DTux/dtux__sshdetect
Archived
1
0
Fork 0
Code

debug

Browse Source
This commit is contained in:
Daniel Tartavel 2020-05-13 18:55:48 +02:00
parent df4e9ec09d
commit 5c8bcb434c
2 changed files with 174 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

228
main.c
View File

@ -8,8 +8,9 @@
#include <utmp.h> #include <utmp.h>
#include <locale.h> #include <locale.h>
#include <libgen.h> #include <libgen.h>
#include <libconfig.h>
#define HOSTNAME "lalis" #define HOSTNAME "localhost"
struct connexion struct connexion
{ {
@ -24,6 +25,121 @@ struct connexion
}; };
struct config
{
char commande[1024];
char logfile[4096];
char hostname[128];
};
int explode( char * str, char * separator, size_t m, size_t n, char exploded[m][n] )
{
char * pch;
int x=0 ;
pch = strtok( str, separator );
while( pch != NULL )
{
//printf("%s\n", pch);
strcpy( exploded[x++], pch) ;
pch = strtok( NULL , separator );
}
return x;
}
// config function
int readconfig( struct config * cfg )
{
FILE * fh = NULL;
char path[2][30] = {"/etc/sshdetect.conf", ""};
int x;
int retval=0;
char str[1024];
char exploded[2][1024];
char * homepath;
char * buff;
char logfilepath[1024];
homepath = getenv("HOME");
if ( homepath != NULL )
{
sprintf( path[1], "%s%s", homepath, "/.config/sshdetect.conf" );
}
sprintf( logfilepath, "%s%s", homepath, "/.locale/share/sshdetect.log");
for(x=0;x<2;x++)
{
if ((fh = fopen( path[x], "r")) == NULL)
{
perror(path[x]);
if(x==1) retval = -1;
}else
{
printf("Found config file: %s\n", path[x]);
x = 3;
}
}
if (fh != NULL)
{
while(fgets(str, 1024, fh) != NULL)
{
explode(str, "= \n", 2, 1024, exploded);
if ( strcmp( exploded[0], "commande") == 0 )
{
if ( fopen(exploded[1],"r") != NULL)
{
strcpy( cfg->commande, exploded[1] );
printf("Found command: %s\n", cfg->commande);
}else
{
perror(exploded[1]);
}
}else if( strcmp( exploded[0], "logfile") == 0)
{
sprintf( logfilepath, "%s%s", homepath, "/.config/sshdetect.log");
if ( fopen(exploded[1], "a") != NULL )
{
strcpy( cfg->logfile, exploded[1] );
}
}else if( strcmp( exploded[0], "hostname") == 0 )
{
strcpy( cfg->hostname, exploded[1] );
}
}
}
if ( cfg->logfile[0] == 0 )
{
if ( fopen("/var/log/sshdetect.log", "a") != NULL )
{
strcpy( cfg->logfile, "/var/log/sshdetect.log" );
}else if ( fopen(logfilepath, "a") != NULL )
{
strcpy( cfg->logfile, logfilepath );
}else
{
perror(logfilepath);
strcpy(cfg->logfile, "/dev/null");
retval += 2;
}
}
if (cfg->hostname[0] == 0 )
{
buff = getenv("HOSTNAME");
if ( buff != NULL)
{
strcpy(cfg->hostname, buff);
}else
{
strcpy(cfg->hostname, HOSTNAME);
}
}
if (cfg->commande[0] == 0)
{
printf("command not found: no command will be executed");
retval += 4;
}
return retval;
}
//test if pid is in lsit of known sshd processus //test if pid is in lsit of known sshd processus
int isinarray( int pid, int array[], int n ) int isinarray( int pid, int array[], int n )
@ -119,7 +235,8 @@ int null2space( char str[] )
if ( (int) str[x+1] != 0 ) if ( (int) str[x+1] != 0 )
{ {
str[x] = ' '; str[x] = ' ';
}else }elsemv /etc/ssh/sshrc /etc/ssh/sshrc.old
{ {
flag = 1; flag = 1;
} }
@ -151,7 +268,7 @@ int getpids(int pid, int exploded[])
pch = strtok( str, separator ); pch = strtok( str, separator );
while( pch != NULL ) while( pch != NULL )
{ {
printf("%s\n", pch); //printf("%s\n", pch);
exploded[x++] = atoi( pch ); exploded[x++] = atoi( pch );
pch = strtok( NULL , separator ); pch = strtok( NULL , separator );
@ -176,6 +293,7 @@ int getprocinfo( struct connexion * conn )
int r; int r;
int level = 0; int level = 0;
int retval = 0; int retval = 0;
char tab[128];
time_t timet=0; time_t timet=0;
//get connexion time //get connexion time
@ -197,6 +315,7 @@ int getprocinfo( struct connexion * conn )
}else if ( r != -1 ) }else if ( r != -1 )
{ {
level++; level++;
strcat(tab," ");
conn->pid = child_pid[0]; conn->pid = child_pid[0];
}else }else
{ {
@ -212,7 +331,6 @@ int getprocinfo( struct connexion * conn )
return 2; return 2;
} }
fgets( str, 1024, fh1); fgets( str, 1024, fh1);
flag = 0;
null2space( str ); null2space( str );
sprintf(conn->cmdline, "%s", str); sprintf(conn->cmdline, "%s", str);
fclose(fh1); fclose(fh1);
@ -230,14 +348,14 @@ int getprocinfo( struct connexion * conn )
int main() int main()
{ {
FILE *fh; FILE *fh = NULL;
FILE *fh1; FILE *fh1;
int n_ssh=10; int n_ssh=10;
int id; int id;
int pid; int pid;
int x=0; int x=0;
int y=0; int y=0;
int r; int r=0;
int i; int i;
int j; int j;
int n; int n;
@ -247,64 +365,50 @@ int main()
int flag[n_ssh]; int flag[n_ssh];
int rinfo; int rinfo;
int status; int status;
char commande[] = "/usr/local/bin/send_sms";
char logfile[] = "/var/log/sshdetect.log";
// char cmd[24];
// char cmdline[1000];
// char user[24]="";
char hostname[128];
char ip[42]=""; char ip[42]="";
// char host_ip[42]="";
// char host_ipv6[42]="";
char str[1024]; char str[1024];
char date[60]; char date[60];
time_t now ; time_t now = 0;
char * locale;
char * language; char * language;
char * buff; char * buff;
struct connexion conn; struct connexion conn;
struct connexion connexions[n_ssh]; struct connexion connexions[n_ssh];
struct config cfg = {"","",""};
//char * ptr; //char * ptr;
if ( (fh = fopen(logfile, "a")) == NULL) readconfig( &cfg );
{
perror(logfile);
buff = basename(logfile);
sprintf( logfile, "%s%s", "~/.local/share/", buff);
if( (fh = fopen(logfile, "a")))
{
perror(logfile);
return 1;
}
return 0;
}
buff = getenv("HOSTNAME"); //localizing
if ( buff != NULL) if ( (language = getenv("LANGUAGE")) != NULL)
{ {
strcpy(hostname, buff); strtok (language, ":");
}else }else if ( (language = getenv("LC_ALL")) == NULL )
{ {
strcpy(hostname, HOSTNAME); language="";
} }
setlocale(LC_ALL,language);
language = getenv("LANGUAGE");
strtok (language, ":");
locale = setlocale(LC_ALL,language);
time( &now ); time( &now );
sprintf( date, "%s", frtime(now)); sprintf( date, "%s", frtime(now));
if ( (fh = fopen(logfile, "a")) == NULL) if ( (fh = fopen(cfg.logfile, "a")) == NULL)
{ {
perror(logfile); perror(cfg.logfile);
return 1; return 7;
} }
fprintf(fh, "%s: Démarrage de sshdetect\n", date); fprintf(fh, "%s: Démarrage de sshdetect\n", date);
fclose(fh); fclose(fh);
sprintf( str, "%s \"%s - %s: Démarrage de sshdetect\"", commande, HOSTNAME, date ); sprintf( str, "%s \"%s - %s: Démarrage de sshdetect\"", cfg.commande, cfg.hostname, date );
id=fork(); id=fork();
if(id == 0) if(id == 0)
{ {
r = system( str ); if (cfg.commande[0] != 0)
{
r = system( str );
}else
{
printf("no command defined: no command launched\n");
}
exit(r); exit(r);
}else if( id<0 ) }else if( id<0 )
{ {
@ -356,42 +460,52 @@ int main()
if (conn.user[0] == '\0') if (conn.user[0] == '\0')
{ {
sprintf( str, "%s \"%s: tunnel ouvert le %s depuis %s avec la commande: %s %s\"", commande, hostname, conn.date, ip, conn.cmd, conn.cmdline ); sprintf( str, "%s \"%s: tunnel ouvert le %s depuis %s avec la commande: %s %s\"", cfg.commande, cfg.hostname, conn.date, ip, conn.cmd, conn.cmdline );
}else }else
{ {
sprintf( str, "%s \"%s: %s s'est connecté le %s depuis %s avec la commande: %s %s\"", commande, hostname, conn.user, conn.date, ip, conn.cmd, conn.cmdline ); sprintf( str, "%s \"%s: %s s'est connecté le %s depuis %s avec la commande: %s %s\"", cfg.commande, cfg.hostname, conn.user, conn.date, ip, conn.cmd, conn.cmdline );
} }
if ( start != 1 ) if ( start != 1 )
{ {
id=fork(); id=fork();
if(id>0) if(id > 0)
{ {
if ( (fh1 = fopen(logfile, "a")) == NULL) if ( (fh1 = fopen(cfg.logfile, "a")) == NULL)
{ {
perror(logfile); perror(cfg.logfile);
return 7; return 7;
} }
fprintf(fh1, "%s: Connexion de %s depuis %s commande: %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline); fprintf(fh1, "%s: Connexion de %s depuis %s commande: %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline);
fclose(fh1); fclose(fh1);
}else if (id<0) }else if (id < 0)
{ {
printf("erreur de création du fork: %s\n", str); printf("erreur de création du fork: %s\n", str);
}else }else
{ {
printf("%s\n", str); if (cfg.commande[0] != 0)
r = system( str ); {
exit (r); printf("%s\n", str);
r = system( str );
}else
{
printf("no command defined: no command launched\n");
}
exit(r);
} }
}else }else
{ {
if ( (fh1 = fopen(logfile, "a")) == NULL) if ( (fh1 = fopen(cfg.logfile, "a")) == NULL)
{ {
perror(logfile); perror(cfg.logfile);
return 7; return 7;
} }
fprintf(fh1, "%s: %s Connecté depuis %s - %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline); fprintf(fh1, "%s: %s Connecté depuis %s - %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline);
fclose(fh1); fclose(fh1);
} }
}else if (rinfo == -1)
{
printf("%i => 2 pids : en cours de connexion\n", conn.pid);
} }
}else }else
{ {
@ -403,14 +517,14 @@ int main()
if (flag[i] == 0 ) if (flag[i] == 0 )
{ {
time( &now ); time( &now );
sprintf( date, "%s", frtime(now)); sprintf( date, "%s", frtime(now) );
printf("Session %d de %s terminée le %s\n", connexions[i].pid, connexions[i].user, date); printf( "Session %d de %s terminée le %s\n", connexions[i].pid, connexions[i].user, date );
if ( (fh1 = fopen(logfile, "a")) == NULL) if ( (fh1 = fopen(cfg.logfile, "a")) == NULL)
{ {
perror(logfile); perror(cfg.logfile);
return 7; return 7;
} }
fprintf(fh1, "%s: pid %d -Connexion de %s terminée le %s\n", hostname, connexions[i].pid, connexions[i].user, connexions[i].date); fprintf(fh1, "%s: pid %d -Connexion de %s terminée le %s\n", cfg.hostname, connexions[i].pid, connexions[i].user, connexions[i].date);
for( j=i; j<x; j++ ) for( j=i; j<x; j++ )
{ {
childrens[j] = childrens[j+1]; childrens[j] = childrens[j+1];

3
sshdetect.conf Normal file
View File

@ -0,0 +1,3 @@
hostname = portable
commande = /usr/local/bin/send_sms
#logfile = /var/log/sshdetect1.log