From afa80d169fc15940ed7db8a11879afa40ae724be Mon Sep 17 00:00:00 2001 From: PTah Date: Wed, 17 Jun 2026 11:12:59 +1000 Subject: [PATCH] chore(github): keep sanitized settings on public main Production tokens and NETLOGON paths live on kalinamall/papatramp only. Use scripts/Push-PrivateMirror.ps1 after feature pushes. Co-authored-by: Cursor --- exchange_monitor.settings.example.ps1 | 10 ++++---- login_monitor.settings.example.ps1 | 19 ++++++++------- update-rdp-monitor.ps1 | 33 ++++++++------------------- 3 files changed, 24 insertions(+), 38 deletions(-) diff --git a/exchange_monitor.settings.example.ps1 b/exchange_monitor.settings.example.ps1 index f0fdcc3..f276584 100644 --- a/exchange_monitor.settings.example.ps1 +++ b/exchange_monitor.settings.example.ps1 @@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150 # --- Пилот VIP (рекомендуется для первого запуска) --- # $VipMailboxesOnly = $true # $VipMailboxes = @( -# 'director@kalinamall.ru', -# 'cfo@kalinamall.ru' +# 'director@example.com', +# 'cfo@example.com' # ) # $VipMailboxPatterns = @( -# '*@kalinamall.ru' # опционально: все ящики домена из Get-Mailbox +# '*@example.com' # опционально: все ящики домена из Get-Mailbox # ) # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам @@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150 # $SendInboxScanSummary = $true # Удалённый EMS (если скрипт не на Exchange) -# $ExchangeServerFqdn = 'fifth.kalinamall.ru' +# $ExchangeServerFqdn = 'mail.example.com' # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule) # $SkipInboxScanMailboxes = @( -# 'k.selezneva@kalinamall.ru' +# 'k.selezneva@example.com' # ) diff --git a/login_monitor.settings.example.ps1 b/login_monitor.settings.example.ps1 index cc75e58..e348d68 100644 --- a/login_monitor.settings.example.ps1 +++ b/login_monitor.settings.example.ps1 @@ -9,9 +9,8 @@ #> # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) --- -# Закрытое зеркало Gitea — доверенный инстанс; в публичном GitHub используйте example без секретов. -$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I' -$TelegramChatID = '2843230' +$TelegramBotToken = 'YOUR_BOT_TOKEN' +$TelegramChatID = 'YOUR_CHAT_ID' # $TelegramBotTokenProtectedB64 = '' # $TelegramChatIDProtectedB64 = '' @@ -30,13 +29,13 @@ $NotifyOrder = 'tg' # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME --- # $ServerDisplayName = 'UNMS Kalina' # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) --- -# $ServerIPv4 = '192.168.160.57' +# $ServerIPv4 = '10.0.0.10' # --- Security Alert Center (SAC) --- # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md $UseSAC = 'fallback' -$SacUrl = 'https://sac.kalinamall.ru' -$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8' +$SacUrl = 'https://sac.example.com' +$SacApiKey = 'sac_CHANGE_ME' # $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool' # $SacTimeoutSec = 12 # $SacTlsSkipVerify = $false @@ -66,7 +65,7 @@ $GetInventory = $true # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) --- $IgnoreAdvapiNetworkLogonSourceIps = @( - '192.168.160.57' + '10.0.0.1' ) # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) --- # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал. @@ -79,9 +78,9 @@ $MaxBackupDays = 31 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync --- # Мониторинг включается только на КД с именем $LockoutMonitorDomainController. -$LockoutMonitorDomainController = 'K6A-DC3' -$NetBiosDomainName = 'B26' -$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1' +$LockoutMonitorDomainController = 'DC01' +$NetBiosDomainName = 'CONTOSO' +$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1' $ExchangeServerHostForIisExclude = '' $ExchangeIisLogTailLines = 5000 $ExchangeIisLogMinutesBeforeLockout = 30 diff --git a/update-rdp-monitor.ps1 b/update-rdp-monitor.ps1 index 072c76b..2e3af55 100644 --- a/update-rdp-monitor.ps1 +++ b/update-rdp-monitor.ps1 @@ -4,7 +4,7 @@ .DESCRIPTION Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah). Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea. - Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd. + Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd. Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md. .EXAMPLE powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1 @@ -14,8 +14,8 @@ [CmdletBinding(SupportsShouldProcess = $true)] param( [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor', - [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor', - [string]$GitUrl = 'https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git', + [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor', + [string]$GitUrl = 'https://github.com/PTah/RDP-login-monitor.git', [string]$GitBranch = 'main', [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log', [switch]$SkipGitClean @@ -112,38 +112,25 @@ function Ensure-GitRepository { function Get-ConfiguredGitRemoteName { $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ }) if ($names.Count -eq 0) { return $null } - if ('kalinamall' -in $names) { return 'kalinamall' } - foreach ($n in $names) { - $url = (& git -C $RepoPath remote get-url $n 2>$null) - if ($url -match 'git\.kalinamall\.ru') { return $n } - } if ('origin' -in $names) { return 'origin' } return $names[0] } -function Ensure-GitKalinamallRemote { +function Ensure-GitUpstreamRemote { $name = Get-ConfiguredGitRemoteName if ($null -ne $name) { $url = (& git -C $RepoPath remote get-url $name 2>$null) - if ($url -match 'git\.kalinamall\.ru') { - Write-UpdateLog "Using remote: $name ($url)" - return $name - } - Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl" - } else { - Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl" + Write-UpdateLog "Using remote: $name ($url)" + return $name } - if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) { - Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl) - return 'kalinamall' - } - Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl) - return 'kalinamall' + Write-UpdateLog "No remotes; adding origin -> $GitUrl" + Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl) + return 'origin' } function Update-Repository { Ensure-GitRepository - $remote = Ensure-GitKalinamallRemote + $remote = Ensure-GitUpstreamRemote Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch) $upstream = "${remote}/${GitBranch}"