移除 SSH 登录事件中的登录方法字段

This commit is contained in:
dushixiang committed 2026-01-11 10:14:48 +08:00
1 parent 692f2e8f34
commit 602a36df01
8 files changed
+12 -54

No files matched your search

+1 -2
View File
@@ -7,8 +7,7 @@ type SSHLoginEvent struct {
Username string `gorm:"index" json:"username"` // 用户名
IP string `gorm:"index" json:"ip"` // 来源IP
Port string `json:"port,omitempty"` // 来源端口
Status string `gorm:"index" json:"status"` // 状态: success/failed
Method string `json:"method,omitempty"` // 认证方式: password/publickey
Status string `gorm:"index" json:"status"` // 状态: success
TTY string `json:"tty,omitempty"` // 终端
SessionID string `json:"sessionId,omitempty"` // 会话ID
Timestamp int64 `gorm:"index" json:"timestamp"` // 登录时间(毫秒时间戳)
-1
View File
@@ -701,7 +701,6 @@ type SSHLoginEvent struct {
Port string `json:"port,omitempty"` // 来源端口
Timestamp int64 `json:"timestamp"` // 登录时间(毫秒时间戳)
Status string `json:"status"` // success/failed
Method string `json:"method,omitempty"` // 认证方式: password/publickey
TTY string `json:"tty,omitempty"` // 终端
SessionID string `json:"sessionId,omitempty"` // 会话ID
}
+1 -2
View File
@@ -144,7 +144,6 @@ func (s *SSHLoginService) HandleEvent(ctx context.Context, agentID string, event
IP: eventData.IP,
Port: eventData.Port,
Status: eventData.Status,
Method: eventData.Method,
TTY: eventData.TTY,
SessionID: eventData.SessionID,
Timestamp: eventData.Timestamp,
@@ -201,7 +200,7 @@ func (s *SSHLoginService) sendLoginSuccessNotification(agentID string, eventData
AgentID: agentID,
AgentName: agent.Name,
AlertType: "ssh_login",
Message: fmt.Sprintf("SSH登录成功:用户 %s,来源 %s,方式 %s,终端 %s,会话 %s", eventData.Username, sourceAddr, eventData.Method, eventData.TTY, eventData.SessionID),
Message: fmt.Sprintf("SSH登录成功:用户 %s,来源 %s,终端 %s,会话 %s", eventData.Username, sourceAddr, eventData.TTY, eventData.SessionID),
Threshold: 0,
ActualValue: 0,
Level: "warning",
+1 -13
View File
@@ -925,22 +925,10 @@ func (a *Agent) sshLoginEventLoop(ctx context.Context, conn *safeConn, done chan
case <-ctx.Done():
return
case event := <-eventCh:
// 转换为 protocol 结构
eventData := protocol.SSHLoginEvent{
Username: event.Username,
IP: event.IP,
Port: event.Port,
Timestamp: event.Timestamp,
Status: event.Status,
Method: event.Method,
TTY: event.TTY,
SessionID: event.SessionID,
}
// 上报到服务端
if err := conn.WriteJSON(protocol.OutboundMessage{
Type: protocol.MessageTypeSSHLoginEvent,
Data: eventData,
Data: event,
}); err != nil {
slog.Warn("发送SSH登录事件失败", "error", err)
} else {
-13
View File
@@ -1,13 +0,0 @@
package sshmonitor
// SSHLoginEvent SSH登录事件(内部结构)
type SSHLoginEvent struct {
Username string `json:"username"`
IP string `json:"ip"`
Port string `json:"port,omitempty"`
Timestamp int64 `json:"timestamp"`
Status string `json:"status"`
Method string `json:"method,omitempty"`
TTY string `json:"tty,omitempty"`
SessionID string `json:"sessionId,omitempty"`
}
+5 -4
View File
@@ -7,6 +7,8 @@ import (
"strconv"
"strings"
"time"
"github.com/dushixiang/pika/internal/protocol"
)
// SendEventFromEnv 从 PAM 环境变量构建并发送事件
@@ -19,7 +21,7 @@ func SendEventFromEnv() error {
}
// BuildEventFromEnv 从 PAM 环境变量构建事件
func BuildEventFromEnv() SSHLoginEvent {
func BuildEventFromEnv() protocol.SSHLoginEvent {
now := time.Now().UnixMilli()
username := os.Getenv("PAM_USER")
@@ -48,20 +50,19 @@ func BuildEventFromEnv() SSHLoginEvent {
ip = "localhost"
}
return SSHLoginEvent{
return protocol.SSHLoginEvent{
Username: username,
IP: ip,
Port: port,
Timestamp: now,
Status: "success",
Method: "unknown",
TTY: tty,
SessionID: strconv.Itoa(os.Getpid()),
}
}
// SendEvent 发送事件到本地 socket
func SendEvent(event SSHLoginEvent) error {
func SendEvent(event protocol.SSHLoginEvent) error {
addr := &net.UnixAddr{
Name: DefaultSocketPath,
Net: "unixgram",
+4 -4
View File
@@ -28,7 +28,7 @@ type Monitor struct {
listener *net.UnixConn
ctx context.Context
cancel context.CancelFunc
eventCh chan SSHLoginEvent
eventCh chan protocol.SSHLoginEvent
hookManager *HookManager
}
@@ -37,7 +37,7 @@ func NewMonitor() *Monitor {
return &Monitor{
enabled: false,
socketPath: DefaultSocketPath,
eventCh: make(chan SSHLoginEvent, 100),
eventCh: make(chan protocol.SSHLoginEvent, 100),
hookManager: NewHookManager(),
}
}
@@ -124,7 +124,7 @@ func (m *Monitor) stopInternal() error {
}
// GetEvents 获取事件通道
func (m *Monitor) GetEvents() <-chan SSHLoginEvent {
func (m *Monitor) GetEvents() <-chan protocol.SSHLoginEvent {
return m.eventCh
}
@@ -178,7 +178,7 @@ func (m *Monitor) readLoop() {
continue
}
var event SSHLoginEvent
var event protocol.SSHLoginEvent
if err := json.Unmarshal(buf[:n], &event); err != nil {
slog.Warn("解析SSH登录事件失败", "error", err)
continue
@@ -76,21 +76,6 @@ const SSHLoginEvents: React.FC<SSHLoginEventsProps> = ({agentId}) => {
hideInSearch: true,
render: (_, record) => record.port || '-',
},
{
title: '认证方式',
dataIndex: 'method',
key: 'method',
width: 120,
hideInSearch: true,
render: (_, record) => (
record.method ? (
<Tooltip
title={record.method === 'password' ? '密码认证' : record.method === 'publickey' ? '公钥认证' : record.method}>
<Tag>{record.method}</Tag>
</Tooltip>
) : '-'
),
},
{
title: 'TTY',
dataIndex: 'tty',