PapaTramp/ssh-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enrich SAC events with session_id, tty and source_ip (2.1.4-SAC)

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
2026-06-22 10:13:40 +10:00
parent 489d071208
commit c96e870542
3 changed files with 32 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssh-monitor
+30 -4
View File
@@ -7,7 +7,7 @@ IFS=$'\n\t'
# ============================================
CONFIG_FILE="/etc/ssh-monitor.conf"
SSH_MONITOR_VERSION="2.1.3-SAC"
SSH_MONITOR_VERSION="2.1.4-SAC"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then
@@ -1316,14 +1316,14 @@ monitor_ssh() {
message="${message}👤 Пользователь: ${user}"$'\n'
message="${message}🌐 IP адрес: ${ip:-local}"$'\n'
message="${message}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
SAC_D_USER="$user" SAC_D_IP="${ip:-}" \
SAC_D_USER="$user" SAC_D_SOURCE_IP="${ip:-}" SAC_D_IP="${ip:-}" SAC_D_PORT="${dedupe_port:-}" \
notify_or_sac "ssh.login.success" "info" "Успешное SSH" "${user} с ${ip:-local}" "$message"
write_log "SSH успешный вход: $user с IP ${ip:-local}"
if [ "$user" = "root" ]; then
local rmsg=" 🔑 SSH ВХОД ПОД ROOT "$'\n'
rmsg="${rmsg}🌐 IP: ${ip:-local}"$'\n'
rmsg="${rmsg}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
SAC_D_USER="root" SAC_D_IP="${ip:-}" \
SAC_D_USER="root" SAC_D_SOURCE_IP="${ip:-}" SAC_D_IP="${ip:-}" SAC_D_PORT="${dedupe_port:-}" \
notify_or_sac "ssh.login.success" "warning" "SSH вход под root" "root с ${ip:-local}" "$rmsg"
fi
fi
@@ -1457,8 +1457,11 @@ monitor_sudo() {
[[ -n "$fp" && -n "${SUDO_DEDUP_BATCH[$fp]:-}" ]] && continue
[[ -n "$fp" ]] && SUDO_DEDUP_BATCH[$fp]=1
local user sudo_cmd pwd run_as
local user sudo_cmd pwd run_as sudo_tty=""
parse_sudo_audit_line "$line" user sudo_cmd pwd run_as
if [[ "$line" =~ TTY=([^[:space:];]+) ]]; then
sudo_tty="${BASH_REMATCH[1]}"
fi
if [ -n "$user" ] && [ -n "${sudo_cmd:-}" ]; then
local message=" ⚠️ ИСПОЛЬЗОВАНИЕ SUDO "$'\n'
@@ -1471,6 +1474,7 @@ monitor_sudo() {
message="${message}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
local sac_summary="${user}: ${sudo_cmd}"
SAC_D_USER="$user" SAC_D_COMMAND="$sudo_cmd" SAC_D_RUN_AS="${run_as:-}" SAC_D_PWD="${pwd:-}" \
SAC_D_TTY="${sudo_tty:-}" \
notify_or_sac "privilege.sudo.command" "warning" "Использование sudo" "$sac_summary" "$message"
write_log "SUDO: $user выполнил $sudo_cmd${run_as:+ (USER=$run_as)}"
fi
@@ -1549,6 +1553,27 @@ monitor_security_events() {
# Локальные сессии (systemd-logind, journalctl)
# ============================================
enrich_sac_logind_session_details() {
local sid="$1"
[ -n "$sid" ] || return 0
SAC_D_SESSION_ID="$sid"
command -v loginctl >/dev/null 2>&1 || return 0
local tty remote since
tty=$(loginctl show-session "$sid" -p TTY --value 2>/dev/null || true)
remote=$(loginctl show-session "$sid" -p RemoteHost --value 2>/dev/null || true)
since=$(loginctl show-session "$sid" -p Timestamp --value 2>/dev/null || true)
if [ -n "$tty" ] && [ "$tty" != "n/a" ]; then
SAC_D_TTY="$tty"
case "$tty" in pts/*) SAC_D_PTS="${tty#pts/}" ;; esac
fi
if [ -n "$remote" ] && [ "$remote" != "n/a" ]; then
SAC_D_SOURCE_IP="$remote"
fi
if [ -n "$since" ]; then
SAC_D_SINCE="$since"
fi
}
# Возврат 0 = не слать Telegram по logind (дубль с monitor_ssh): Type=ssh или Service=*sshd*.
# Пустой ответ loginctl — короткие повторы (гонка с journal).
logind_session_is_ssh_duplicate_for_notify() {
@@ -1645,6 +1670,7 @@ monitor_logind() {
msg="${msg}👤 Пользователь: ${user:-неизвестно}"$'\n'
msg="${msg}🆔 Сессия: ${sid:-?}"$'\n'
msg="${msg}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
enrich_sac_logind_session_details "$sid"
SAC_D_USER="${user:-}" \
notify_or_sac "session.logind.new" "info" "Новая сессия logind" "${user:-?} sid=${sid:-?}" "$msg"
write_log "LOGIND: новая сессия: ${line}"