Skip to content

GitLab

Commit 1f27f718 authored by liming6's avatar liming6
Browse files

feature sftp监控功能基本完善

parent 8a2d69fb
Show whitespace changes
Inline Side-by-side
Showing with 324 additions and 121 deletions
Readme.md
View file @ 1f27f718
...@@ -29,30 +29,3 @@ sshd-tool监听这个unix socket，过滤出需要的信息 ...@@ -29,30 +29,3 @@ sshd-tool监听这个unix socket，过滤出需要的信息
## auditd日志分析 ## auditd日志分析
tabby上传文件成功：
```
open(at) pid: 35286, ppid: 35262, open /tmp/navicat17_premium_lite_cs_x64.exe.tabby-upload, fd: 4
-----
close pid: 35286, ppid: 35262, fd: 4
-----
link(at): paths: [map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126469 item:0 mode:0100644 name:/tmp/navicat17_premium_lite_cs_x64.exe.tabby-upload nametype:NORMAL ogid:0 ouid:0 rdev:00:00] map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126465 item:1 mode:041777 name:/tmp/ nametype:PARENT ogid:0 ouid:0 rdev:00:00] map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126469 item:2 mode:0100644 name:/tmp/navicat17_premium_lite_cs_x64.exe nametype:CREATE ogid:0 ouid:0 rdev:00:00]]
-----
unlink(at): paths: [map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126465 item:0 mode:041777 name:/tmp/ nametype:PARENT ogid:0 ouid:0 rdev:00:00] map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126469 item:1 mode:0100644 name:/tmp/navicat17_premium_lite_cs_x64.exe.tabby-upload nametype:DELETE ogid:0 ouid:0 rdev:00:00]]
-----
close pid: 35286, ppid: 35262, fd: 4
```
tabby创建文件后中断
```
open(at) pid: 35286, ppid: 35262, open /tmp/Rocky-8.10-x86_64-dvd1.iso.tabby-upload, fd: 4
-----
unlink(at): paths: [map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126465 item:0 mode:041777 name:/tmp/ nametype:PARENT ogid:0 ouid:0 rdev:00:00] map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126470 item:1 mode:0100644 name:/tmp/Rocky-8.10-x86_64-dvd1.iso.tabby-upload nametype:DELETE ogid:0 ouid:0 rdev:00:00]]
```
```
open(at) pid: 35286, ppid: 35262, open /tmp/AnolisOS-8.6-x86_64-dvd.iso.tabby-upload, fd: 5
-----
unlink(at): paths: [map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126465 item:0 mode:041777 name:/tmp/ nametype:PARENT ogid:0 ouid:0 rdev:00:00] map[cap_fe:0 cap_fi:0 cap_fp:0 cap_frootid:0 cap_fver:0 dev:fc:00 inode:8126471 item:1 mode:0100644 name:/tmp/AnolisOS-8.6-x86_64-dvd.iso.tabby-upload nametype:DELETE ogid:0 ouid:0 rdev:00:00]]
```
\ No newline at end of file
cmd/file-monitor/logic/check.go
View file @ 1f27f718
...@@ -14,10 +14,14 @@ import ( ...@@ -14,10 +14,14 @@ import (
var ( var (
// 需要的二进制文件 // 需要的二进制文件
NeedExec = []string{"clamscan", "clamdscan"} NeedExec = []string{"clamscan", "clamdscan"}
ReInfectedFile = regexp.MustCompile(`(?i)^infected\s+files:\s+([0-9]+)\s*$`) ReInfectedFile = regexp.MustCompile(`(?i)^infected\s+files:\s+([0-9]+)\s*$`)
ErrNoLineMatch = errors.New("no line match") ErrNoLineMatch = errors.New("no line match")
HasGzip = false
HasBzip2 = false
HasXZ = false
HasZStd = false
CMExec = []string{"gzip", "bzip2", "xz", "zstd"}
) )
func CheckExec() error { func CheckExec() error {
...@@ -27,6 +31,20 @@ func CheckExec() error { ...@@ -27,6 +31,20 @@ func CheckExec() error {
return fmt.Errorf("%s not found", v) return fmt.Errorf("%s not found", v)
} }
} }
for k, v := range CMExec {
if utils.FindCmd(v) != nil {
switch k {
case 0:
HasGzip = true
case 1:
HasBzip2 = true
case 2:
HasXZ = true
case 3:
HasZStd = true
}
}
}
return nil return nil
} }
...@@ -47,7 +65,29 @@ func ScanFile(f string) (bool, error) { ...@@ -47,7 +65,29 @@ func ScanFile(f string) (bool, error) {
if err != nil { if err != nil {
return false, err return false, err
} }
// // 优化归档文件
// cm, istar, err := utils.DetectArchive(sf)
// if err == nil {
// if cm == utils.CMNone || cm == utils.CMUnknown {
// // 不能采用优化方法
// } else {
// // 是压缩后的tar包
// switch cm {
// case utils.CMGZip:
// if istar {
// exec.Command()
// } else {
// }
// case utils.CMBZip2:
// case utils.CMXZ:
// case utils.CMZStd:
// }
// }
// }
cmd := exec.Command("clamdscan", "-i", sf) cmd := exec.Command("clamdscan", "-i", sf)
output, err := cmd.CombinedOutput() output, err := cmd.CombinedOutput()
if err != nil { if err != nil {
......
cmd/file-monitor/logic/sftp.go
View file @ 1f27f718
...@@ -7,6 +7,7 @@ import ( ...@@ -7,6 +7,7 @@ import (
"net" "net"
"os" "os"
"regexp" "regexp"
"slices"
"strconv" "strconv"
"strings" "strings"
"sync" "sync"
...@@ -45,7 +46,8 @@ const ( ...@@ -45,7 +46,8 @@ const (
func parseSLA(s string, t time.Time) GetSLA { func parseSLA(s string, t time.Time) GetSLA {
prev := "" prev := ""
if strings.HasPrefix(s, string(SLAOpen)) { switch {
case strings.HasPrefix(s, string(SLAOpen)):
fields := strings.Fields(s) fields := strings.Fields(s)
result := SftpLogOpen{Time: t} result := SftpLogOpen{Time: t}
for i, v := range fields[1:] { for i, v := range fields[1:] {
...@@ -71,8 +73,7 @@ func parseSLA(s string, t time.Time) GetSLA { ...@@ -71,8 +73,7 @@ func parseSLA(s string, t time.Time) GetSLA {
} }
} }
return &result return &result
} case strings.HasPrefix(s, string(SLAClose)):
if strings.HasPrefix(s, string(SLAClose)) {
fields := strings.Fields(s) fields := strings.Fields(s)
result := SftpLogClose{Time: t} result := SftpLogClose{Time: t}
for k, v := range fields[1:] { for k, v := range fields[1:] {
...@@ -102,14 +103,12 @@ func parseSLA(s string, t time.Time) GetSLA { ...@@ -102,14 +103,12 @@ func parseSLA(s string, t time.Time) GetSLA {
} }
} }
return &result return &result
} case strings.HasPrefix(s, string(SLARemove)):
if strings.HasPrefix(s, string(SLARemove)) {
fields := strings.Fields(s) fields := strings.Fields(s)
result := SftpLogRemove{Time: t} result := SftpLogRemove{Time: t}
result.Path = fields[2] result.Path = fields[2]
return &result return &result
} case strings.HasPrefix(s, string(SLARename)):
if strings.HasPrefix(s, string(SLARename)) {
fields := strings.Fields(s) fields := strings.Fields(s)
result := SftpLogRename{Time: t} result := SftpLogRename{Time: t}
for _, v := range fields[1:] { for _, v := range fields[1:] {
...@@ -126,8 +125,7 @@ func parseSLA(s string, t time.Time) GetSLA { ...@@ -126,8 +125,7 @@ func parseSLA(s string, t time.Time) GetSLA {
} }
} }
return &result return &result
} case strings.HasPrefix(s, string(SLAForceClose)):
if strings.HasPrefix(s, string(SLAForceClose)) {
fields := strings.Fields(s) fields := strings.Fields(s)
result := SftpLogForceClose{Time: t} result := SftpLogForceClose{Time: t}
for k, v := range fields[2:] { for k, v := range fields[2:] {
...@@ -157,22 +155,21 @@ func parseSLA(s string, t time.Time) GetSLA { ...@@ -157,22 +155,21 @@ func parseSLA(s string, t time.Time) GetSLA {
} }
} }
return &result return &result
} case strings.HasPrefix(s, string(SLAOpenSession)):
if strings.HasPrefix(s, string(SLAOpenSession)) {
result := SftpLogOpenSession{Time: t} result := SftpLogOpenSession{Time: t}
items := RegParseSession.FindStringSubmatch(s) items := RegParseSession.FindStringSubmatch(s)
result.User = items[2] result.User = items[2]
result.From = items[3] result.From = items[3]
return &result return &result
} case strings.HasPrefix(s, string(SLACloseSession)):
if strings.HasPrefix(s, string(SLACloseSession)) {
result := SftpLogCloseSession{Time: t} result := SftpLogCloseSession{Time: t}
items := RegParseSession.FindStringSubmatch(s) items := RegParseSession.FindStringSubmatch(s)
result.User = items[2] result.User = items[2]
result.From = items[3] result.From = items[3]
return &result return &result
} default:
return nil return nil
}
} }
type SftpLogOpen struct { type SftpLogOpen struct {
...@@ -339,6 +336,11 @@ func NewSftpLogSet(pid int32, user *string, startTime *time.Time) *SftpLogSet { ...@@ -339,6 +336,11 @@ func NewSftpLogSet(pid int32, user *string, startTime *time.Time) *SftpLogSet {
user, err := p.Username() user, err := p.Username()
if err == nil { if err == nil {
result.User = user result.User = user
} else {
uids, err := p.Uids()
if err == nil && len(uids) > 0 {
result.User = fmt.Sprintf("UID: %d", uids[0])
}
} }
} }
} }
...@@ -370,59 +372,76 @@ func (sls *SftpLogSet) CheckAlive() (bool, error) { ...@@ -370,59 +372,76 @@ func (sls *SftpLogSet) CheckAlive() (bool, error) {
} }
type FileInfo struct { type FileInfo struct {
Path string Path string // 文件路径，对于tabby等中途会修改的sftp客户端，这里记录有后缀的名称
NameSet map[string]bool // 可用名称
Log []GetSLA // 文件操作日志 Log []GetSLA // 文件操作日志
LogSet *SftpLogSet LogLock sync.RWMutex // 保护Log的读写
LogSet *SftpLogSet // 这个文件信息所属的日志集，用于获取用户名和pid
} }
func NewFileInfo(path string, ls *SftpLogSet) *FileInfo { func NewFileInfo(path string, ls *SftpLogSet) *FileInfo {
return &FileInfo{ return &FileInfo{
Path: path, Path: path,
NameSet: make(map[string]bool),
Log: make([]GetSLA, 0, 4), Log: make([]GetSLA, 0, 4),
LogSet: ls, LogSet: ls,
LogLock: sync.RWMutex{},
} }
} }
// CheckNeedScan 检查是否需要扫描文件 // CheckNeedScan 检查是否需要扫描文件
func (fi *FileInfo) CheckNeedScan() { func (fi *FileInfo) CheckNeedScan() {
// 检查最后一个日志的种类 // 检查最后一个日志的种类
rl := fi.LogLock.RLocker()
rl.Lock()
l := len(fi.Log) l := len(fi.Log)
if l == 0 { if l == 0 {
return return
} }
last := fi.Log[l-1] last := fi.Log[l-1]
userName := fi.LogSet.User
rl.Unlock()
switch act := last.(type) { switch act := last.(type) {
case *SftpLogClose: case *SftpLogClose:
if strings.HasSuffix(act.Path, "tabby-upload") { if strings.HasSuffix(act.Path, ".tabby-upload") {
return return
} }
log.Println("scan file: ", act.Path) fi.LogSet.Lock.Lock()
delete(fi.LogSet.OpenedFile, act.Path)
fi.LogSet.Lock.Unlock()
log.Printf("user %s upload file: %s, scanning...\n", userName, act.Path)
have, _ := ScanFile(act.Path) have, _ := ScanFile(act.Path)
if have { if have {
log.Println(act.Path, "有病毒") log.Printf("user %s upload file %s containing viruses\n", userName, act.Path)
} else { } else {
log.Println(act.Path, "没病毒") log.Printf("user %s upload file %s not find virus\n", userName, act.Path)
} }
return
case *SftpLogRename: case *SftpLogRename:
if strings.HasSuffix(act.Old, "tabby-upload") { if strings.HasSuffix(act.Old, ".tabby-upload") {
log.Println("scan file: ", act.New) log.Printf("user %s upload file: %s, scanning...\n", userName, act.New)
have, _ := ScanFile(act.New) have, _ := ScanFile(act.New)
if have { if have {
log.Println(act.New, "有病毒") log.Printf("user %s upload file %s containing viruses\n", userName, act.New)
} else { } else {
log.Println(act.New, "没病毒") log.Printf("user %s upload file %s not find virus\n", userName, act.New)
} }
fi.LogSet.Lock.Lock()
delete(fi.LogSet.OpenedFile, act.Old)
delete(fi.LogSet.OpenedFile, act.New)
fi.LogSet.Lock.Unlock()
} }
return
case *SftpLogForceClose: case *SftpLogForceClose:
log.Println("scan file: ", act.Path) log.Printf("user %s upload file: %s, scanning...\n", userName, act.Path)
have, _ := ScanFile(act.Path) have, _ := ScanFile(act.Path)
if have { if have {
log.Println(act.Path, "有病毒") log.Printf("user %s upload file %s containing viruses\n", userName, act.Path)
} else { } else {
log.Println(act.Path, "没病毒") log.Printf("user %s upload file %s not find virus\n", userName, act.Path)
} }
fi.LogSet.Lock.Lock()
delete(fi.LogSet.OpenedFile, act.Path)
fi.LogSet.Lock.Unlock()
return
} }
} }
...@@ -431,24 +450,32 @@ func InsertAction(action GetSLA) { ...@@ -431,24 +450,32 @@ func InsertAction(action GetSLA) {
return return
} }
pid := action.GetPid() pid := action.GetPid()
SftpLogLock.Lock()
defer SftpLogLock.Unlock()
switch act := action.(type) { switch act := action.(type) {
case *SftpLogOpenSession: case *SftpLogOpenSession:
// 新建 // 新建
SftpLogLock.Lock()
sls := NewSftpLogSet(pid, &act.User, &act.Time) sls := NewSftpLogSet(pid, &act.User, &act.Time)
sls.From = act.From sls.From = act.From
SftpLogMap[pid] = sls SftpLogMap[pid] = sls
SftpLogLock.Unlock()
return return
case *SftpLogCloseSession: case *SftpLogCloseSession:
SftpLogLock.Lock()
delete(SftpLogMap, pid) delete(SftpLogMap, pid)
SftpLogLock.Unlock()
return return
case *SftpLogOpen: case *SftpLogOpen:
if slices.Contains(act.Flags, "READ") {
// 是读文件，不理会
return
}
SftpLogLock.Lock()
ls, have := SftpLogMap[pid] ls, have := SftpLogMap[pid]
if !have { if !have {
ls = NewSftpLogSet(pid, nil, &act.Time) ls = NewSftpLogSet(pid, nil, &act.Time)
SftpLogMap[pid] = ls SftpLogMap[pid] = ls
} }
SftpLogLock.Unlock()
istabby := strings.HasSuffix(act.Path, ".tabby-upload") istabby := strings.HasSuffix(act.Path, ".tabby-upload")
ls.IsTabby = mo.Some(istabby) ls.IsTabby = mo.Some(istabby)
ls.Lock.Lock() ls.Lock.Lock()
...@@ -456,62 +483,70 @@ func InsertAction(action GetSLA) { ...@@ -456,62 +483,70 @@ func InsertAction(action GetSLA) {
if !have { if !have {
finfo = NewFileInfo(act.Path, ls) finfo = NewFileInfo(act.Path, ls)
ls.OpenedFile[act.Path] = finfo ls.OpenedFile[act.Path] = finfo
ls.Lock.Unlock()
finfo.LogLock.Lock()
finfo.Log = append(finfo.Log, act) finfo.Log = append(finfo.Log, act)
finfo.LogLock.Unlock()
} else { } else {
// 发生重复了？？？ // 发生重复了？？？
}
ls.Lock.Unlock() ls.Lock.Unlock()
}
return return
case *SftpLogClose: case *SftpLogClose:
// 关闭文件 if num, have := act.Write.Get(); have && num == 0 {
// 没有写入数据，不处理
return
}
SftpLogLock.Lock()
ls, have := SftpLogMap[pid] ls, have := SftpLogMap[pid]
if !have { if !have {
ls = NewSftpLogSet(pid, nil, &act.Time) ls = NewSftpLogSet(pid, nil, &act.Time)
SftpLogMap[pid] = ls SftpLogMap[pid] = ls
} }
SftpLogLock.Unlock()
ls.Lock.Lock() ls.Lock.Lock()
if strings.HasSuffix(act.Path, ".tabby-upload") {
ls.IsTabby = mo.Some(true)
}
finfo, have := ls.OpenedFile[act.Path] finfo, have := ls.OpenedFile[act.Path]
if !have { if !have {
finfo = NewFileInfo(act.Path, ls) finfo = NewFileInfo(act.Path, ls)
ls.OpenedFile[act.Path] = finfo ls.OpenedFile[act.Path] = finfo
} }
finfo.Log = append(finfo.Log, act)
ls.Lock.Unlock() ls.Lock.Unlock()
finfo.CheckNeedScan() finfo.LogLock.Lock()
finfo.Log = append(finfo.Log, act)
finfo.LogLock.Unlock()
go finfo.CheckNeedScan()
return return
case *SftpLogRemove: case *SftpLogRemove:
// 查看是否为tabby，如果是tabby，需要检查是否为上传的文件 // 查看是否为tabby，如果是tabby，需要检查是否为上传的文件
// 如果没有，不创建日志 // 如果没有，不创建日志
SftpLogLock.Lock()
ls, have := SftpLogMap[pid] ls, have := SftpLogMap[pid]
if !have { if !have {
ls = NewSftpLogSet(pid, nil, &act.Time) ls = NewSftpLogSet(pid, nil, &act.Time)
SftpLogMap[pid] = ls SftpLogMap[pid] = ls
} }
SftpLogLock.Unlock()
a, b := ls.IsTabby.Get() a, b := ls.IsTabby.Get()
if a && b { if a && b {
// 是tabby上传的文件，需要记录日志
ls.Lock.Lock()
finfo, have := ls.OpenedFile[act.Path]
if !have {
finfo = NewFileInfo(act.Path, ls)
ls.OpenedFile[act.Path] = finfo
}
finfo.Log = append(finfo.Log, act)
ls.Lock.Unlock()
} else {
delete(ls.OpenedFile, act.Path) delete(ls.OpenedFile, act.Path)
} }
return return
case *SftpLogRename: case *SftpLogRename:
// 查看是否为tabby，如果是tabby，需要检查是否为上传的文件 // 查看是否为tabby，如果是tabby，需要检查是否为上传的文件
istabby := strings.HasSuffix(act.Old, ".tabby-upload")
if istabby {
SftpLogLock.Lock()
ls, have := SftpLogMap[pid] ls, have := SftpLogMap[pid]
if !have { if !have {
ls = NewSftpLogSet(pid, nil, &act.Time) ls = NewSftpLogSet(pid, nil, &act.Time)
SftpLogMap[pid] = ls SftpLogMap[pid] = ls
} }
istabby := strings.HasSuffix(act.Old, ".tabby-upload") SftpLogLock.Unlock()
ls.IsTabby = mo.Some(istabby) ls.IsTabby = mo.Some(istabby)
if istabby {
// 是tabby上传的文件，需要记录日志 // 是tabby上传的文件，需要记录日志
ls.Lock.Lock() ls.Lock.Lock()
finfo, have := ls.OpenedFile[act.Old] finfo, have := ls.OpenedFile[act.Old]
...@@ -519,27 +554,36 @@ func InsertAction(action GetSLA) { ...@@ -519,27 +554,36 @@ func InsertAction(action GetSLA) {
finfo = NewFileInfo(act.Old, ls) finfo = NewFileInfo(act.Old, ls)
ls.OpenedFile[act.Old] = finfo ls.OpenedFile[act.Old] = finfo
} }
finfo.Log = append(finfo.Log, act)
ls.Lock.Unlock() ls.Lock.Unlock()
finfo.CheckNeedScan() finfo.LogLock.Lock()
finfo.Log = append(finfo.Log, act)
finfo.LogLock.Unlock()
go finfo.CheckNeedScan()
} }
return return
case *SftpLogForceClose: case *SftpLogForceClose:
if num, have := act.Write.Get(); have && num == 0 {
return
}
SftpLogLock.Lock()
// 是强制中断，需要检查是否为上传的文件 // 是强制中断，需要检查是否为上传的文件
ls, have := SftpLogMap[pid] ls, have := SftpLogMap[pid]
if !have { if !have {
ls = NewSftpLogSet(pid, nil, &act.Time) ls = NewSftpLogSet(pid, nil, &act.Time)
SftpLogMap[pid] = ls SftpLogMap[pid] = ls
} }
SftpLogLock.Unlock()
ls.Lock.Lock() ls.Lock.Lock()
finfo, have := ls.OpenedFile[act.Path] finfo, have := ls.OpenedFile[act.Path]
if !have { if !have {
finfo = NewFileInfo(act.Path, ls) finfo = NewFileInfo(act.Path, ls)
ls.OpenedFile[act.Path] = finfo ls.OpenedFile[act.Path] = finfo
} }
finfo.Log = append(finfo.Log, act)
ls.Lock.Unlock() ls.Lock.Unlock()
finfo.CheckNeedScan() finfo.LogLock.Lock()
finfo.Log = append(finfo.Log, act)
finfo.LogLock.Unlock()
go finfo.CheckNeedScan()
return return
} }
} }
...@@ -582,13 +626,13 @@ func ParseSftpLog(s string) (GetSLA, error) { ...@@ -582,13 +626,13 @@ func ParseSftpLog(s string) (GetSLA, error) {
} }
func StartSftpMonitor() { func StartSftpMonitor() {
regRemove := regexp.MustCompile(`^<\d+>(.*)$`) regRemove := regexp.MustCompile(`^<\d+>(.*)$`)
os.Remove("/tmp/rsyslog.sock") os.Remove("/tmp/rsyslog.sock")
conn, err := net.ListenPacket("unixgram", "/tmp/rsyslog.sock") conn, err := net.ListenPacket("unixgram", "/tmp/rsyslog.sock")
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
} }
defer os.Remove("/tmp/rsyslog.sock")
buffer := make([]byte, 16384) buffer := make([]byte, 16384)
for { for {
n, _, err := conn.ReadFrom(buffer) n, _, err := conn.ReadFrom(buffer)
...@@ -601,14 +645,14 @@ func StartSftpMonitor() { ...@@ -601,14 +645,14 @@ func StartSftpMonitor() {
continue continue
} }
if strings.Contains(items[1], "sftp-server") { if strings.Contains(items[1], "sftp-server") {
fmt.Println(items[1])
l, err := ParseSftpLog(items[1]) l, err := ParseSftpLog(items[1])
if err != nil { if err != nil {
log.Println(err) log.Println(err)
} else { } else {
if l != nil {
InsertAction(l) InsertAction(l)
} }
} }
} }
os.Remove("/tmp/rsyslog.sock") }
} }
cmd/file-monitor/main.go
View file @ 1f27f718
package main package main
import ( import (
"fmt"
"log" "log"
"os"
"sshd-tool/cmd/file-monitor/logic" "sshd-tool/cmd/file-monitor/logic"
"time"
"github.com/gofrs/flock"
) )
// import ( // import (
...@@ -69,12 +74,34 @@ import ( ...@@ -69,12 +74,34 @@ import (
// close(logic.EventChan) // close(logic.EventChan)
// } // }
var (
logfile *os.File
)
func init() {
logFile, err := os.Create(fmt.Sprintf("/var/log/file-monitor.%s.log", time.Now().Format("2006-01-02_15-04-05")))
if err == nil {
logfile = logFile
log.SetOutput(logFile)
}
}
func shutdown() {
if logfile != nil {
logfile.Close()
}
}
func main() { func main() {
err := logic.CheckExec() fileLock := flock.New("/tmp/file-monitor.lock")
locked, err := fileLock.TryLock()
if err != nil || !locked {
log.Fatal("there is already a file-monitor instance running, stopping")
}
defer fileLock.Unlock()
err = logic.CheckExec()
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
} }
logic.StartSftpMonitor() logic.StartSftpMonitor()
} }
cmd/file-monitor/readme.md
View file @ 1f27f718
# readme # readme
sftp： file-minitor是一个监控sftp和scp上传文件动作并对上传文件进行病毒扫描的工具
通过解析sftp日志实现感知文件上传动作，自动扫描文件 ## 工作方式
scp： 针对sftp，它解析实时sftp日志，识别上传文件行为并使用clamdscan扫描文件
针对scp，它利用auditd中的审计规则判识别写文件动作
一旦上传文件完成，file-monitor会立即修改文件名，添加 `.scanning` 后缀，若扫描到文件，删除文件，并在原地留下一个警示文件 `.virus`
如果没有病毒，会恢复文件名
扫描病毒文件的时间会根据文件类型、文件大小而变化，最长扫描时间为5分钟
同样大小下，`.zip`文件扫描比较慢，建议压缩包格式为 `.tar.gz`
使用系统调用监控
cmd/tester/main.go deleted 100644 → 0
View file @ 8a2d69fb
package main
import (
"fmt"
"log"
"net"
)
func main() {
conn, err := net.ListenPacket("unixgram", "/tmp/rsyslog.sock")
if err != nil {
log.Fatal(err)
}
buffer := make([]byte, 16384)
for {
n, _, err := conn.ReadFrom(buffer)
if err != nil {
break
}
fmt.Println(string(buffer[:n]))
}
}
go.mod
View file @ 1f27f718
...@@ -11,6 +11,7 @@ require ( ...@@ -11,6 +11,7 @@ require (
require ( require (
github.com/ebitengine/purego v0.10.0 // indirect github.com/ebitengine/purego v0.10.0 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-ole/go-ole v1.2.6 // indirect
github.com/klauspost/compress v1.18.5 // indirect
github.com/kr/text v0.2.0 // indirect github.com/kr/text v0.2.0 // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
...@@ -18,6 +19,7 @@ require ( ...@@ -18,6 +19,7 @@ require (
github.com/samber/mo v1.16.0 // indirect github.com/samber/mo v1.16.0 // indirect
github.com/tklauser/go-sysconf v0.3.16 // indirect github.com/tklauser/go-sysconf v0.3.16 // indirect
github.com/tklauser/numcpus v0.11.0 // indirect github.com/tklauser/numcpus v0.11.0 // indirect
github.com/ulikunitz/xz v0.5.15 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect
golang.org/x/exp v0.0.0-20221031165847-c99f073a8326 // indirect golang.org/x/exp v0.0.0-20221031165847-c99f073a8326 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect
......
go.sum
View file @ 1f27f718
...@@ -47,6 +47,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr ...@@ -47,6 +47,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs= github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8= github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
...@@ -99,6 +101,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS ...@@ -99,6 +101,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08= github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA= github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4= github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0= github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU= go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
......
utils/archive.go 0 → 100644
View file @ 1f27f718
package utils
import (
"bytes"
"compress/bzip2"
"compress/gzip"
"io"
"os"
"github.com/klauspost/compress/zstd"
"github.com/ulikunitz/xz"
)
// 压缩格式魔术数
var (
PrefixZSTD = []byte{0x28, 0xB5, 0x2F, 0xFD}
PrefixGZip = []byte{0x1F, 0x8B}
PrefixBzip2 = []byte{0x42, 0x5A, 0x68}
PrefixXZ = []byte{0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00}
)
type CompressMethod uint8
const (
CMUnknown CompressMethod = iota
CMGZip
CMBZip2
CMXZ
CMZStd
CMNone // 表示没有压缩
)
// IsTar 判断是否为tar包
func IsTar(r io.Reader) (bool, error) {
buf := make([]byte, 512)
rn, err := r.Read(buf)
if err != nil {
return false, err
}
if rn < 262 {
return false, nil
}
if string(buf[257:262]) == "ustar" {
return true, nil
}
return false, nil
}
// DetectArchive 探测文件是否为压缩包类型
func DetectArchive(path string) (CompressMethod, bool, error) {
f, err := os.Open(path)
if err != nil {
return CMUnknown, false, err
}
defer f.Close()
// 先判断是否为tar包
istar, err := IsTar(f)
if err != nil {
return CMUnknown, false, err
}
if istar {
return CMNone, true, nil
}
// 先判断压缩格式
_, err = f.Seek(0, 0)
if err != nil {
return CMUnknown, false, err
}
buf := make([]byte, 6)
rn, err := f.Read(buf)
if err != nil {
return CMUnknown, false, err
}
if rn != 6 {
return CMNone, false, nil
}
switch {
case bytes.HasPrefix(buf, PrefixZSTD):
reader, err := zstd.NewReader(f)
if err != nil {
return CMZStd, false, err
}
defer reader.Close()
isTar, err := IsTar(reader)
return CMZStd, isTar, err
case bytes.HasPrefix(buf, PrefixGZip):
reader, err := gzip.NewReader(f)
if err != nil {
return CMGZip, false, err
}
defer reader.Close()
isTar, err := IsTar(reader)
return CMGZip, isTar, err
case bytes.HasPrefix(buf, PrefixBzip2):
reader := bzip2.NewReader(f)
isTar, err := IsTar(reader)
return CMBZip2, isTar, err
case bytes.HasPrefix(buf, PrefixXZ):
reader, err := xz.NewReader(f)
if err != nil {
return CMXZ, false, err
}
isTar, err := IsTar(reader)
return CMXZ, isTar, err
default:
return CMUnknown, false, nil
}
}
utils/utils_test.go
View file @ 1f27f718
package utils package utils
import ( import (
"bytes"
"crypto/sha256" "crypto/sha256"
"encoding/base64" "encoding/base64"
"os/exec"
"testing" "testing"
"time" "time"
) )
...@@ -143,7 +145,7 @@ func TestGetPidChild(t *testing.T) { ...@@ -143,7 +145,7 @@ func TestGetPidChild(t *testing.T) {
t.Error(err) t.Error(err)
} }
t.Logf("%v", pids) t.Logf("%v", pids)
t.Logf("num: %d",len(pids)) t.Logf("num: %d", len(pids))
} }
func TestGetPidChild2(t *testing.T) { func TestGetPidChild2(t *testing.T) {
...@@ -155,5 +157,22 @@ func TestGetPidChild2(t *testing.T) { ...@@ -155,5 +157,22 @@ func TestGetPidChild2(t *testing.T) {
t.Error(err) t.Error(err)
} }
t.Logf("%v", pids) t.Logf("%v", pids)
t.Logf("num: %d",len(pids)) t.Logf("num: %d", len(pids))
}
func TestRunCmd(t *testing.T) {
cmd1 := exec.Command("echo", "hello world")
cmd2 := exec.Command("grep", "-o", "h.*o")
so, err := cmd1.StdoutPipe()
if err != nil {
t.Fatal(err)
}
cmd2.Stdin = so
var out bytes.Buffer
cmd2.Stdout = &out
_ = cmd1.Start()
_ = cmd2.Start()
cmd1.Wait()
cmd2.Wait()
t.Logf("%s", out.String())
} }
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment