PapaTramp
1928e68088
Health already used sac_base_url(); ingest used raw SAC_URL and got HTTP 405 when config had only https://host without /api/v1/events.
251 lines
6.7 KiB
Bash
251 lines
6.7 KiB
Bash
# SAC client for ssh-monitor (source from ssh-monitor)
|
|
# shellcheck shell=bash
|
|
|
|
sac_normalize_mode() {
|
|
printf '%s' "${1:-off}" | tr '[:upper:]' '[:lower:]'
|
|
}
|
|
|
|
sac_is_configured() {
|
|
[ -n "${SAC_URL:-}" ] && [ -n "${SAC_API_KEY:-}" ]
|
|
}
|
|
|
|
sac_base_url() {
|
|
local url="${SAC_URL%/}"
|
|
case "$url" in
|
|
*/api/v1/events) url="${url%/api/v1/events}" ;;
|
|
esac
|
|
printf '%s' "${url%/}"
|
|
}
|
|
|
|
# URL ingest (POST): всегда .../api/v1/events, даже если в конфиге указан только хост
|
|
sac_ingest_url() {
|
|
local base
|
|
base="$(sac_base_url)"
|
|
[ -n "$base" ] || return 1
|
|
printf '%s/api/v1/events' "$base"
|
|
}
|
|
|
|
sac_agent_instance_id() {
|
|
local id_file="${SAC_AGENT_ID_FILE:-/var/lib/ssh-monitor/agent_instance_id}"
|
|
local dir
|
|
dir="$(dirname "$id_file")"
|
|
if [ ! -d "$dir" ]; then
|
|
mkdir -p "$dir" 2>/dev/null || id_file="/tmp/ssh-monitor-agent_instance_id"
|
|
fi
|
|
if [ -f "$id_file" ]; then
|
|
cat "$id_file"
|
|
return 0
|
|
fi
|
|
local new_id
|
|
new_id="$(python3 -c 'import uuid; print(uuid.uuid4())')"
|
|
printf '%s\n' "$new_id" >"$id_file" 2>/dev/null || true
|
|
printf '%s' "$new_id"
|
|
}
|
|
|
|
sac_check_health() {
|
|
local base code
|
|
base="$(sac_base_url)"
|
|
[ -n "$base" ] || return 1
|
|
if [ "${DRY_RUN:-0}" = "1" ]; then
|
|
return 0
|
|
fi
|
|
code="$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
--connect-timeout "${SAC_TIMEOUT_SEC:-12}" \
|
|
--max-time "${SAC_TIMEOUT_SEC:-12}" \
|
|
"${base}/health" || echo 000)"
|
|
[ "$code" = "200" ]
|
|
}
|
|
|
|
sac_spool_write() {
|
|
local event_id="$1"
|
|
local body="$2"
|
|
local dir="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
|
|
mkdir -p "$dir" 2>/dev/null || return 1
|
|
printf '%s' "$body" >"${dir}/${event_id}.json"
|
|
}
|
|
|
|
sac_spool_remove() {
|
|
local event_id="$1"
|
|
local dir="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
|
|
rm -f "${dir}/${event_id}.json"
|
|
}
|
|
|
|
# send_sac_event type severity title summary [details_json]
|
|
sac_send_event() {
|
|
local event_type="$1"
|
|
local severity="$2"
|
|
local title="$3"
|
|
local summary="$4"
|
|
local details_json="${5:-}"
|
|
|
|
if ! sac_is_configured; then
|
|
write_log "WARN: SAC не настроен (SAC_URL / SAC_API_KEY)"
|
|
return 1
|
|
fi
|
|
|
|
if [ "${DRY_RUN:-0}" = "1" ]; then
|
|
printf '[DRY-RUN SAC] %s | %s | %s\n' "$event_type" "$severity" "$title" >&2
|
|
return 0
|
|
fi
|
|
|
|
local payload http_code event_id
|
|
payload="$(SAC_EVENT_TYPE="$event_type" \
|
|
SAC_SEVERITY="$severity" \
|
|
SAC_TITLE="$title" \
|
|
SAC_SUMMARY="$summary" \
|
|
SAC_DETAILS_JSON="$details_json" \
|
|
SAC_AGENT_ID="$(sac_agent_instance_id)" \
|
|
SAC_PRODUCT_VERSION="${SSH_MONITOR_VERSION:-unknown}" \
|
|
python3 <<'PY'
|
|
import json, os, socket, uuid
|
|
from datetime import datetime, timezone
|
|
|
|
def details():
|
|
raw = os.environ.get("SAC_DETAILS_JSON", "").strip()
|
|
if not raw:
|
|
return None
|
|
return json.loads(raw)
|
|
|
|
host = socket.gethostname()
|
|
etype = os.environ["SAC_EVENT_TYPE"]
|
|
if etype.startswith(("ssh.", "auth.", "rdp.")):
|
|
category = "auth"
|
|
elif etype.startswith("privilege."):
|
|
category = "privilege"
|
|
elif etype.startswith("session."):
|
|
category = "session"
|
|
elif etype.startswith("report."):
|
|
category = "report"
|
|
elif etype.startswith("rdg."):
|
|
category = "network"
|
|
else:
|
|
category = "agent"
|
|
payload = {
|
|
"schema_version": "1.0",
|
|
"event_id": str(uuid.uuid4()),
|
|
"occurred_at": datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds"),
|
|
"source": {
|
|
"product": "ssh-monitor",
|
|
"product_version": os.environ.get("SAC_PRODUCT_VERSION", "unknown"),
|
|
"agent_instance_id": os.environ["SAC_AGENT_ID"],
|
|
},
|
|
"host": {
|
|
"hostname": host,
|
|
"os_family": "linux",
|
|
},
|
|
"category": category,
|
|
"type": os.environ["SAC_EVENT_TYPE"],
|
|
"severity": os.environ["SAC_SEVERITY"],
|
|
"title": os.environ["SAC_TITLE"],
|
|
"summary": os.environ["SAC_SUMMARY"],
|
|
}
|
|
d = details()
|
|
if d is not None:
|
|
payload["details"] = d
|
|
print(json.dumps(payload, ensure_ascii=False))
|
|
PY
|
|
)" || return 1
|
|
|
|
event_id="$(printf '%s' "$payload" | python3 -c 'import json,sys; print(json.load(sys.stdin)["event_id"])')"
|
|
|
|
local tmp resp
|
|
tmp="$(mktemp)"
|
|
resp="$(mktemp)"
|
|
printf '%s' "$payload" >"$tmp"
|
|
http_code="$(curl -sS -o "$resp" -w '%{http_code}' \
|
|
-X POST "$(sac_ingest_url)" \
|
|
-H "Authorization: Bearer ${SAC_API_KEY}" \
|
|
-H "Content-Type: application/json" \
|
|
-H "Idempotency-Key: ${event_id}" \
|
|
--connect-timeout "${SAC_TIMEOUT_SEC:-12}" \
|
|
--max-time "${SAC_TIMEOUT_SEC:-12}" \
|
|
-d @"$tmp" 2>/dev/null || echo 000)"
|
|
rm -f "$tmp"
|
|
|
|
if [ "$http_code" = "202" ]; then
|
|
sac_spool_remove "$event_id" 2>/dev/null || true
|
|
write_log "SAC: принято event_id=$event_id type=$event_type"
|
|
return 0
|
|
fi
|
|
|
|
write_log "WARN: SAC POST HTTP $http_code: $(tr '\n' ' ' <"$resp" | head -c 200)"
|
|
sac_spool_write "$event_id" "$payload"
|
|
return 1
|
|
}
|
|
|
|
# JSON details из переменных SAC_D_* (опционально)
|
|
sac_build_details_json() {
|
|
python3 <<'PY'
|
|
import json, os
|
|
out = {}
|
|
for k, v in os.environ.items():
|
|
if k.startswith("SAC_D_") and v:
|
|
out[k[6:].lower()] = v
|
|
print(json.dumps(out) if out else "")
|
|
PY
|
|
}
|
|
|
|
# notify_or_sac type severity title summary telegram_message [details_json]
|
|
notify_or_sac() {
|
|
local event_type="$1"
|
|
local severity="$2"
|
|
local title="$3"
|
|
local summary="$4"
|
|
local telegram_message="${5:-$summary}"
|
|
local details_json="${6:-}"
|
|
if [ -z "$details_json" ] && [ -n "${SAC_D_USER:-}${SAC_D_IP:-}${SAC_D_COMMAND:-}" ]; then
|
|
details_json="$(sac_build_details_json)"
|
|
fi
|
|
unset SAC_D_USER SAC_D_IP SAC_D_COMMAND SAC_D_ATTEMPT SAC_D_MAX SAC_D_RUN_AS SAC_D_PWD 2>/dev/null || true
|
|
local mode
|
|
mode="$(sac_normalize_mode "${UseSAC:-off}")"
|
|
|
|
case "$mode" in
|
|
off)
|
|
notify_send "$telegram_message"
|
|
;;
|
|
exclusive)
|
|
sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json"
|
|
;;
|
|
dual)
|
|
sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json" || true
|
|
NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"
|
|
;;
|
|
fallback)
|
|
if sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json"; then
|
|
return 0
|
|
fi
|
|
NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"
|
|
;;
|
|
*)
|
|
write_log "WARN: неизвестный UseSAC=$mode, только Telegram"
|
|
notify_send "$telegram_message"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
run_check_sac() {
|
|
printf 'Проверка SAC (ssh-monitor)\n'
|
|
printf 'UseSAC=%s\n' "${UseSAC:-off}"
|
|
printf 'SAC_URL=%s\n' "${SAC_URL:-}"
|
|
if sac_is_configured; then
|
|
printf 'SAC ingest URL=%s\n' "$(sac_ingest_url)"
|
|
fi
|
|
if ! sac_is_configured; then
|
|
printf 'SAC: SAC_URL или SAC_API_KEY не заданы\n' >&2
|
|
return 1
|
|
fi
|
|
if sac_check_health; then
|
|
printf 'SAC health: OK\n'
|
|
else
|
|
printf 'SAC health: FAIL\n' >&2
|
|
return 1
|
|
fi
|
|
if sac_send_event "agent.test" "info" "SAC test" "ssh-monitor --check-sac"; then
|
|
printf 'SAC ingest agent.test: OK (ожидается HTTP 202)\n'
|
|
return 0
|
|
fi
|
|
printf 'SAC ingest agent.test: FAIL\n' >&2
|
|
return 1
|
|
}
|