PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce SAC git URL when updating ssh-monitor agents (0.20.8)

Browse Source 
Pass REPO_URL/GIT_BRANCH from agent settings over SSH, preflight git remotes on stale hosts, and stop using GitHub origin on routers.
This commit is contained in:
PTah
2026-06-20 19:28:14 +10:00
parent 115289ef35
commit ec5ec62240
6 changed files with 68 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/v1/hosts.py
+2 -1
View File
@@ -415,10 +415,11 @@ def update_host_agent_via_ssh(
agent_cfg = get_effective_agent_update_config(db)
repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
branch = (agent_cfg.git_branch or "main").strip() or "main"
response = _run_ssh_action_on_host(
host,
cfg,
action=partial(run_ssh_monitor_update, repo_url=repo_url),
action=partial(run_ssh_monitor_update, repo_url=repo_url, git_branch=branch),
)
_set_ssh_admin_status(host, response.ok)
if response.ok and response.product_version:
backend/app/services/agent_update.py
+10 -1
View File
@@ -146,6 +146,7 @@ def run_linux_agent_update_fallback(
cfg_linux,
*,
repo_url: str | None = None,
git_branch: str | None = None,
) -> tuple[bool, str, str | None]:
if not is_linux_host(host):
return False, "Host is not Linux", None
@@ -160,12 +161,14 @@ def run_linux_agent_update_fallback(
return False, str(exc), None
effective_repo = (repo_url or "").strip() or None
effective_branch = (git_branch or "main").strip() or "main"
for target in targets:
result = run_ssh_monitor_update(
target=target,
user=cfg_linux.user,
password=cfg_linux.password,
repo_url=effective_repo,
git_branch=effective_branch,
)
last_message = result.message
if result.ok:
@@ -217,7 +220,13 @@ def execute_agent_update_fallback(db: Session, host: Host) -> tuple[bool, str, s
linux_cfg = get_effective_linux_admin_config(db)
agent_cfg = get_effective_agent_update_config(db)
repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
ok, message, version = run_linux_agent_update_fallback(host, linux_cfg, repo_url=repo_url)
branch = (agent_cfg.git_branch or "main").strip() or "main"
ok, message, version = run_linux_agent_update_fallback(
host,
linux_cfg,
repo_url=repo_url,
git_branch=branch,
)
elif product == PRODUCT_RDP or is_windows_host(host):
win_cfg = get_effective_win_admin_config(db)
ok, message, version = run_windows_agent_update_fallback(host, win_cfg, cfg.win_agent_update_script)
backend/app/services/ssh_connect.py
+42 -5
View File
@@ -274,18 +274,46 @@ def probe_ssh_monitor_version(
return None
def _ssh_monitor_bootstrap_command(repo_url: str) -> str:
def _ssh_monitor_preflight_git_remote(repo_url: str) -> str:
"""Align clone remotes with SAC-trusted URL (works even before updater script is refreshed)."""
safe_repo = _shell_single_quote(repo_url.strip())
repo_dir = _shell_single_quote(f"{SSH_MONITOR_UPDATE_DIR}/{SSH_MONITOR_REPO_NAME}")
return (
f"if [ -d {repo_dir}/.git ]; then "
f"git -C {repo_dir} remote add kalinamall {safe_repo} 2>/dev/null || "
f"git -C {repo_dir} remote set-url kalinamall {safe_repo}; "
f"if git -C {repo_dir} remote get-url origin >/dev/null 2>&1; then "
f"git -C {repo_dir} remote set-url origin {safe_repo}; "
f"fi; fi"
)
def _ssh_monitor_update_invoke_command(
repo_url: str,
*,
git_branch: str = "main",
) -> str:
"""Run installed updater with SAC-trusted git URL (overrides script default / stale origin)."""
safe_repo = _shell_single_quote(repo_url.strip())
safe_branch = _shell_single_quote((git_branch or "main").strip() or "main")
preflight = _ssh_monitor_preflight_git_remote(repo_url)
return f"{preflight}; REPO_URL={safe_repo} GIT_BRANCH={safe_branch} {SSH_MONITOR_UPDATE_SCRIPT}"
def _ssh_monitor_bootstrap_command(repo_url: str, *, git_branch: str = "main") -> str:
"""Clone ssh-monitor repo and install updater when /opt/scripts/update_ssh_monitor.sh is absent."""
safe_repo = repo_url.replace("\\", "\\\\").replace('"', '\\"')
safe_branch = (git_branch or "main").replace("\\", "\\\\").replace('"', '\\"')
return (
f'UPDATE_DIR="{SSH_MONITOR_UPDATE_DIR}";'
f'REPO_URL="{safe_repo}";'
f'GIT_BRANCH="{safe_branch}";'
f'SCRIPT_NAME="{SSH_MONITOR_REPO_NAME}";'
f'INSTALL="{SSH_MONITOR_UPDATE_SCRIPT}";'
f'mkdir -p "$UPDATE_DIR" && cd "$UPDATE_DIR" && '
f'([ -d "$SCRIPT_NAME" ] || git clone "$REPO_URL" "$SCRIPT_NAME") && '
f'([ -d "$SCRIPT_NAME" ] || git clone -b "$GIT_BRANCH" "$REPO_URL" "$SCRIPT_NAME") && '
f'cp "$UPDATE_DIR/$SCRIPT_NAME/update_ssh_monitor.sh" "$INSTALL" && '
f'chmod 750 "$INSTALL" && "$INSTALL"'
f'chmod 750 "$INSTALL" && REPO_URL="$REPO_URL" GIT_BRANCH="$GIT_BRANCH" "$INSTALL"'
)
@@ -295,9 +323,15 @@ def run_ssh_monitor_update(
user: str,
password: str,
repo_url: str | None = None,
git_branch: str | None = None,
) -> SshCommandResult:
script = SSH_MONITOR_UPDATE_SCRIPT
effective_repo = (repo_url or SSH_MONITOR_UPDATE_REPO_URL).strip()
effective_branch = (git_branch or "main").strip() or "main"
update_cmd = _ssh_monitor_update_invoke_command(
effective_repo,
git_branch=effective_branch,
)
check_cmd = f"test -x {script} && echo ready || echo missing"
probe = run_ssh_command(
target=target,
@@ -318,7 +352,10 @@ def run_ssh_monitor_update(
bootstrapped = False
if "missing" in probe.stdout:
bootstrap_cmd = _ssh_monitor_bootstrap_command(effective_repo)
bootstrap_cmd = _ssh_monitor_bootstrap_command(
effective_repo,
git_branch=effective_branch,
)
updated = run_ssh_command(
target=target,
user=user,
@@ -333,7 +370,7 @@ def run_ssh_monitor_update(
target=target,
user=user,
password=password,
remote_cmd=script,
remote_cmd=update_cmd,
command_timeout_sec=900,
need_root=True,
)
backend/app/version.py
+1 -1
View File
@@ -1,5 +1,5 @@
"""Единый источник версии SAC (API, health, логи, OpenAPI)."""
APP_NAME = "Security Alert Center"
APP_VERSION = "0.20.7"
APP_VERSION = "0.20.8"
APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"