SSH安全告警微信消息提醒

Posted 2022-04-08 富哥运维

1.1 SSH安全告警微信消息提醒

1.1.1 前言

由于公司网络服务器资源限制，无法使用监控及堡垒机(防止被破会所有编写此文章)

1.1.2 服务器环境及配置说明

1.1.3 环境配置的脚本ssh_huanji.sh (次脚本在系统CentOS运行，如果需要在Ubuntu系统运行可以联系博主修改)

#!/bin/bash
##############################################################
# File Name: ss_huanji.sh
# Version: V1.0
# Author: guoxiangfu
# EMail: [e-mail]
# Created Time : 2022-03-31 15:10:19
# Description:
##############################################################
sh_home="/web_www/jiaoben/sh"
sh_smtp_mail="smtp.guoxiangfu.com:465"
form_smtp_mail="[e-mail]"
smtp_user="[e-mail]"
smtp_password="$(cat /home/smtp_password.txt)"
if [ ! -d $sh_home ]; then
        mkdir -p $sh_home
    fi
    yum install screen jq  mailx -y 
    mkdir -p /root/.certs/
    echo -n|openssl s_client -connect $sh_smtp_mail |sed -ne /-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p > ~/.certs/guoxiangfu.crt
    /usr/bin/certutil -A -n "GeoTrust SSL CA" -t "C,," -d ~/.certs -i ~/.certs/guoxiangfu.crt
    /usr/bin/certutil -A -n "GeoTrust Global CA" -t "C,," -d ~/.certs -i ~/.certs/guoxiangfu.crt
    cd  /root/.certs/
    /usr/bin/certutil -A -n "GeoTrust SSL CA - G3" -t "Pu,Pu,Pu"  -d ./ -i ./guoxiangfu.crt
    /usr/bin/certutil  -L -d /root/.certs
    echo "set from=$form_smtp_mail" >>/etc/mail.rc
    echo "set smtp=:smtps://$sh_smtp_mail" >>/etc/mail.rc
    echo "set smtp-auth-user=$smtp_user" >>/etc/mail.rc
    echo "set smtp-auth-password=$smtp_password" >>/etc/mail.rc
    echo set smtp-auth=login  >>/etc/mail.rc
    echo set ssl-verify=ignore   >>/etc/mail.rc
    echo set nss-config-dir=/root/.certs  >>/etc/mail.rc
    echo -e #!/bin/bash\\nbash /web_www/jiaoben/sh/Login92fuge.sh > /etc/ssh/sshrc

脚本说明：

sh_home 脚本工作目录

/etc/mail.rc 邮件配置地址(注意请填写自己的邮箱)

1.1.4 weixin.sh配置微信接口的脚本#!/bin/bash

#!/bin/bash
##############################################################
# File Name: weixin.sh
# Version: V5.0
# Author: guoxiangfu
# EMail: [e-mail]
# Created Time : 2022-03-31 15:15:49
# Description:
##############################################################
#set -x
CorpID="$(cat /app/userhome/wexin.txt|grep CorpID|awk -F "[ =]" print $2)"  #企业ID
Secret="$(cat /app/userhome/wexin.txt|grep Secret|awk -F "[ =]" print $2)"   #管理组凭证密钥
GETURL=https://qyapi.weixin.qq.com/cgi-bin/gettoken\\?corpid=$CorpID\\&corpsecret=$Secret
Token=$(/usr/bin/curl -s -G $GETURL |awk -F\\": print $4|awk -F\\" print $2)
#echo $Token
POSTURL="https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=$Token"
UserID=$1
#PartyID=1
agentid=1000004  #企业号中的应用id
Msg=`echo "$@" | cut -f 3`
message()
    printf \\n
    printf \\t"touser": ""$UserID"\\"",\\n"
    printf \\t"toparty": ""$PartyID"\\"",\\n"
    printf \\t"msgtype": "text",\\n
    printf \\t"agentid": ""$agentid"\\"",\\n"
    printf \\t"text": \\n
    printf \\t\\t"content": ""$Msg"\\""\\n"
    printf \\t,\\n
    printf \\t"safe":"0"\\n
    printf \\n

/usr/bin/curl    --data-ascii "$(message $1 $2 $3)" $POSTURL

1.1.5 归属地源IP的脚本ip-where.sh

1.1.6 定位地理位置的脚本ip-sswhere.sh

1.1.7 配置登录的主脚本Login92fuge.sh

1.1.8 配置ssh的重点配置文件sshrc

cat  > /etc/ssh/sshrc  << EOF
#!/bin/bash
bash /web_www/jiaoben/sh/Login92fuge.sh
EOF
chmod 644 /etc/ssh/sshrc

1.1.9 正式模拟演示登录告警

1.1.9.1  我这里使用xshell登录服务器模拟

1.1.9.2 开始登录xshell后

1.1.9.3 查询微信是否成功接收到消息通知