From 6511d34ca7c4d3386f0c46c48559989282ea64ce Mon Sep 17 00:00:00 2001 From: PTah Date: Wed, 8 Jul 2026 12:25:06 +1000 Subject: [PATCH] fix: suppress sudo Telegram during SAC agent update (2.2.3-SAC) Whitelist SAC maintenance commands in ssh-monitor-perms and monitor_sudo; pre-commit uses working python on Windows. --- README.md | 2 +- contrib/hooks/pre-commit | 21 ++++++++++++++++----- docs/security-roadmap.ru.md | 1 + release/manifest-2.2.3-SAC.json | 11 +++++++++++ ssh-monitor | 6 +++++- ssh-monitor-perms.sh | 16 ++++++++++++++++ update_ssh_monitor.sh | 9 +++++---- version.txt | 2 +- 8 files changed, 56 insertions(+), 12 deletions(-) create mode 100644 release/manifest-2.2.3-SAC.json diff --git a/README.md b/README.md index f0cba27..089ff4a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # ssh-monitor -**Версия:** `2.2.2-SAC` +**Версия:** `2.2.3-SAC` Bash-мониторинг **SSH**, **sudo**, **systemd-logind**: Telegram/email, бан IP (ipset), ежедневный отчёт, heartbeat. diff --git a/contrib/hooks/pre-commit b/contrib/hooks/pre-commit index c241e25..bdb79b9 100644 --- a/contrib/hooks/pre-commit +++ b/contrib/hooks/pre-commit @@ -33,12 +33,23 @@ _agent_files_staged() { _version_bump_staged || _agent_files_staged || exit 0 -if ! command -v python3 >/dev/null 2>&1; then - echo "pre-commit: python3 нужен для manifest" >&2 - exit 1 -fi +_find_python() { + local c + for c in python3 python; do + if command -v "$c" >/dev/null 2>&1 && "$c" -c 'import sys' >/dev/null 2>&1; then + echo "$c" + return 0 + fi + done + return 1 +} -python3 "$ROOT/contrib/manifest/generate.py" +PY="$(_find_python)" || { + echo "pre-commit: python нужен для manifest (рабочий python/python3 не найден)" >&2 + exit 1 +} + +"$PY" "$ROOT/contrib/manifest/generate.py" VER="$(tr -d '\r\n' <"$ROOT/version.txt")" [ -n "$VER" ] || { echo "pre-commit: version.txt пуст — не могу добавить manifest" >&2 diff --git a/docs/security-roadmap.ru.md b/docs/security-roadmap.ru.md index 3eb4ec5..2768ea3 100644 --- a/docs/security-roadmap.ru.md +++ b/docs/security-roadmap.ru.md @@ -25,6 +25,7 @@ | **2.1.7-SAC** | Фаза 1 + выбранное из Фазы 4 | Права, `REPO_URL` обязателен, webhook, docs | ✅ реализовано | | **2.1.8-SAC** | Дополнение к 1.1 | SAC-first update: hardening прав на каждом прогоне updater | ✅ реализовано | | **2.1.9-SAC** | Дополнение к 1.x | Watchdog: `🖥️ Сервер:` в Telegram (как у агента) | ✅ реализовано | +| **2.2.3-SAC** | Дополнение к 2.2.x | Подавление sudo TG при SAC bootstrap/update | ✅ реализовано | | **2.2.1-SAC** | Дополнение к 2.2.0 | Подавление lifecycle/watchdog TG при SAC-update | ✅ реализовано | | **2.2.0-SAC** | **Фаза 2** | Manifest, pinned ref, без слепого `reset --hard` | ✅ реализовано | | **2.3.0-SAC** | Фаза 3 | Парсер конфига без `source` (minor breaking) | diff --git a/release/manifest-2.2.3-SAC.json b/release/manifest-2.2.3-SAC.json new file mode 100644 index 0000000..e5d3753 --- /dev/null +++ b/release/manifest-2.2.3-SAC.json @@ -0,0 +1,11 @@ +{ + "version": "2.2.3-SAC", + "git_commit": "", + "files": { + "ssh-monitor": "sha256:875252eb23640cbae34bcaaf71d07b091c71e04c29d5d5d5e90851083c5bfc21", + "sac-client.sh": "sha256:4c481effd0e50b3db8cfa3baf3c5f228892530939df6f534a5d3d3d8a79db048", + "update_ssh_monitor.sh": "sha256:76c610ed229d510c41ddd0d10db2b68d48c08b89eb1c8252341ce85f088bf6cd", + "ssh-monitor-watchdog": "sha256:41aa139cab0fb275249780953fceb3f8ebe01c49bf96f901dd3cf4d2fb3a9274", + "ssh-monitor-perms.sh": "sha256:a1ca9e72a9bd7162324c308849cfeebd449228c308edb03191171e9d3187658c" + } +} diff --git a/ssh-monitor b/ssh-monitor index f1e3c3e..272b667 100644 --- a/ssh-monitor +++ b/ssh-monitor @@ -7,7 +7,7 @@ IFS=$'\n\t' # ============================================ CONFIG_FILE="/etc/ssh-monitor.conf" -SSH_MONITOR_VERSION="2.2.2-SAC" +SSH_MONITOR_VERSION="2.2.3-SAC" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" if [ -f "$SCRIPT_DIR/ssh-monitor-perms.sh" ]; then @@ -1521,6 +1521,10 @@ monitor_sudo() { fi if [ -n "$user" ] && [ -n "${sudo_cmd:-}" ]; then + if ssh_monitor_sudo_is_sac_maintenance "$sudo_cmd" 2>/dev/null; then + write_log "SUDO: пропуск SAC/update maintenance ($user): ${sudo_cmd:0:80}…" + continue + fi local message=" ⚠️ ИСПОЛЬЗОВАНИЕ SUDO "$'\n' message="${message}👤 Пользователь: ${user}"$'\n' if [ -n "$run_as" ]; then diff --git a/ssh-monitor-perms.sh b/ssh-monitor-perms.sh index b7c440d..b473f48 100644 --- a/ssh-monitor-perms.sh +++ b/ssh-monitor-perms.sh @@ -205,3 +205,19 @@ ssh_monitor_update_mark_end() { f="$(ssh_monitor_update_state_file)" rm -f "$f" 2>/dev/null || true } + +# SAC/cron update: не слать sudo-alert на штатные команды updater/bootstrap. +ssh_monitor_sudo_is_sac_maintenance() { + local cmd="$1" + [ -n "$cmd" ] || return 1 + if ssh_monitor_update_in_progress 2>/dev/null; then + return 0 + fi + case "$cmd" in + *update_ssh_monitor.sh* | *UPDATE_VIA_SAC* | *update_script.log* | \ + *"/opt/scripts/update"*"ssh-monitor"* | *agent-update-in-progress*) + return 0 + ;; + esac + return 1 +} diff --git a/update_ssh_monitor.sh b/update_ssh_monitor.sh index 979d462..74d2197 100755 --- a/update_ssh_monitor.sh +++ b/update_ssh_monitor.sh @@ -1570,10 +1570,6 @@ update_script() { load_git_verify_settings load_ssh_monitor_perms_lib || true - if declare -F ssh_monitor_update_mark_begin >/dev/null 2>&1; then - ssh_monitor_update_mark_begin - log_action "agent-update: state file установлен (подавление lifecycle/watchdog)" - fi log_action "Старт обновления (deploy=$DEPLOY_MODE, debug=$DEBUG, git_ref=${GIT_REF:-$GIT_BRANCH})" debug_step "Запуск функции обновления скрипта" @@ -1757,6 +1753,11 @@ parse_command_line "$@" deploy_require_root require_repo_url +load_ssh_monitor_perms_lib || true +if declare -F ssh_monitor_update_mark_begin >/dev/null 2>&1; then + ssh_monitor_update_mark_begin +fi + if [ "$DEPLOY_MODE" -eq 1 ]; then printf '\n=== ssh-monitor: первичная установка (--deploy) ===\n' say_step "Репозиторий и файлы" diff --git a/version.txt b/version.txt index 93d6b9a..6059cf9 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -2.2.2-SAC +2.2.3-SAC