feat: UseSAC sac-client.sh and --check-sac

ssh-monitor

@@ -9,6 +9,18 @@ IFS=$'\n\t'
 CONFIG_FILE="/etc/ssh-monitor.conf"
 SSH_MONITOR_VERSION="1.1.3-server-label"
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then
+ # shellcheck source=sac-client.sh
+ source "$SCRIPT_DIR/sac-client.sh"
+else
+ sac_normalize_mode() { printf '%s' "${1:-off}" | tr '[:upper:]' '[:lower:]'; }
+ sac_is_configured() { return 1; }
+ sac_check_health() { return 1; }
+ notify_or_sac() { notify_send "${5:-$4}"; }
+ run_check_sac() { printf 'sac-client.sh не найден\n' >&2; return 1; }
+fi
+
 TELEGRAM_BOT_TOKEN=""
 TELEGRAM_CHAT_ID=""
 BACKUP_WEBHOOK_URL=""
@@ -17,6 +29,15 @@ BACKUP_WEBHOOK_URL=""
 # Пусто = авто: только настроенные каналы, порядок telegram → email.
 NOTIFY_ORDER=""
 
+# Security Alert Center: off | exclusive | dual | fallback
+UseSAC="off"
+SAC_URL=""
+SAC_API_KEY=""
+SAC_SPOOL_DIR="/var/lib/ssh-monitor/sac-spool"
+SAC_TIMEOUT_SEC="12"
+SAC_SEND_HEARTBEAT="1"
+SAC_FALLBACK_FAILURES="5"
+
 # Почта (SMTP через python3). Нужны MAIL_SMTP_HOST, MAIL_FROM, MAIL_TO.
 MAIL_SMTP_HOST=""
 MAIL_SMTP_PORT="587"
@@ -192,6 +213,11 @@ load_config() {
  local cfg_whitelist_ips_csv="${default_whitelist_ips_csv}"
  local cfg_whitelist_subnets_csv="${default_whitelist_subnets_csv}"
  local cfg_notify_order="${NOTIFY_ORDER:-}"
+ local cfg_use_sac="${UseSAC:-off}"
+ local cfg_sac_url="${SAC_URL:-}"
+ local cfg_sac_api_key="${SAC_API_KEY:-}"
+ local cfg_sac_spool_dir="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
+ local cfg_sac_timeout_sec="${SAC_TIMEOUT_SEC:-12}"
  local cfg_mail_smtp_host="${MAIL_SMTP_HOST:-}"
  local cfg_mail_smtp_port="${MAIL_SMTP_PORT:-587}"
  local cfg_mail_smtp_user="${MAIL_SMTP_USER:-}"
@@ -254,6 +280,11 @@ load_config() {
  csv_to_array "$whitelist_subnets_csv" WHITELIST_SUBNETS
 
  NOTIFY_ORDER="$(trim_value "${NOTIFY_ORDER:-$cfg_notify_order}")"
+ UseSAC="$(trim_value "${UseSAC:-$cfg_use_sac}")"
+ SAC_URL="$(trim_value "${SAC_URL:-$cfg_sac_url}")"
+ SAC_API_KEY="$(trim_value "${SAC_API_KEY:-$cfg_sac_api_key}")"
+ SAC_SPOOL_DIR="$(trim_value "${SAC_SPOOL_DIR:-$cfg_sac_spool_dir}")"
+ SAC_TIMEOUT_SEC="$(trim_value "${SAC_TIMEOUT_SEC:-$cfg_sac_timeout_sec}")"
  MAIL_SMTP_HOST="$(trim_value "${MAIL_SMTP_HOST:-$cfg_mail_smtp_host}")"
  MAIL_SMTP_PORT="${MAIL_SMTP_PORT:-$cfg_mail_smtp_port}"
  MAIL_SMTP_USER="$(trim_value "${MAIL_SMTP_USER:-$cfg_mail_smtp_user}")"
@@ -357,8 +388,31 @@ validate_config() {
  exit 1
  fi
  fi
+ local sac_mode
+ sac_mode="$(sac_normalize_mode "${UseSAC:-off}")"
+ case "$sac_mode" in
+ off) ;;
+ exclusive | dual | fallback)
+ if ! sac_is_configured; then
+ printf '%s\n' "UseSAC=${sac_mode}: задайте SAC_URL и SAC_API_KEY" >&2
+ exit 1
+ fi
+ ;;
+ *)
+ printf '%s\n' "Неверный UseSAC=\"${UseSAC:-}\"" >&2
+ exit 1
+ ;;
+ esac
+
  refresh_notify_chain
- if [ "${#NOTIFY_CHAIN[@]}" -eq 0 ]; then
+ if [ "$sac_mode" = "exclusive" ]; then
+ if [ "${CHECK_CONFIG_ONLY:-0}" != "1" ] && [ "${CHECK_SAC_ONLY:-0}" != "1" ] && [ "${DRY_RUN:-0}" != "1" ]; then
+ if ! sac_check_health; then
+ printf '%s\n' 'UseSAC=exclusive: SAC /health недоступен' >&2
+ exit 1
+ fi
+ fi
+ elif [ "${#NOTIFY_CHAIN[@]}" -eq 0 ]; then
  printf '%s\n' 'Не настроен ни один канал отправки оповещений' >&2
  exit 1
  fi
@@ -1868,6 +1922,8 @@ run_check_config() {
   "${MAIL_SMTP_STARTTLS:-}" "${MAIL_SMTP_SSL:-}"
  printf 'MAIL_SMTP_USER: %s\n' "$([ -n "${MAIL_SMTP_USER:-}" ] && echo задан || echo не задан)"
  printf 'MAIL_SMTP_PASSWORD: %s\n' "$([ -n "${MAIL_SMTP_PASSWORD:-}" ] && echo задан || echo не задан)"
+ printf 'UseSAC=%s SAC_URL=%s SAC_API_KEY=%s\n' "${UseSAC:-off}" "${SAC_URL:-}" \
+  "$([ -n "${SAC_API_KEY:-}" ] && echo задан || echo не задан)"
  if bash -n "$0" 2>/dev/null; then
  printf 'bash -n: OK\n'
  else
@@ -1881,6 +1937,7 @@ parse_args() {
  for a in "$@"; do
  case "$a" in
  --check-config) CHECK_CONFIG_ONLY=1 ;;
+ --check-sac) CHECK_SAC_ONLY=1 ;;
  --dry-run) DRY_RUN=1 ;;
  esac
  done
@@ -1900,6 +1957,11 @@ if [ "$CHECK_CONFIG_ONLY" = "1" ]; then
  exit $?
 fi
 
+if [ "${CHECK_SAC_ONLY:-0}" = "1" ]; then
+ run_check_sac
+ exit $?
+fi
+
 trap send_shutdown_notification EXIT INT TERM
 
 mkdir -p "$(dirname "$LOG_FILE")"