看一下你的dartnote机器有没有被入侵

在你的dartnote服务器上执行

ls -al .bash_history

显示下面内容,就是有人在你小鸡上搞事情了

lrwxrwxrwx 1 root root 9 Sep 24 22:10 .bash_history -> /dev/null

那是别人为了掩盖执行过的命令,把记录文件重定向到黑洞

   3 unset HISTFILE
   4 export HISTFILE=/dev/null
   5 set +o history
   6 HIST_START=$HISTCMD
   7 find /home /root /opt /var /mnt /media /srv /data -type f \( -iname "*wallet*" -o -iname "*keystore*" -o -iname "*.dat" -o -iname "*.key" -o -iname "*.json" -o -iname "*seed*" -o -iname "*mnemonic*" -o -iname "*private*" -o -iname "*electrum*" -o -iname "*bitcoin*" -o -iname "*ethereum*" -o -iname "*monero*" -o -iname "*crypto*" \) -size +100c -size -100M 2>/dev/null
   8 find /home /root -type d \( -name ".bitcoin" -o -name ".ethereum" -o -name ".electrum" -o -name ".monero" -o -name ".config" -o -name ".local" \) -exec find {} -type f -size +100c -size -50M \; 2>/dev/null | head -100
   9 find /var/lib/docker/volumes -type f -size +100c 2>/dev/null | head -50
  10 ls -la /home/*/.bitcoin/wallet.dat /home/*/.ethereum/keystore/* /home/*/.electrum/wallets/* /root/.bitcoin/wallet.dat /root/.ethereum/keystore/* 2>/dev/null | head -50
  11 HIST_END=$HISTCMD
  12 for i in $(seq $HIST_START $HIST_END); do history -d $HIST_START; done
  13 history -c