736 lines
24 KiB
Bash
736 lines
24 KiB
Bash
#!/usr/bin/env bash
|
||
# Telegram SSH Notifications Script
|
||
# Version: 3.0.0
|
||
# Author: System Administrator
|
||
# Description: Уведомления о SSH-входах и попытках взлома через Telegram
|
||
|
||
set -euo pipefail
|
||
IFS=$'\n\t'
|
||
|
||
# ============================================================================
|
||
# CONSTANTS
|
||
# ============================================================================
|
||
readonly SCRIPT_NAME="$(basename "${0}")"
|
||
readonly SCRIPT_VERSION="3.0.0"
|
||
readonly CONFIG_FILE="/etc/telegram-ssh-notify.conf"
|
||
readonly DEFAULT_LOG_FILE="/var/log/telegram-ssh-notify.log"
|
||
readonly FAILED_LOGINS_DIR="/var/log/ssh_failed_logins"
|
||
readonly IP_CACHE_DIR="/tmp/telegram-ssh-notify-cache"
|
||
readonly LOCK_FILE="/var/run/telegram-ssh-notify.lock"
|
||
|
||
# ============================================================================
|
||
# DEFAULT CONFIGURATION (может быть переопределено в файле или env)
|
||
# ============================================================================
|
||
declare -gA CONFIG=(
|
||
[TELEGRAM_TOKEN]=""
|
||
[TELEGRAM_CHAT_ID]=""
|
||
[TELEGRAM_TOPIC_ID]=""
|
||
[MAX_ATTEMPTS_BEFORE_CRITICAL]="20"
|
||
[CRITICAL_TIME_WINDOW]="300" # секунд
|
||
[CLEANUP_DAYS]="7"
|
||
[IP_API_TIMEOUT]="3"
|
||
[ENABLE_GEOIP]="true"
|
||
[ENABLE_NOTIFICATIONS]="true"
|
||
[LOG_FILE]="${DEFAULT_LOG_FILE}"
|
||
[DEBUG]="false"
|
||
[AUTO_BLOCK_CRITICAL]="false" # автоматически блокировать IP при критической атаке
|
||
[BLOCK_COMMAND]="iptables -A INPUT -s {ip} -j DROP"
|
||
[WHITELIST_IPS]="" # разделённые пробелом IP или подсети
|
||
[BLACKLIST_IPS]="" # сразу блокировать эти IP
|
||
[RATE_LIMIT_SEC]="60" # минимальный интервал между одинаковыми уведомлениями
|
||
[USE_JOURNAL]="false" # использовать journalctl вместо файлов логов
|
||
)
|
||
|
||
# Эмодзи для сообщений
|
||
declare -gA EMOJI=(
|
||
[SUCCESS]="✅" [INFO]="ℹ️" [WARNING]="⚠️" [DANGER]="🔴" [CRITICAL]="🚨"
|
||
[FIRE]="🔥" [LOCK]="🔒" [GLOBE]="🌍" [CITY]="🏙️" [BUILDING]="🏢"
|
||
[CLOCK]="🕐" [MAP]="🗺️" [SERVER]="🖥️" [USER]="👤" [IP]="🔗"
|
||
[DOOR]="🚪" [BELL]="🔔" [SHIELD]="🛡️" [MAGNIFYING_GLASS]="🔍"
|
||
)
|
||
|
||
# Флаги стран (сокращённо)
|
||
declare -gA COUNTRY_FLAGS=(
|
||
[RU]="🇷🇺" [US]="🇺🇸" [DE]="🇩🇪" [CN]="🇨🇳" [UA]="🇺🇦"
|
||
[BY]="🇧🇾" [KZ]="🇰🇿" [FR]="🇫🇷" [GB]="🇬🇧" [JP]="🇯🇵"
|
||
)
|
||
|
||
# ============================================================================
|
||
# LOGGING
|
||
# ============================================================================
|
||
log() {
|
||
local level="$1"
|
||
local message="$2"
|
||
local timestamp
|
||
timestamp="$(date '+%Y-%m-%d %H:%M:%S')"
|
||
local log_file="${CONFIG[LOG_FILE]}"
|
||
|
||
# Создаём каталог для лога, если нужно
|
||
[[ -n "$log_file" ]] && mkdir -p "$(dirname "$log_file")" 2>/dev/null || true
|
||
|
||
case "$level" in
|
||
DEBUG)
|
||
[[ "${CONFIG[DEBUG]}" == "true" ]] && echo "[$timestamp] [DEBUG] $message" >> "$log_file"
|
||
;;
|
||
INFO)
|
||
echo "[$timestamp] [INFO] $message" >> "$log_file"
|
||
;;
|
||
WARN)
|
||
echo "[$timestamp] [WARN] $message" >> "$log_file"
|
||
;;
|
||
ERROR)
|
||
echo "[$timestamp] [ERROR] $message" >> "$log_file"
|
||
echo "[$timestamp] [ERROR] $message" >&2
|
||
;;
|
||
esac
|
||
}
|
||
|
||
# ============================================================================
|
||
# UTILITY FUNCTIONS
|
||
# ============================================================================
|
||
command_exists() {
|
||
command -v "$1" >/dev/null 2>&1
|
||
}
|
||
|
||
validate_ip() {
|
||
local ip="$1"
|
||
# IPv4
|
||
if [[ "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||
local IFS='.'
|
||
read -r -a octets <<< "$ip"
|
||
for octet in "${octets[@]}"; do
|
||
if (( octet < 0 || octet > 255 )); then
|
||
return 1
|
||
fi
|
||
done
|
||
return 0
|
||
fi
|
||
# IPv6 просто проверяем формат
|
||
if [[ "$ip" =~ ^[0-9a-fA-F:]+$ ]]; then
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
is_private_ip() {
|
||
local ip="$1"
|
||
[[ "$ip" =~ ^10\. ]] && return 0
|
||
[[ "$ip" =~ ^172\.(1[6-9]|2[0-9]|3[0-1])\. ]] && return 0
|
||
[[ "$ip" =~ ^192\.168\. ]] && return 0
|
||
[[ "$ip" =~ ^127\. ]] && return 0
|
||
[[ "$ip" =~ ^169\.254\. ]] && return 0
|
||
[[ "$ip" =~ ^fc[0-9a-f]{2}: ]] && return 0
|
||
[[ "$ip" =~ ^fd[0-9a-f]{2}: ]] && return 0
|
||
[[ "$ip" =~ ^fe80: ]] && return 0
|
||
[[ "$ip" == "::1" ]] && return 0
|
||
return 1
|
||
}
|
||
|
||
sanitize() {
|
||
echo "$1" | tr -d '\000-\037' | cut -c1-200
|
||
}
|
||
|
||
# Проверка, входит ли IP в список (поддерживаются CIDR)
|
||
ip_in_list() {
|
||
local ip="$1"
|
||
local list="$2"
|
||
[[ -z "$list" ]] && return 1
|
||
for entry in $list; do
|
||
if [[ "$entry" == */* ]]; then
|
||
# CIDR
|
||
if command_exists ipcalc; then
|
||
if ipcalc -c "$ip" "$entry" >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
else
|
||
# грубая проверка: если IP начинается с той же подсети
|
||
if [[ "$ip" == "${entry%/*}"* ]]; then
|
||
return 0
|
||
fi
|
||
fi
|
||
else
|
||
[[ "$ip" == "$entry" ]] && return 0
|
||
fi
|
||
done
|
||
return 1
|
||
}
|
||
|
||
# Rate limiting: проверяем, можно ли отправить уведомление по ключу (например, IP+user)
|
||
check_rate_limit() {
|
||
local key="$1"
|
||
local limit_sec="${CONFIG[RATE_LIMIT_SEC]}"
|
||
[[ "$limit_sec" -le 0 ]] && return 0
|
||
local cache_file="${IP_CACHE_DIR}/rate_$(echo -n "$key" | md5sum | cut -d' ' -f1)"
|
||
mkdir -p "$IP_CACHE_DIR"
|
||
if [[ -f "$cache_file" ]]; then
|
||
local last
|
||
last="$(cat "$cache_file")"
|
||
local now
|
||
now="$(date +%s)"
|
||
if (( now - last < limit_sec )); then
|
||
return 1
|
||
fi
|
||
fi
|
||
date +%s > "$cache_file"
|
||
return 0
|
||
}
|
||
|
||
# ============================================================================
|
||
# CONFIGURATION LOADING
|
||
# ============================================================================
|
||
load_config() {
|
||
# Сначала загружаем переменные окружения (приоритет выше)
|
||
local env_vars=(
|
||
TELEGRAM_TOKEN TELEGRAM_CHAT_ID TELEGRAM_TOPIC_ID
|
||
MAX_ATTEMPTS_BEFORE_CRITICAL CRITICAL_TIME_WINDOW CLEANUP_DAYS
|
||
IP_API_TIMEOUT ENABLE_GEOIP ENABLE_NOTIFICATIONS DEBUG
|
||
AUTO_BLOCK_CRITICAL WHITELIST_IPS BLACKLIST_IPS RATE_LIMIT_SEC
|
||
)
|
||
for var in "${env_vars[@]}"; do
|
||
if [[ -n "${!var:-}" ]]; then
|
||
CONFIG["$var"]="${!var}"
|
||
log "DEBUG" "Loaded from env: $var=${!var}"
|
||
fi
|
||
done
|
||
|
||
# Затем из конфигурационного файла (переопределяет, если нет в env)
|
||
if [[ -f "$CONFIG_FILE" ]]; then
|
||
log "INFO" "Loading configuration from $CONFIG_FILE"
|
||
local line key value
|
||
while IFS='=' read -r key value; do
|
||
key="${key// /}"
|
||
value="${value// /}"
|
||
[[ -z "$key" || "$key" =~ ^# ]] && continue
|
||
if [[ -n "${CONFIG[$key]:-}" ]]; then
|
||
CONFIG["$key"]="$value"
|
||
log "DEBUG" "Config: $key=$value"
|
||
fi
|
||
done < "$CONFIG_FILE"
|
||
else
|
||
log "WARN" "Configuration file not found, using defaults/env"
|
||
fi
|
||
|
||
# Валидация обязательных параметров
|
||
if [[ -z "${CONFIG[TELEGRAM_TOKEN]}" || -z "${CONFIG[TELEGRAM_CHAT_ID]}" ]]; then
|
||
log "ERROR" "TELEGRAM_TOKEN and TELEGRAM_CHAT_ID must be set"
|
||
exit 1
|
||
fi
|
||
|
||
# Создаём необходимые каталоги
|
||
mkdir -p "$FAILED_LOGINS_DIR" "$IP_CACHE_DIR" "$(dirname "${CONFIG[LOG_FILE]}")"
|
||
}
|
||
|
||
# ============================================================================
|
||
# GEOIP FUNCTIONS
|
||
# ============================================================================
|
||
get_ip_info() {
|
||
local ip="$1"
|
||
local cache_file="${IP_CACHE_DIR}/geo_$(echo -n "$ip" | md5sum | cut -d' ' -f1)"
|
||
local cache_age=3600
|
||
|
||
# Проверка кэша
|
||
if [[ -f "$cache_file" ]]; then
|
||
local file_time now
|
||
file_time="$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file")"
|
||
now="$(date +%s)"
|
||
if (( now - file_time < cache_age )); then
|
||
cat "$cache_file"
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
# Если GeoIP отключён
|
||
if [[ "${CONFIG[ENABLE_GEOIP]}" != "true" ]]; then
|
||
echo "🌐 *Страна:* отключено"
|
||
echo "🏙️ *Город:* отключено"
|
||
return 0
|
||
fi
|
||
|
||
# Приватный IP
|
||
if is_private_ip "$ip"; then
|
||
{
|
||
echo "🌐 *Страна:* частная сеть"
|
||
echo "🏙️ *Город:* локальный адрес"
|
||
} > "$cache_file"
|
||
cat "$cache_file"
|
||
return 0
|
||
fi
|
||
|
||
# Попытка использовать mmdblookup (MaxMind GeoIP2) если установлен
|
||
if command_exists mmdblookup && [[ -f /usr/share/GeoIP/GeoLite2-City.mmdb ]]; then
|
||
local country city
|
||
country="$(mmdblookup --file /usr/share/GeoIP/GeoLite2-City.mmdb --ip "$ip" country names en 2>/dev/null | head -1 | tr -d '"')"
|
||
city="$(mmdblookup --file /usr/share/GeoIP/GeoLite2-City.mmdb --ip "$ip" city names en 2>/dev/null | head -1 | tr -d '"')"
|
||
{
|
||
echo "🌐 *Страна:* ${country:-Неизвестно}"
|
||
echo "🏙️ *Город:* ${city:-Неизвестно}"
|
||
} > "$cache_file"
|
||
cat "$cache_file"
|
||
return 0
|
||
fi
|
||
|
||
# Резервный API ip-api.com
|
||
local response
|
||
response="$(curl -s --max-time "${CONFIG[IP_API_TIMEOUT]}" "http://ip-api.com/json/$ip?fields=status,country,city")" || true
|
||
if [[ -n "$response" ]] && command_exists jq; then
|
||
local status country city
|
||
status="$(jq -r '.status' <<<"$response")"
|
||
if [[ "$status" == "success" ]]; then
|
||
country="$(jq -r '.country' <<<"$response")"
|
||
city="$(jq -r '.city' <<<"$response")"
|
||
{
|
||
echo "🌐 *Страна:* ${country:-Неизвестно}"
|
||
echo "🏙️ *Город:* ${city:-Неизвестно}"
|
||
} > "$cache_file"
|
||
cat "$cache_file"
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
# Если ничего не сработало
|
||
echo "🌐 *Страна:* не определена"
|
||
echo "🏙️ *Город:* не определён"
|
||
return 1
|
||
}
|
||
|
||
# ============================================================================
|
||
# IP FILTERING (WHITELIST/BLACKLIST)
|
||
# ============================================================================
|
||
check_ip_filter() {
|
||
local ip="$1"
|
||
if ip_in_list "$ip" "${CONFIG[BLACKLIST_IPS]}"; then
|
||
log "INFO" "IP $ip is blacklisted, blocking immediately"
|
||
auto_block_ip "$ip" "blacklist"
|
||
return 1
|
||
fi
|
||
if ip_in_list "$ip" "${CONFIG[WHITELIST_IPS]}"; then
|
||
log "DEBUG" "IP $ip is whitelisted, skipping notifications"
|
||
return 2
|
||
fi
|
||
return 0
|
||
}
|
||
|
||
# ============================================================================
|
||
# AUTO BLOCK IP
|
||
# ============================================================================
|
||
auto_block_ip() {
|
||
local ip="$1"
|
||
local reason="$2"
|
||
if [[ "${CONFIG[AUTO_BLOCK_CRITICAL]}" != "true" ]]; then
|
||
return 0
|
||
fi
|
||
local cmd="${CONFIG[BLOCK_COMMAND]//\{ip\}/$ip}"
|
||
log "WARN" "Auto-blocking IP $ip (reason: $reason) with command: $cmd"
|
||
eval "$cmd" || log "ERROR" "Failed to block IP $ip"
|
||
}
|
||
|
||
# ============================================================================
|
||
# FAILED LOGIN TRACKING
|
||
# ============================================================================
|
||
track_failed_attempt() {
|
||
local ip="$1"
|
||
local user="$2"
|
||
local timestamp
|
||
timestamp="$(date +%s)"
|
||
local date_str
|
||
date_str="$(date '+%Y-%m-%d %H:%M:%S')"
|
||
local safe_ip
|
||
safe_ip="$(echo "$ip" | tr './:' '_')"
|
||
local ip_file="$FAILED_LOGINS_DIR/$safe_ip"
|
||
|
||
# Читаем предыдущие данные
|
||
local attempts=1 last_attempt=0 old_user="$user"
|
||
if [[ -f "$ip_file" ]]; then
|
||
IFS='|' read -r attempts last_attempt old_user _ < "$ip_file"
|
||
attempts=$((attempts + 1))
|
||
# Сбрасываем счётчик, если прошло много времени
|
||
if (( timestamp - last_attempt > 600 )); then
|
||
attempts=1
|
||
fi
|
||
fi
|
||
|
||
# Сохраняем
|
||
echo "$attempts|$timestamp|$user|$date_str" > "$ip_file"
|
||
log "INFO" "Failed attempt #$attempts from $ip as $user"
|
||
|
||
# Проверяем условия для уведомления
|
||
local notify=false
|
||
local alert_level="info"
|
||
local time_window_diff=$((timestamp - last_attempt))
|
||
|
||
# Критическая атака
|
||
if (( attempts >= ${CONFIG[MAX_ATTEMPTS_BEFORE_CRITICAL]} )) && \
|
||
(( time_window_diff < ${CONFIG[CRITICAL_TIME_WINDOW]} )); then
|
||
notify=true
|
||
alert_level="critical"
|
||
auto_block_ip "$ip" "critical_attack"
|
||
elif (( attempts == 1 || attempts == 3 || attempts == 5 || attempts % 10 == 0 )); then
|
||
notify=true
|
||
alert_level="warning"
|
||
fi
|
||
|
||
if [[ "$notify" == "true" ]]; then
|
||
send_failed_login_alert "$ip" "$user" "$attempts" "$date_str" "$alert_level"
|
||
fi
|
||
|
||
return "$attempts"
|
||
}
|
||
|
||
# ============================================================================
|
||
# TELEGRAM SENDER
|
||
# ============================================================================
|
||
send_telegram_message() {
|
||
local message="$1"
|
||
local disable_notification="${2:-false}"
|
||
local parse_mode="${3:-markdown}"
|
||
|
||
if [[ "${CONFIG[ENABLE_NOTIFICATIONS]}" != "true" ]]; then
|
||
log "INFO" "Notifications disabled, message not sent"
|
||
return 0
|
||
fi
|
||
|
||
local url="https://api.telegram.org/bot${CONFIG[TELEGRAM_TOKEN]}/sendMessage"
|
||
local response_file="/tmp/tg_response_$$.json"
|
||
|
||
local curl_cmd=(curl -s -X POST "$url" -F "chat_id=${CONFIG[TELEGRAM_CHAT_ID]}" -F "text=$message" -F "parse_mode=$parse_mode" -F "disable_notification=$disable_notification")
|
||
if [[ -n "${CONFIG[TELEGRAM_TOPIC_ID]}" ]]; then
|
||
curl_cmd+=(-F "message_thread_id=${CONFIG[TELEGRAM_TOPIC_ID]}")
|
||
fi
|
||
|
||
local http_code
|
||
http_code="$("${curl_cmd[@]}" -w "%{http_code}" -o "$response_file" 2>/dev/null || echo "000")"
|
||
|
||
if [[ "$http_code" -eq 200 ]]; then
|
||
log "DEBUG" "Telegram message sent"
|
||
else
|
||
log "ERROR" "Telegram send failed (HTTP $http_code). Response: $(cat "$response_file" 2>/dev/null)"
|
||
fi
|
||
rm -f "$response_file"
|
||
}
|
||
|
||
send_failed_login_alert() {
|
||
local ip="$1"
|
||
local user="$2"
|
||
local attempts="$3"
|
||
local date_str="$4"
|
||
local alert_level="$5"
|
||
|
||
# Rate limiting
|
||
local rate_key="failed_${ip}_${user}"
|
||
check_rate_limit "$rate_key" || return 0
|
||
|
||
local ip_info
|
||
ip_info="$(get_ip_info "$ip")"
|
||
|
||
local danger_emoji title
|
||
case "$alert_level" in
|
||
critical)
|
||
danger_emoji="${EMOJI[FIRE]}${EMOJI[CRITICAL]}"
|
||
title="*КРИТИЧЕСКАЯ АТАКА!*"
|
||
;;
|
||
warning)
|
||
if (( attempts >= 10 )); then
|
||
danger_emoji="${EMOJI[DANGER]}⚠️"
|
||
title="*ВЫСОКАЯ АКТИВНОСТЬ*"
|
||
else
|
||
danger_emoji="${EMOJI[WARNING]}"
|
||
title=""
|
||
fi
|
||
;;
|
||
*)
|
||
danger_emoji="❌"
|
||
title=""
|
||
;;
|
||
esac
|
||
|
||
local message
|
||
message="$(cat << EOF
|
||
${danger_emoji} *НЕУДАЧНАЯ ПОПЫТКА SSH* ${danger_emoji}
|
||
${title}
|
||
|
||
⚠️ *Попытка:* #${attempts}
|
||
👤 *Пользователь:* \`${user}\`
|
||
🖥️ *Сервер:* \`${HOSTNAME:-$(hostname)}\`
|
||
🔗 *IP атакующего:* \`${ip}\`
|
||
|
||
*Геоинформация:*
|
||
${ip_info}
|
||
|
||
🕐 *Время:* ${date_str}
|
||
📊 *Всего попыток с IP:* ${attempts}
|
||
|
||
#SSH #FailedLogin #SecurityAlert
|
||
EOF
|
||
)"
|
||
send_telegram_message "$message" "false"
|
||
}
|
||
|
||
send_successful_login() {
|
||
local ip="$1"
|
||
local user="$2"
|
||
|
||
local rate_key="success_${ip}_${user}"
|
||
check_rate_limit "$rate_key" || return 0
|
||
|
||
local ip_info
|
||
ip_info="$(get_ip_info "$ip")"
|
||
|
||
local message
|
||
message="$(cat << EOF
|
||
✅ *УСПЕШНЫЙ ВХОД SSH*
|
||
|
||
👤 *Пользователь:* \`${user}\`
|
||
🖥️ *Сервер:* \`${HOSTNAME:-$(hostname)}\`
|
||
🔗 *IP адрес:* \`${ip}\`
|
||
|
||
*Информация о подключении:*
|
||
${ip_info}
|
||
|
||
🕐 *Время входа:* $(date '+%d %b %Y, %H:%M:%S')
|
||
📡 *Сервис:* ${PAM_SERVICE:-ssh}
|
||
|
||
#SSH #Login #Successful
|
||
EOF
|
||
)"
|
||
send_telegram_message "$message" "true"
|
||
}
|
||
|
||
send_logout_notification() {
|
||
local ip="$1"
|
||
local user="$2"
|
||
local session_start="${3:-}"
|
||
|
||
local duration="?"
|
||
if [[ -n "$session_start" ]]; then
|
||
local start_sec end_sec diff
|
||
start_sec="$(date -d "$session_start" +%s 2>/dev/null || echo 0)"
|
||
end_sec="$(date +%s)"
|
||
if (( start_sec > 0 )); then
|
||
diff=$((end_sec - start_sec))
|
||
duration="$(printf '%02d:%02d:%02d' $((diff/3600)) $(((diff%3600)/60)) $((diff%60)))"
|
||
fi
|
||
fi
|
||
|
||
local message
|
||
message="$(cat << EOF
|
||
🚪 *ВЫХОД ИЗ SSH СЕССИИ*
|
||
|
||
👤 *Пользователь:* \`${user}\`
|
||
🖥️ *Сервер:* \`${HOSTNAME:-$(hostname)}\`
|
||
🔗 *IP адрес:* \`${ip}\`
|
||
|
||
🕐 *Время выхода:* $(date '+%d %b %Y, %H:%M:%S')
|
||
⏱️ *Длительность:* $duration
|
||
|
||
#SSH #Logout
|
||
EOF
|
||
)"
|
||
send_telegram_message "$message" "true"
|
||
}
|
||
|
||
# ============================================================================
|
||
# LOG MONITORING (режим демона)
|
||
# ============================================================================
|
||
monitor_logs() {
|
||
log "INFO" "Starting log monitor"
|
||
|
||
local use_journal="${CONFIG[USE_JOURNAL]}"
|
||
if [[ "$use_journal" == "true" ]] && command_exists journalctl; then
|
||
journalctl -f -n0 -u ssh.service -o cat | while read -r line; do
|
||
process_log_line "$line"
|
||
done
|
||
else
|
||
local auth_logs=("/var/log/auth.log" "/var/log/secure")
|
||
local log_file=""
|
||
for f in "${auth_logs[@]}"; do
|
||
if [[ -f "$f" ]]; then
|
||
log_file="$f"
|
||
break
|
||
fi
|
||
done
|
||
if [[ -z "$log_file" ]]; then
|
||
log "ERROR" "No auth log file found"
|
||
return 1
|
||
fi
|
||
log "INFO" "Monitoring $log_file"
|
||
tail -Fn0 "$log_file" | while read -r line; do
|
||
process_log_line "$line"
|
||
done
|
||
fi
|
||
}
|
||
|
||
process_log_line() {
|
||
local line="$1"
|
||
local ip user
|
||
|
||
# Failed password
|
||
if [[ "$line" =~ Failed\ password\ for\ (.+)\ from\ ([0-9\.]+) ]]; then
|
||
user="${BASH_REMATCH[1]}"
|
||
ip="${BASH_REMATCH[2]}"
|
||
check_ip_filter "$ip" || return 0
|
||
track_failed_attempt "$ip" "$user"
|
||
# Invalid user
|
||
elif [[ "$line" =~ Invalid\ user\ ([^\ ]+)\ from\ ([0-9\.]+) ]]; then
|
||
user="${BASH_REMATCH[1]}"
|
||
ip="${BASH_REMATCH[2]}"
|
||
check_ip_filter "$ip" || return 0
|
||
track_failed_attempt "$ip" "$user"
|
||
# Successful login
|
||
elif [[ "$line" =~ Accepted\ password\ for\ ([^\ ]+)\ from\ ([0-9\.]+) ]]; then
|
||
user="${BASH_REMATCH[1]}"
|
||
ip="${BASH_REMATCH[2]}"
|
||
check_ip_filter "$ip" || return 0
|
||
send_successful_login "$ip" "$user"
|
||
fi
|
||
}
|
||
|
||
# ============================================================================
|
||
# PAM HANDLER (вызывается из PAM)
|
||
# ============================================================================
|
||
handle_pam() {
|
||
local pam_type="${PAM_TYPE:-}"
|
||
local pam_user="${PAM_USER:-}"
|
||
local pam_rhost="${PAM_RHOST:-}"
|
||
local pam_service="${PAM_SERVICE:-}"
|
||
|
||
[[ -z "$pam_type" || -z "$pam_user" || -z "$pam_rhost" ]] && return 0
|
||
|
||
# Фильтрация
|
||
check_ip_filter "$pam_rhost" || return 0
|
||
|
||
log "INFO" "PAM event: $pam_type from $pam_rhost as $pam_user"
|
||
|
||
case "$pam_type" in
|
||
open_session)
|
||
send_successful_login "$pam_rhost" "$pam_user"
|
||
;;
|
||
close_session)
|
||
send_logout_notification "$pam_rhost" "$pam_user"
|
||
;;
|
||
auth)
|
||
# Обрабатывается через логи, игнорируем
|
||
;;
|
||
*)
|
||
log "DEBUG" "Unknown PAM type: $pam_type"
|
||
;;
|
||
esac
|
||
}
|
||
|
||
# ============================================================================
|
||
# MAINTENANCE
|
||
# ============================================================================
|
||
cleanup() {
|
||
log "INFO" "Cleaning up old files"
|
||
find "$FAILED_LOGINS_DIR" -type f -mtime "+${CONFIG[CLEANUP_DAYS]}" -delete
|
||
find "$IP_CACHE_DIR" -type f -mtime +1 -delete
|
||
log "INFO" "Cleanup done"
|
||
}
|
||
|
||
status() {
|
||
echo "=== Telegram SSH Notifier Status ==="
|
||
echo "Version: $SCRIPT_VERSION"
|
||
echo "Log file: ${CONFIG[LOG_FILE]}"
|
||
echo "Failed logins dir: $FAILED_LOGINS_DIR"
|
||
echo "Notifications: ${CONFIG[ENABLE_NOTIFICATIONS]}"
|
||
echo "GeoIP: ${CONFIG[ENABLE_GEOIP]}"
|
||
echo "Auto-block: ${CONFIG[AUTO_BLOCK_CRITICAL]}"
|
||
echo ""
|
||
local count
|
||
count="$(find "$FAILED_LOGINS_DIR" -type f 2>/dev/null | wc -l)"
|
||
echo "Tracked IPs with failed attempts: $count"
|
||
echo ""
|
||
echo "Recent failed attempts (last 10):"
|
||
find "$FAILED_LOGINS_DIR" -type f -exec ls -lt {} + 2>/dev/null | head -10 | while read -r line; do
|
||
local file
|
||
file="$(echo "$line" | awk '{print $NF}')"
|
||
if [[ -f "$file" ]]; then
|
||
IFS='|' read -r attempts _ user date < "$file"
|
||
local ip_name
|
||
ip_name="$(basename "$file" | tr '_' '.')"
|
||
echo " $ip_name: $attempts attempts, last: $date, user: $user"
|
||
fi
|
||
done
|
||
}
|
||
|
||
# ============================================================================
|
||
# COMMAND LINE PARSING
|
||
# ============================================================================
|
||
usage() {
|
||
cat << EOF
|
||
Telegram SSH Notifier v$SCRIPT_VERSION
|
||
|
||
Использование: $SCRIPT_NAME [КОМАНДА]
|
||
|
||
Команды:
|
||
monitor Запустить мониторинг логов (демон)
|
||
cleanup Очистить старые файлы и кэш
|
||
status Показать статус и статистику
|
||
test Отправить тестовое сообщение
|
||
--help, -h Показать эту справку
|
||
--version, -v Показать версию
|
||
|
||
Без аргументов работает в режиме PAM (для интеграции с /etc/pam.d/sshd).
|
||
|
||
Конфигурация: $CONFIG_FILE
|
||
Лог: ${CONFIG[LOG_FILE]}
|
||
EOF
|
||
}
|
||
|
||
# ============================================================================
|
||
# MAIN
|
||
# ============================================================================
|
||
main() {
|
||
# Предотвращаем повторный запуск в режиме monitor
|
||
if [[ "${1:-}" == "monitor" ]]; then
|
||
if [[ -f "$LOCK_FILE" ]]; then
|
||
if kill -0 "$(cat "$LOCK_FILE")" 2>/dev/null; then
|
||
log "ERROR" "Another monitor process is already running (PID $(cat "$LOCK_FILE")). Exiting."
|
||
exit 1
|
||
else
|
||
rm -f "$LOCK_FILE"
|
||
fi
|
||
fi
|
||
echo $$ > "$LOCK_FILE"
|
||
trap 'rm -f "$LOCK_FILE"' EXIT
|
||
fi
|
||
|
||
load_config
|
||
|
||
case "${1:-}" in
|
||
monitor)
|
||
monitor_logs
|
||
;;
|
||
cleanup)
|
||
cleanup
|
||
;;
|
||
status)
|
||
status
|
||
;;
|
||
test)
|
||
send_telegram_message "*Тестовое сообщение от SSH Notifier*" "true"
|
||
echo "Тестовое сообщение отправлено."
|
||
;;
|
||
--help|-h)
|
||
usage
|
||
;;
|
||
--version|-v)
|
||
echo "$SCRIPT_VERSION"
|
||
;;
|
||
"")
|
||
# PAM mode
|
||
handle_pam
|
||
;;
|
||
*)
|
||
echo "Неизвестная команда: $1"
|
||
usage
|
||
exit 1
|
||
;;
|
||
esac
|
||
}
|
||
|
||
# Защита от source
|
||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||
trap 'log "ERROR" "Script failed at line $LINENO"' ERR
|
||
main "$@"
|
||
fi
|