrix   2110582 10.7  1.7 1372532 144136 ?      S    20:25   0:03 /usr/sbin/httpd -DFOREGROUND
bitrix   2110590  0.0  0.0   7060  3208 ?        R    20:25   0:00 ps ux -u bitrix

> crontab -l

# Jobs moved to /etc/crontab

> last -i `whoami`

bitrix   pts/0        46.159.116.161   Tue Oct 27 12:10 - 14:13  (02:03)
bitrix   pts/1        46.158.121.179   Wed Oct 21 11:09 - 11:50  (00:41)
bitrix   pts/1        46.158.121.179   Wed Oct 21 09:56 - 10:22  (00:25)
bitrix   pts/0        46.158.121.179   Tue Oct 20 09:36 - 10:38  (01:01)
bitrix   pts/0        46.158.121.179   Mon Oct 19 11:34 - 11:51  (00:17)

wtmp begins Thu Oct 15 09:26:20 2026

> cat ~/.bashrc

# .bashrc

# Source global definitions
if [ -f /etc/bashrc ]; then
	. /etc/bashrc
fi

# User specific environment
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]
then
    PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH

# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=

# User specific aliases and functions
if [ -d ~/.bashrc.d ]; then
	for rc in ~/.bashrc.d/*; do
		if [ -f "$rc" ]; then
			. "$rc"
		fi
	done
fi

unset rc

> stat ~/.bashrc

  File: /home/bitrix/.bashrc
  Size: 492       	Blocks: 8          IO Block: 4096   regular file
Device: fd03h/64771d	Inode: 138412747   Links: 1
Access: (0644/-rw-r--r--)  Uid: (  600/  bitrix)   Gid: (  600/  bitrix)
Access: 2026-11-11 17:39:31.401125176 +0300
Modify: 2024-04-30 17:14:04.000000000 +0300
Change: 2026-10-15 09:28:49.492499730 +0300
 Birth: 2026-10-15 09:28:49.492499730 +0300

> cat ~/.ssh/authorized_keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBE8kG0EfvUFfNZApbbbohlTpzpvANo1Gm37zLH6MxFG9qm8rApxZ/c3hrx7INEH9YsYmUOXcGnI+QW94eMjNXtTryWn5V3rUWKqoXiblvArum892XS1Pvd7EKADBQS+Y4aC5W75zjLbA/5IFPINmdzfyDPrJYGoNWdJXsEiWlJMbwvu7RgQ0lBgwF5vJ5+5iE1xSxQr7zRM8S65TA0dI2sfBDxslnnkw3UIds60AOeWZgqu2rEqDPRxO+Y19We/5RpBlv72d7Os9T4TJGx8vRK2n3iIDCNafqvRnjCgscrdzC1atoc7b9tLLZCbBOsH7xPV48BAnD4hG9fl9cfjRr gitlab-runner@git.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWBj5z1qHWJMAH0kul4OKbwAoZgf0/4ipYhME2mZ6YRAADN9cTkyKr2w9ZIuX0mVptN7xgJbN9My2mnjpFqmWieXrAN+PBmmO/tT+vtzZTGG+dUnjXirAkE9YF/WEGvXw+j/1Ze47im1AHhXT9C3yHI7CD9ac1GqRLitofIkTz80xTMvQrWVxLa1tNvro+rtlKlBIp5jN9y0EyMpa3Ipn4jvh1NOEUMVVlwqUwU1wf+a9Wx1WDw6Do4LneS8sy9tqEaY3uBniSk/2LS32kX2yUR3ABP4MFfbUc1KmzwfGowNQzdMdiC1MfCq4kG8oBWM5duda3X24Cgxxy5x6PvPFj adminka@ansible.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm8UKWDUnUMINQsr76HsSqu1WnKPKinbmbydCaZVi4oxLZxwMpMIVUGrgJuKX+M7FGZ4+NfroxaLH83TyrSbKQ3OokKdF87nO61tQYq6w9uBUrye5jiv819YgK49CeQmvnXy48Cmb7z6j8EMM70eSvHHCRFKPZkKAqAAH/S8Bt50nPhI89bgz9Ou4RL1WAjlP06WuXzDdwhixV5Uiem4tnqU5XN0RnqWnIIkB9a+chWpia9UE8Ar8m57z6E2EKEn67a8GYq9tzht92+YSbAfn1hxpTXr/fiTdju+t3zLResOiZzh485Ge+NyXnuKv8CP8eCMvbcRLLnzQThNHsdn7OsGdmlkWy+vkz/khwE1rVDYRjqKYyvel6xG0PfH+WbBmbp6r1lyAZm81sGvxds4whK8488w54mCHQ4SdBdw6eyREFbJF4KG03ruMiqCmBWBCzURWQvkZn+3krgdY5kEZ0Gpv0ra5nGcaOGcGgibkzADH88H8HGF5yNml32TTQAVE= tumerov@gmail.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNj85F84SDfkvLoCEqTrYqkbGyulyWGKHLolGRp1KX0Hcu8lTxcpuBNC2YEER21FRMVW2P/O395UGDZN4ApkScRpv4FMide5YH6jBlos/eD5CeWnwC8R2ftwNbALHcJB3e37qmdRwWkapZggRmTOiQtQLzAynM3UXuXVWOLYZKY7RU4A+CCBbZvwDaKvVzi6UwOFcJk5zmb3/pIhMznJrseAu3qr4Os8HHuM8aYHCHZp9mYuyq38ByeiOV+FnYYt5uxPA82x1iNW3+UR4bB2hsrSrq14YDiNogDvmf0XeDKMmICm7J5gQB9Pn4h9yBeqFTpoMN5cfCjdTD70BUYQ/dvu209az0saYRQILnS55Yp9NWdmnceXK0wVnAZ76vxekyykZoGPojQ5HLASdqr0qgElX6Ausy5+BoLEE06bHvz9wQI92pDVeRNRoZRC0wMv0/0s4ksrzi1YDYE1WBCMWbZ8dZytKZQRgPfvjxV1l7yxHxPgdHl6Ws5jT0a2Iy/z8= dmitriev@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNT6eo6Um6boPiRC8/ReQv4sOwMu4S+Ib+gXzrrE/N9hOZXDXFAtAWKuwv8NZWfsQx6DFjMppa3RyN2DEhhzvE+CEfqSyrBaVYXbhi5nIChRNtFLzSf97zMJ9F7y23X2rNoullI6YSLBhNM9PnovG3xXwgzb8mh84FbIct1TgKsOfEkHwgB77Zc1eKUgmGElsF5rJt+cBTNm9tQAXdGjEH86fc4d2WxFYKas3nTOMAIFEIfNhaqXP3UVJv2osfBVafFJIuN7QEmbfXgHuT0qWVO4mXC8eCbLTkcukdPtWyr2RNzcD7YT87RYVlOlUdAWjM4jOF1HsaYpjQj0tnzyrXd423dyTfltgouQXsjYqF3HPasG2kfm77MWff01Hy2d5O0ZZ/BHSm4zgiSESQ6wpcKiGYcl+24i6xvDZP4hTo4VDDGUKcZh3o7m2u+hWw4Zeq/cBclx/7wJ2tMgueH/JPnAiUz3a8wdW7Y9qJazqGbIXohSENaDYKs828e+Yl+dE= shuvalov@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDN/kd2fVsgRSGoEyvBO9m6OP/2rUSt3fJbuzIwlZChU6C5NjAmGNg8MxDe62vItkrMyFZ9DUo502T5DMedodEhoBFMd5o1PMw7gVXC3AVhxr2FYE+8HnoiqH1EHQNW4SzlH9H/EiJ/0sYpER2Qc3qiQX+6Hm3Z1EMskKzp9QWUVaGA5bqpOFALvibbgG4T7i/9Jko63XYdAYa3JGRnTQ4NuUOqwgtksCehu3QcgFVjo6x+YCT5DxPBXs9htKbTFGkDvFTgQ1u/PmT602vw+mj2PNLfcI2oiE5vBXSRQg6nzTpVErFLOnmRIDpjqI9qxte3l15V5bbcCJmBbbfKwNbePK/K5aY0uFeCJ5plaR4IF1L4860dbvZjNVh/BTO6Lo8D81jhiswMDlGhShsYIP49tqgaOrR8eA2oc+dyQeDCSpurWkdy5DVYGtcb/RgExX3UoSsiAoXv/gO9r1YwHQngEvj5I+0wivnOxM6rXEZUXdOxIg/+hbLR2+uFGvqtyC0= stepanov@o2k.ru

> stat ~/.ssh/authorized_keys

  File: /home/bitrix/.ssh/authorized_keys
  Size: 3088      	Blocks: 8          IO Block: 4096   regular file
Device: fd03h/64771d	Inode: 114317332   Links: 1
Access: (0644/-rw-r--r--)  Uid: (  600/  bitrix)   Gid: (  600/  bitrix)
Access: 2026-11-11 17:39:31.403125145 +0300
Modify: 2026-07-03 08:01:23.872782118 +0300
Change: 2026-10-15 13:45:16.568481814 +0300
 Birth: 2026-10-15 13:45:16.568481814 +0300


Эта установка предназначена для разработки на базе продукта "1С-Битрикс: Управление сайтом". Она не должна использоваться в качестве рабочего (боевого) сайта.