fix: SSH sudo without TTY for non-root Linux admin (0.11.1)

Probe commands run without sudo; privileged update uses sudo -S. Add SSH connect and Linux admin API tests.

backend/app/services/ssh_connect.py

@@ -67,11 +67,25 @@ def _truncate_output(text: str) -> str:
     return text[:SSH_OUTPUT_MAX_LEN] + "\n… (truncated)"
 
 
-def _remote_shell_command(user: str, remote_cmd: str) -> str:
-    safe_cmd = remote_cmd.replace("'", "'\"'\"'")
-    if user == "root":
-        return f"bash -lc '{safe_cmd}'"
-    return f"bash -lc 'sudo -n {safe_cmd} 2>/dev/null || sudo {safe_cmd}'"
+def _shell_single_quote(value: str) -> str:
+    return "'" + value.replace("'", "'\"'\"'") + "'"
+
+
+def _remote_shell_command(
+    user: str,
+    remote_cmd: str,
+    password: str,
+    *,
+    need_root: bool = False,
+) -> str:
+    """Build remote shell command. Sudo only when need_root and user is not root."""
+    safe_cmd = _shell_single_quote(remote_cmd)
+    if user == "root" or not need_root:
+        return f"bash -lc {safe_cmd}"
+
+    safe_pw = _shell_single_quote(password)
+    inner = f"printf '%s\\n' {safe_pw} | sudo -S -p '' bash -lc {safe_cmd}"
+    return f"bash -lc {_shell_single_quote(inner)}"
 
 
 def run_ssh_command(
@@ -82,6 +96,7 @@ def run_ssh_command(
     remote_cmd: str,
     connect_timeout_sec: int = 15,
     command_timeout_sec: int = 600,
+    need_root: bool = False,
 ) -> SshCommandResult:
     target = target.strip()
     user = user.strip()
@@ -95,7 +110,7 @@ def run_ssh_command(
 
     client = paramiko.SSHClient()
     client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    shell_cmd = _remote_shell_command(user, remote_cmd)
+    shell_cmd = _remote_shell_command(user, remote_cmd, password, need_root=need_root)
 
     try:
         client.connect(
@@ -209,4 +224,5 @@ def run_ssh_monitor_update(
         password=password,
         remote_cmd=script,
         command_timeout_sec=900,
+        need_root=True,
     )

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.11.0"
+APP_VERSION = "0.11.1"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"