feat: enrich SAC events with session_id, tty and source_ip (2.1.4-SAC)

Co-authored-by: Cursor <cursoragent@cursor.com>

sac-client.sh

@@ -365,7 +365,7 @@ notify_or_sac() {
  if [ -z "$details_json" ] && [ -n "${SAC_D_USER:-}${SAC_D_IP:-}${SAC_D_COMMAND:-}" ]; then
   details_json="$(sac_build_details_json)"
  fi
- unset SAC_D_USER SAC_D_IP SAC_D_COMMAND SAC_D_ATTEMPT SAC_D_MAX SAC_D_RUN_AS SAC_D_PWD 2>/dev/null || true
+ unset SAC_D_USER SAC_D_IP SAC_D_SOURCE_IP SAC_D_PORT SAC_D_COMMAND SAC_D_ATTEMPT SAC_D_MAX SAC_D_RUN_AS SAC_D_PWD SAC_D_SESSION_ID SAC_D_TTY SAC_D_PTS SAC_D_SINCE 2>/dev/null || true
  local mode
  mode="$(sac_normalize_mode "${UseSAC:-off}")"
  local tg_via=""

ssh-monitor

@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="2.1.3-SAC"
+SSH_MONITOR_VERSION="2.1.4-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then
@@ -1316,14 +1316,14 @@ monitor_ssh() {
  message="${message}👤 Пользователь: ${user}"$'\n'
  message="${message}🌐 IP адрес: ${ip:-local}"$'\n'
  message="${message}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
- SAC_D_USER="$user" SAC_D_IP="${ip:-}" \
+ SAC_D_USER="$user" SAC_D_SOURCE_IP="${ip:-}" SAC_D_IP="${ip:-}" SAC_D_PORT="${dedupe_port:-}" \
  notify_or_sac "ssh.login.success" "info" "Успешное SSH" "${user} с ${ip:-local}" "$message"
  write_log "SSH успешный вход: $user с IP ${ip:-local}"
  if [ "$user" = "root" ]; then
  local rmsg=" 🔑 SSH ВХОД ПОД ROOT "$'\n'
  rmsg="${rmsg}🌐 IP: ${ip:-local}"$'\n'
  rmsg="${rmsg}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
- SAC_D_USER="root" SAC_D_IP="${ip:-}" \
+ SAC_D_USER="root" SAC_D_SOURCE_IP="${ip:-}" SAC_D_IP="${ip:-}" SAC_D_PORT="${dedupe_port:-}" \
  notify_or_sac "ssh.login.success" "warning" "SSH вход под root" "root с ${ip:-local}" "$rmsg"
  fi
  fi
@@ -1457,8 +1457,11 @@ monitor_sudo() {
  [[ -n "$fp" && -n "${SUDO_DEDUP_BATCH[$fp]:-}" ]] && continue
  [[ -n "$fp" ]] && SUDO_DEDUP_BATCH[$fp]=1
 
- local user sudo_cmd pwd run_as
+ local user sudo_cmd pwd run_as sudo_tty=""
  parse_sudo_audit_line "$line" user sudo_cmd pwd run_as
+ if [[ "$line" =~ TTY=([^[:space:];]+) ]]; then
+ sudo_tty="${BASH_REMATCH[1]}"
+ fi
 
  if [ -n "$user" ] && [ -n "${sudo_cmd:-}" ]; then
  local message=" ⚠️ ИСПОЛЬЗОВАНИЕ SUDO "$'\n'
@@ -1471,6 +1474,7 @@ monitor_sudo() {
  message="${message}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
  local sac_summary="${user}: ${sudo_cmd}"
  SAC_D_USER="$user" SAC_D_COMMAND="$sudo_cmd" SAC_D_RUN_AS="${run_as:-}" SAC_D_PWD="${pwd:-}" \
+ SAC_D_TTY="${sudo_tty:-}" \
  notify_or_sac "privilege.sudo.command" "warning" "Использование sudo" "$sac_summary" "$message"
  write_log "SUDO: $user выполнил $sudo_cmd${run_as:+ (USER=$run_as)}"
  fi
@@ -1549,6 +1553,27 @@ monitor_security_events() {
 # Локальные сессии (systemd-logind, journalctl)
 # ============================================
 
+enrich_sac_logind_session_details() {
+ local sid="$1"
+ [ -n "$sid" ] || return 0
+ SAC_D_SESSION_ID="$sid"
+ command -v loginctl >/dev/null 2>&1 || return 0
+ local tty remote since
+ tty=$(loginctl show-session "$sid" -p TTY --value 2>/dev/null || true)
+ remote=$(loginctl show-session "$sid" -p RemoteHost --value 2>/dev/null || true)
+ since=$(loginctl show-session "$sid" -p Timestamp --value 2>/dev/null || true)
+ if [ -n "$tty" ] && [ "$tty" != "n/a" ]; then
+  SAC_D_TTY="$tty"
+  case "$tty" in pts/*) SAC_D_PTS="${tty#pts/}" ;; esac
+ fi
+ if [ -n "$remote" ] && [ "$remote" != "n/a" ]; then
+  SAC_D_SOURCE_IP="$remote"
+ fi
+ if [ -n "$since" ]; then
+  SAC_D_SINCE="$since"
+ fi
+}
+
 # Возврат 0 = не слать Telegram по logind (дубль с monitor_ssh): Type=ssh или Service=*sshd*.
 # Пустой ответ loginctl — короткие повторы (гонка с journal).
 logind_session_is_ssh_duplicate_for_notify() {
@@ -1645,6 +1670,7 @@ monitor_logind() {
  msg="${msg}👤 Пользователь: ${user:-неизвестно}"$'\n'
  msg="${msg}🆔 Сессия: ${sid:-?}"$'\n'
  msg="${msg}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
+ enrich_sac_logind_session_details "$sid"
  SAC_D_USER="${user:-}" \
  notify_or_sac "session.logind.new" "info" "Новая сессия logind" "${user:-?} sid=${sid:-?}" "$msg"
  write_log "LOGIND: новая сессия: ${line}"

version.txt

@@ -1 +1 @@
-2.1.3-SAC
+2.1.4-SAC