審計系統---堡壘機項目之strace追蹤ssh

strace 追蹤ssh的進程ID，記錄操做的命令[其實是內核裏面記錄的東西]，進行操做日誌的Py解析達到效果。

修改ssh源碼添加訪問標誌位

源碼下載：【本文示例：openssh-7.4p1.tar.gz】

https://cloudflare.cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/

導入工程到PyCharm

ssh.c

在ubuntu上安裝openssl dev組件

 sudo apt-get install zlib1g
 sudo apt-get install zlib1g-dev
 sudo apt-get install libssl-dev

上傳軟件包到Ubuntu並解壓： 

unzip openssh-7.4p1.zip
  cd src/openssh-7.4p1/
chmod 750 ./mkinstalldirs
chmod 7500 ./configure      
  sudo ./configure --prefix=/usr/local/openssh7/
sudo make && sudo make install    【make clean 能夠清除上次的編譯結果】

登陸成功

omc@omc-virtual-machine:~/CityHunter$ python3 user_enterpoint.py 

 

audit.py

#_*_coding:utf-8_*_
import re
class AuditLogHandler(object):
    '''分析audit log日誌'''
    def __init__(self, log_file):
        self.log_file_obj = self._get_file(log_file)
    def _get_file(self,log_file):
        return open(log_file)
    def parse(self):
        cmd_list = []
        cmd_str = ''
        catch_write5_flag = False #for tab complication
        for line in self.log_file_obj:
            #print(line.split())
            line = line.split()
            try:
                pid,time_clock,io_call,char = line[0:4]
                if io_call.startswith('write(9'):
                    if char == '"\\177",':#回退
                        char = '[1<-del]'
                    if char == '"\\33OB",': #vim中下箭頭
                        char = '[down 1]'
                    if char == '"\\33OA",': #vim中下箭頭
                        char = '[up 1]'
                    if char == '"\\33OC",': #vim中右移
                        char = '[->1]'
                    if char == '"\\33OD",': #vim中左移
                        char = '[1<-]'
                    if char == '"\33[2;2R",': #進入vim模式
                        continue
                    if char == '"\\33[>1;95;0c",':  # 進入vim模式
                        char = '[----enter vim mode-----]'


                    if char == '"\\33[A",': #命令行向上箭頭
                        char = '[up 1]'
                        catch_write5_flag = True #取到向上按鍵拿到的歷史命令
                    if char == '"\\33[B",':  # 命令行向上箭頭
                        char = '[down 1]'
                        catch_write5_flag = True  # 取到向下按鍵拿到的歷史命令
                    if char == '"\\33[C",':  # 命令行向右移動1位
                        char = '[->1]'
                    if char == '"\\33[D",':  # 命令行向左移動1位
                        char = '[1<-]'

                    cmd_str += char.strip('"",')
                    if char == '"\\t",':
                        catch_write5_flag = True
                        continue
                    if char == '"\\r",':
                        cmd_list.append([time_clock,cmd_str])
                        cmd_str = ''  # 重置
                    if char == '"':#space
                        cmd_str += ' '

                if catch_write5_flag:  # to catch tab completion
                    if io_call.startswith('write(5'):
                        if io_call == '"\7",':  # 空鍵，不是空格，是回退不了就是這個鍵
                            pass
                        else:
                            cmd_str += char.strip('"",')
                        catch_write5_flag = False
            except ValueError as e:
                print("\033[031;1mSession log record err,please contact your IT admin,\033[0m",e)

        #print(cmd_list)
        for cmd in cmd_list:
            print(cmd)
        # return cmd_list

if __name__ == "__main__":
    parser = AuditLogHandler('ssh.log')
    parser.parse()

追蹤進程並寫入ssh操做到文件中

Ps: 此時機器A已經ssh登陸了機器B，這裏的2087就是它的ssh進程PID

機器A登陸後的操做命令就記錄在了ssh.log文件中了

omc@omc-virtual-machine:~$ sudo strace -f -p 2087 -ttt -o /home/omc/ssh.log

追蹤到的ssh操做文件的解析：

omc@omc-virtual-machine:~/CityHunter/backend$ cd /home/omc/CityHunter/backend
omc@omc-virtual-machine:~/CityHunter/backend$ vim audit.py
omc@omc-virtual-machine:~/CityHunter/backend$ cp /home/omc/ssh.log ./  [複製文件到當前目錄]
omc@omc-virtual-machine:~/CityHunter/backend$ python3 audit.py