find_remote_ssh_monitor_path output was polluted by log_action on stdout,
breaking -f checks; mirror user messages to stderr instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Restore ssh-monitor from HEAD when missing on disk; try git ls-files and
find fallback; log clone root listing on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
After git pull, copy updater from clone to DEPLOY_INSTALL_PATH and re-exec
once so cron always picks up new logging without manual cp.
Co-authored-by: Cursor <cursoragent@cursor.com>
Increase SSH monitor release version used by sac-client payloads and refresh
RU/EN README references to the new version.
Co-authored-by: Cursor <cursoragent@cursor.com>
ssh-monitor.conf.example ships dual SAC + Telegram defaults; updater
overwrites /etc/ssh-monitor.conf when UseSAC is off or SAC_API_KEY empty
or sac-client.sh is missing, with backup. Leaves configured hosts untouched.
Co-authored-by: Cursor <cursoragent@cursor.com>
After SAC_FALLBACK_FAILURES consecutive POST errors, skip SAC until
/health recovers; persist count in SAC_FAIL_COUNT_FILE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replay spool on each monitor loop; sac_post_payload refactor;
pilot-verify-exclusive.sh and --check-sac hints for exclusive mode.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health already used sac_base_url(); ingest used raw SAC_URL and got
HTTP 405 when config had only https://host without /api/v1/events.
Co-authored-by: Cursor <cursoragent@cursor.com>
Copy sac-client.sh on every git pull by checksum, not only when
ssh-monitor binary changes. Restart service when either file updates.
Co-authored-by: Cursor <cursoragent@cursor.com>
- REPO_URL points to git.kalinamall.ru
- ssh-monitor.conf may be committed here (secrets); .env still ignored
- Docs note for closed vs public GitHub
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce ENABLE_IP_BAN in config and script.
When set to 0, ssh-monitor works in monitor-only mode (alerts without ipset/iptables bans).
Made-with: Cursor
- ssh-monitor: баны через ipset (hash:ip timeout), одно правило iptables/ip6tables;
нормализация бан-листа (один IP — одна строка), версия 1.1.1-ipset.
- docs/install-prerequisites.ru.md: зависимости и установка пакетов (в т.ч. ipset).
- README: ссылка на docs, установка скрипта/systemd без дублирования apt; пометка про ipset.
- IPSET-NOTES.txt: заметки по развёртыванию ipset.
- ssh-monitor.conf.example: закомментированные переменные IPSET_*.
Made-with: Cursor
- notification_date: NOTIFY_TZ → DAILY_REPORT_TZ → date процесса
- SSH_ACCEPT_NOTIFY_DEDUP_SEC: пауза между Telegram для той же пары user+IP
- версия 0.9.5.2, README и conf.example
Made-with: Cursor
- checkpoint_stamp_init_if_bad: нет файла / битое значение → только метка «сейчас», без бэклога
- sudo/logind: убрано окно -30m при «первом» запуске (как у SSH)
- README: раздел про файлы-метки и отличие LAST_SECURITY_EVENTS_FILE
Made-with: Cursor
write_log "SAC: принято event_id=$event_id type=$event_type"
@@ -374,7 +374,7 @@ run_check_sac() {
return1
fi
if sac_send_event "agent.test""info""SAC test""ssh-monitor --check-sac";then
printf'SAC ingest agent.test: OK (ожидается HTTP 201)\n'
printf'SAC ingest agent.test: OK (ожидается HTTP 202)\n'
return0
fi
printf'SAC ingest agent.test: FAIL\n' >&2
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
PTah