#include #include #include #include #include #include #include #include #include #include #include #define HOSTNAME "localhost" #define EVENT_SIZE (sizeof(struct inotify_event)) int debug = 0; struct connexion { int pid; char cmd[24]; char cmdline[1000]; char user[24]; char hostname[128]; char host_ip[42]; char host_ipv6[42]; char date[60]; }; struct config { char commande[1024]; char logfile[4096]; char hostname[128]; char configfile[4096]; }; struct notify_config { int fd; int wd; }; int explode( char * str, char * separator, size_t m, size_t n, char exploded[m][n] ) { char * pch; int x=0 ; pch = strtok( str, separator ); while( pch != NULL ) { if (debug >= 2) printf("%s\n", pch); strcpy( exploded[x++], pch) ; pch = strtok( NULL , separator ); } return x; } // config function int readconfig( struct config * cfg ) { FILE * fh = NULL; FILE * fh1 = NULL; char path[2][30] = {"/etc/sshdetect.conf", ""}; int x; int retval=0; char str[1024]; char exploded[2][1024]; char * homepath; char * buff; char logfilepath[1024]; homepath = getenv("HOME"); if ( homepath != NULL ) { sprintf( path[1], "%s%s", homepath, "/.config/sshdetect.conf" ); } sprintf( logfilepath, "%s%s", homepath, "/.local/share/sshdetect.log"); for(x=0;x<2;x++) { if ((fh = fopen( path[x], "r")) == NULL) { if (debug >= 1) perror(path[x]); retval = -1; }else { strcpy( cfg->configfile, path[x]); if (debug >= 1) printf("Found config file: %s\n", path[x]); x = 3; retval = 0; } } if (fh != NULL) { while(fgets(str, 1024, fh) != NULL) { explode(str, "= \n", 2, 1024, exploded); if ( strcmp( exploded[0], "commande") == 0 ) { if ( (fh1 = fopen(exploded[1],"r")) != NULL) { strcpy( cfg->commande, exploded[1] ); if (debug >= 1) printf("Found command: %s\n", cfg->commande); fclose(fh1); }else { if (debug >= 1) perror(exploded[1]); } }else if( strcmp( exploded[0], "logfile") == 0) { if ( (fh1 = fopen(exploded[1], "a")) != NULL ) { strcpy( cfg->logfile, exploded[1] ); if (debug >= 1) printf("Found logfile: %s\n", cfg->logfile); fclose(fh1); } }else if( strcmp( exploded[0], "hostname") == 0 ) { strcpy( cfg->hostname, exploded[1] ); if (debug >= 1 ) printf("Found hostname: %s\n", cfg->hostname); } } } if ( cfg->logfile[0] == 0 ) { if ( (fh1 = fopen("/var/log/sshdetect.log", "a")) != NULL ) { strcpy( cfg->logfile, "/var/log/sshdetect.log" ); fclose(fh1); }else if ( (fh1 = fopen(logfilepath, "a")) != NULL ) { strcpy( cfg->logfile, logfilepath ); fclose(fh1); }else { if (debug >= 1) perror(logfilepath); strcpy(cfg->logfile, "/dev/null"); retval += 2; } } if (cfg->hostname[0] == 0 ) { buff = getenv("HOSTNAME"); if ( buff != NULL) { strcpy(cfg->hostname, buff); }else { strcpy(cfg->hostname, HOSTNAME); } } if (cfg->commande[0] == 0) { if (debug >=1) printf("command not found in config file: no command will be executed\n"); retval += 4; } return retval; } //test if pid is in list of known sshd processus int isinarray( int pid, int array[], int n ) { int x; for(x=1;x<=n;x++) { if( pid == array[x]) { return x; } } return 0; } char* frtime(const time_t timet) { struct tm *date_tm; static char result[40]; date_tm = localtime(&timet); strftime(result, 40, "%c", date_tm); return result; } int init_config_watch( char config_file[], struct notify_config * ncc ) { ncc->fd = inotify_init(); if ( ncc->fd < 0 ) { perror( "inotify_init" ); return -1; } ncc->wd = inotify_add_watch( ncc->fd, config_file, IN_MODIFY | IN_DELETE ); if (ncc->wd == -1) { perror(config_file); printf("%s\n", config_file); return -2; } return 0; } int notify_config_change(struct notify_config * ncc, char config_file[], struct config * cfg) { int length=0; int i=0; int buff_length = (1024 * (EVENT_SIZE + 16)); char buff[buff_length]; fd_set rfds; struct timeval tv = {1,0}; int retval; FD_ZERO(&rfds); FD_SET(ncc->fd, &rfds); retval = select(ncc->fd+1, &rfds, NULL, NULL, &tv); if (retval == -1) { if (debug >= 1) perror("select()"); } else if (retval) { length = read(ncc->fd, buff, buff_length); if (length < 0) { if (debug >= 1) perror("reading"); return -1; } while (i < length) { struct inotify_event *event = (struct inotify_event *) &buff[i]; if (event->mask & IN_DELETE) { if (debug >= 2) printf("The file %s was deleted.\n", event->name); init_config_watch( config_file, ncc); } else if (event->mask & IN_MODIFY) { if (debug >= 2) printf("The file %s was modified.\n", event->name); readconfig(cfg); } i += EVENT_SIZE + event->len; } } return 0; } //get utmp datas void getutmp( struct connexion * conn, time_t * time ) { struct utmp * utmp; int ipv6; int ipv4; int x; char str[6]; conn->host_ip[0]='\0'; conn->host_ipv6[0]='\0'; setutent(); while ( (utmp = getutent()) != NULL ) { if ( utmp->ut_pid == conn->pid ) { sprintf(conn->user, "%s", utmp->ut_user); //got user login sprintf(conn->hostname, "%s", utmp->ut_host); //got ip of origin if((utmp->ut_addr_v6[1] && utmp->ut_addr_v6[2] && utmp->ut_addr_v6[3]) == 0) { ipv4 = utmp->ut_addr_v6[0] & 0x00000000000000ff; sprintf( str, "%d.", ipv4); strcat(conn->host_ip, str); ipv4 = (utmp->ut_addr_v6[0] & 0x000000000000ff00) >> 8; sprintf( str, "%d.", ipv4); strcat(conn->host_ip, str); ipv4 = (utmp->ut_addr_v6[0] & 0x0000000000ff0000) >> 16; sprintf( str, "%d.", ipv4); strcat(conn->host_ip, str); ipv4 = (utmp->ut_addr_v6[0] & 0x00000000ff000000) >> 24; sprintf( str, "%d", ipv4); strcat(conn->host_ip, str); }else { for (x=0;x<4;x++) { ipv6 = utmp->ut_addr_v6[x] & 0x000000000000ffff; sprintf( str, "%x:", ipv6); strcat(conn->host_ipv6, str); ipv6 = (utmp->ut_addr_v6[x] & 0x00000000ffff0000) >> 16; sprintf( str, "%x:", ipv6); strcat(conn->host_ipv6, str); ipv6 = (utmp->ut_addr_v6[x] & 0x0000ffff00000000) >> 32; sprintf( str, "%x:", ipv6); strcat(conn->host_ipv6, str); ipv6 = (utmp->ut_addr_v6[x] & 0xffff000000000000) >> 48; sprintf( str, "%x:", ipv6); strcat(conn->host_ipv6, str); } conn->host_ipv6[strlen(conn->host_ipv6)-1] = '\0'; } *time = (time_t) utmp->ut_tv.tv_sec; //got connexion time break; } } endutent(); } //replace null characters by space int null2space( char str[] ) { int flag =0; int x = 0; while ( flag == 0 ) { if ( (int) str[x] == 0 ) { if ( (int) str[x+1] != 0 ) { str[x] = ' '; }else { flag = 1; } } x++; } return x-1 ; } // get the childs pids int getpids(int pid, int exploded[]) { FILE *fh; char * pch; char path[1024]; char str[4096]; char separator[] = " "; int x = 0; sprintf( path, "/proc/%d/task/%d/children", pid, pid); if (debug >= 1) printf("process path: %s", path); if ((fh = fopen( path, "r")) == NULL) { if (debug >= 1) perror(path); return -1; } if ( fgets( str, 40, fh ) != NULL ) { pch = strtok( str, separator ); while( pch != NULL ) { if (debug >= 2) printf("%s\n", pch); exploded[x++] = atoi( pch ); pch = strtok( NULL , separator ); } fclose(fh); return x; }else { fclose(fh); return -1; } } int getprocinfo( struct connexion * conn ) { FILE *fh1; char child_path[128]; char str[1024]; int child_pid[10]; int flag = 0; int r; int level = 0; int retval = 0; char tab[128]; time_t timet=0; //get connexion time getutmp( conn, &timet ); if ( timet == 0) { time( &timet ); } sprintf( conn->date, "%s", frtime(timet) ); //get the pid of the last processus while ( flag == 0) { r = getpids( conn->pid, child_pid ); if( level == 0 && r == 2 ) { flag = 1; retval = -1; }else if ( r != -1 ) { level++; strcat(tab," "); conn->pid = child_pid[0]; }else { flag = 1; } } // get the command parameters sprintf( child_path, "/proc/%d/cmdline", conn->pid ); if ( (fh1= fopen( child_path, "r" )) == NULL) { if (debug >= 1) perror(child_path); return 2; } fgets( str, 1024, fh1); null2space( str ); sprintf(conn->cmdline, "%s", str); fclose(fh1); // get the command name sprintf( child_path, "/proc/%d/comm", conn->pid ); if ( (fh1= fopen(child_path, "r" )) == NULL) { if (debug >= 1) perror(child_path); return 3; } fscanf( fh1, "%s", conn->cmd ); fclose(fh1); return retval; } int main() { FILE *fh = NULL; FILE *fh1; int n_ssh=10; int id; int pid; int x=0; int y=0; int r=0; int i; int j; int n; int start=1; int childrens[n_ssh]; int pids[n_ssh]; int flag[n_ssh]; int rinfo; int status; char ip[42]=""; char str[1024]; char date[60]; time_t now = 0; char * language; // char * buff; struct connexion conn; struct connexion connexions[n_ssh]; struct config cfg = {"","","",""}; struct notify_config ncc; //char * ptr; // Loading configuration readconfig( &cfg ); //localizing if ( (language = getenv("LANGUAGE")) != NULL) { strtok (language, ":"); }else if ( (language = getenv("LC_ALL")) == NULL ) { language=""; } setlocale(LC_ALL,language); time( &now ); sprintf( date, "%s", frtime(now)); if ( (fh = fopen(cfg.logfile, "a")) == NULL) { if (debug >= 1) perror(cfg.logfile); return 7; } fprintf(fh, "%s: Démarrage de sshdetect\n", date); fclose(fh); sprintf( str, "%s \"%s - %s: Démarrage de sshdetect\"", cfg.commande, cfg.hostname, date ); id=fork(); if(id == 0) { if (cfg.commande[0] != 0) { r = system( str ); }else { if (debug >= 2) printf("no command defined: no command launched\n"); } exit(r); }else if( id<0 ) { if (debug >= 1) printf("erreur de création du fork: %s\n", str); } init_config_watch( cfg.configfile, &ncc); while (1) { // get the sshd process ID (PID) if ( (fh = fopen("/run/sshd.pid", "r" )) == NULL) { if (debug >= 1) perror("/run/sshd.pid"); return 1; } if ( fscanf(fh, "%i", &pid) == 0) { if (debug >= 1) printf("erreur fscanf: /run/sshd.pid\n" ); return 10; } fclose(fh); if (debug >= 1) printf("%i", pid); //get the list of children if ( (n=getpids( pid, pids )) != -1) { for ( y=0; y 0) { if ( (fh1 = fopen(cfg.logfile, "a")) == NULL) { if (debug >= 1) perror(cfg.logfile); return 7; } fprintf(fh1, "%s: Connexion de %s depuis %s commande: %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline); fclose(fh1); }else if (id < 0) { if (debug >= 1) printf("erreur de création du fork: %s\n", str); }else { if (cfg.commande[0] != 0) { if (debug >= 1) printf("%s\n", str); r = system( str ); }else { if (debug >= 1) printf("no command defined: no command launched\n"); } exit(r); } }else { if ( (fh1 = fopen(cfg.logfile, "a")) == NULL) { if (debug >= 1) perror(cfg.logfile); return 7; } fprintf(fh1, "%s: %s Connecté depuis %s - %s %s\n", conn.date, conn.user, ip, conn.cmd, conn.cmdline); fclose(fh1); } }else if (rinfo == -1) { if (debug >= 2) printf("%i => 2 pids : en cours de connexion\n", conn.pid); } }else { flag[r] = 1; } } for(i=1;i<=x;i++) { if (flag[i] == 0 ) { time( &now ); sprintf( date, "%s", frtime(now) ); if (debug >= 2) printf( "Session %d de %s terminée le %s\n", connexions[i].pid, connexions[i].user, date ); if ( (fh1 = fopen(cfg.logfile, "a")) == NULL) { if (debug >= 1) perror(cfg.logfile); return 7; } fprintf(fh1, "%s: pid %d -Connexion de %s terminée le %s\n", cfg.hostname, connexions[i].pid, connexions[i].user, connexions[i].date); for( j=i; j