SSH安全微信告警

下载详细文档## SSH安全告警微信消息提醒

1.1 SSH安全告警微信消息提醒

1.1.1 前言

由于公司网络服务器资源限制，无法使用监控及堡垒机(防止被攻击所有编写此文章)

1.1.2 服务器环境及配置说明

1.1.3 环境配置的脚本ssh_huanji.sh (本次在系统CentOS运行，如果需要在Ubuntu系统运行可以联系作者修改)

#!/bin/bash
##############################################################
# File Name: ss_huanji.sh
# Version: V1.0
# Author: guoxiangfu
# EMail: guoxiangfu@92fuge.com
# Created Time : 2022-03-31 15:10:19
# Description:
##############################################################
sh_home="/web_www/jiaoben/sh"
sh_smtp_mail="smtp.guoxiangfu.com:465"
form_smtp_mail="guoxiangfu@guoxiangfu.com"
smtp_user="guoxiangfu@92fuge.com"
smtp_password="$(cat /home/smtp_password.txt)"
if [ ! -d ${sh_home} ]; then
	    mkdir -p ${sh_home}
    fi
    yum install screen jq  mailx -y 
    mkdir -p /root/.certs/
    echo -n|openssl s_client -connect $sh_smtp_mail |sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/.certs/guoxiangfu.crt
    /usr/bin/certutil -A -n "GeoTrust SSL CA" -t "C,," -d ~/.certs -i ~/.certs/guoxiangfu.crt
    /usr/bin/certutil -A -n "GeoTrust Global CA" -t "C,," -d ~/.certs -i ~/.certs/guoxiangfu.crt
    cd  /root/.certs/
    /usr/bin/certutil -A -n "GeoTrust SSL CA - G3" -t "Pu,Pu,Pu"  -d ./ -i ./guoxiangfu.crt
    /usr/bin/certutil  -L -d /root/.certs
    echo "set from=$form_smtp_mail" >>/etc/mail.rc
    echo "set smtp=:smtps://$sh_smtp_mail" >>/etc/mail.rc
    echo "set smtp-auth-user=$smtp_user" >>/etc/mail.rc
    echo "set smtp-auth-password=$smtp_password" >>/etc/mail.rc
    echo 'set smtp-auth=login'  >>/etc/mail.rc
    echo 'set ssl-verify=ignore '  >>/etc/mail.rc
    echo 'set nss-config-dir=/root/.certs ' >>/etc/mail.rc
    echo -e '#!/bin/bash\nbash /web_www/jiaoben/sh/Login92fuge.sh' > /etc/ssh/sshrc

脚本说明： sh_home 脚本工作目录
/etc/mail.rc 邮件配置地址(注意请填写自己的邮箱)

#1.1.4 weixin.sh配置微信的脚本

#!/bin/bash
##############################################################
# File Name: weixin.sh
# Version: V5.0
# Author: guoxiangfu
# EMail: guoxiangfu@92fuge.com
# Created Time : 2022-03-31 15:15:49
# Description:
##############################################################
#set -x
CorpID="$(cat /app/userhome/wexin.txt|grep CorpID|awk -F "[ =]" '{print $2}')"  #企业ID
Secret="$(cat /app/userhome/wexin.txt|grep Secret|awk -F "[ =]" '{print $2}')"   #管理组凭证密钥
GETURL=https://qyapi.weixin.qq.com/cgi-bin/gettoken\?corpid=$CorpID\&corpsecret=$Secret
Token=$(/usr/bin/curl -s -G $GETURL |awk -F\": '{print $4}'|awk -F\" '{print $2}')
#echo $Token
POSTURL="https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=$Token"
UserID=$1
#PartyID=1
agentid=1000004  #企业号中的应用id
Msg=`echo "$@" | cut -f 3`
message(){
    printf '{\n'
    printf '\t"touser": "'"$UserID"\"",\n"
    printf '\t"toparty": "'"$PartyID"\"",\n"
    printf '\t"msgtype": "text",\n'
    printf '\t"agentid": "'"$agentid"\"",\n"
    printf '\t"text": {\n'
    printf '\t\t"content": "'"$Msg"\""\n"
    printf '\t},\n'
    printf '\t"safe":"0"\n'
    printf '}\n'
}
/usr/bin/curl    --data-ascii "$(message $1 $2 $3)" $POSTURL

1.1.5 归属地IP的脚本ip-where.sh

1.1.6 来源地位置的脚本ip-sswhere.sh

#1.1.7 配置的主脚本Login92fuge.sh

#1.1.8 配置ssh的配置文件sshrc

cat  > /etc/ssh/sshrc  << EOF
#!/bin/bash
bash /web_www/jiaoben/sh/Login92fuge.sh
EOF
chmod 644 /etc/ssh/sshrc

1.1.9 登录告警

1.1.9.1 我这里使用xshell登录服务器模拟

1.1.9.2 开始登录xshell后

1.1.9.3 查询微信是否成功接收到消息通知