Implementation method and device of audit playback of a bastion

Abstract

The present disclosure provides an implementation method and device for audit playback of a bastion host, wherein the method comprises: obtaining a pseudo login shell script for calling screen recording software; configuring a user login session to be bound to the pseudo login shell script; and automatically creating a directory and recording a monitoring record file through the pseudo login shell script. The present disclosure can highly restore the user operation site, ensure the integrity of each file and record, and improve the flexibility of file organization mode and the positioning efficiency.

Description

Technical Field

[0001] This document relates to the field of network security technology, and in particular to a method and apparatus for implementing audit playback of a bastion host. Background Technology

[0002] The rapid expansion of network scale and the number of devices pose significant risks to information system security. Bastion hosts use various technical means to collect and monitor the system status, security time, and network activities of every component in the network environment in real time, so as to promptly audit and assign responsibility and handle network security-related issues.

[0003] Currently, there are two main methods for recording audit logs on bastion hosts: one is to record the ASCII codes of the keyboard to a file, and the other is to use the script tools built into the Linux system for screen recording. However, the above two technical solutions have the following problems: recording the ASCII codes of the keyboard does not echo the command operations, making it difficult to reconstruct the operation situation; the log files saved by using script screen recordings have a limited format and are not easy to search.

[0004] Based on the above analysis of the development status of this technology field, existing technologies lack solutions that can highly reproduce the user's operation process and quickly locate saved records. Summary of the Invention

[0005] The purpose of this invention is to provide a method and apparatus for implementing audit playback of a bastion host, aiming to solve the above-mentioned problems in the prior art.

[0006] According to a first aspect of the present disclosure, a method for implementing audit playback of a bastion host is provided, comprising:

[0007] Obtain the pseudo-login shell script that invokes the screen recording software; configure the user login session to be bound to the pseudo-login shell script; and autonomously create a directory and record a listening log file through the pseudo-login shell script.

[0008] According to a second aspect of the present disclosure, an apparatus for implementing audit playback of a bastion host is provided, comprising:

[0009] The module includes an acquisition module for acquiring the pseudo-login shell script that invokes the screen recording software; a binding module for configuring the user login session to be bound to the pseudo-login shell script; and a monitoring module for autonomously creating a directory and recording monitoring log files through the pseudo-login shell script.

[0010] The technical solutions provided by the embodiments of this disclosure may include the following beneficial effects: by binding the login session with the pseudo login shell, the integrity of each file and record is guaranteed, the degree of restoration of the user's operation scene is improved, and the efficiency of finding and locating saved record files is improved by autonomously creating directories through shell scripts.

[0011] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of the bastion host audit playback implementation method according to an embodiment of the present invention;

[0014] Figure 2 This is a login flowchart of the bastion host audit replay implementation device according to an embodiment of the present invention;

[0015] Figure 3 This is a schematic diagram of the bastion host audit playback implementation device according to an embodiment of the present invention. Detailed Implementation

[0016] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0017] Method Implementation Examples

[0018] According to an embodiment of the present invention, a method for implementing audit playback of a bastion host is provided. Figure 1 This is a flowchart of the bastion host audit playback implementation method according to an embodiment of the present invention, as follows: Figure 1 As shown, the bastion host audit replay implementation method according to an embodiment of the present invention specifically includes:

[0019] In step S110, a pseudo login shell script that calls the screen recording software is obtained. The script can directly call screen recording software such as script, asciinema, etc.

[0020] In step S120, the user login session is configured to be bound to the pseudo login shell script, ensuring that if either the login session or the pseudo login shell script is interrupted, the entire session will be interrupted.

[0021] In step S130, the pseudo-login shell script autonomously creates a directory and records a monitoring file. This creation and recording can be based on factors such as the login host address, username, date, and time. The Linux handle signal of the directory where the monitoring file is stored is listened to, and this multi-factor information is synchronized to the Redis server to accelerate the search speed.

[0022] The technical solutions of the embodiments of the present invention will be illustrated below with reference to the accompanying drawings.

[0023] Figure 2 This is a login flowchart of the bastion host audit playback implementation device according to an embodiment of the present invention, as follows: Figure 2 As shown, the process involves login, session binding, and anomaly detection. The specific process is as follows: After the user logs in, their information is verified. If verification is successful, a login shell is initiated and bound to the user's session. Simultaneously, a multi-dimensional directory structure is created, and user actions are recorded in real-time and written to a file. If a timeout, user logout, or other abnormal operations are detected, the pseudo-shell is disconnected, and the login session is automatically terminated. If verification fails, relevant login and error information is recorded, and the process ends.

[0024] In summary, the above technical solutions of this invention propose a method for auditing and replaying a bastion host. The method records the input and output of commands, which can highly restore the user's operation scene and effectively enhance security. The binding of the user login session and the pseudo login shell ensures the integrity of each file and record, ensuring that screen recording starts when the user logs in and stops when the user logs out. The multi-factor organization of the directory improves flexibility and can be flexibly configured according to the scenario and elements. At the same time, the creation of file handle signals synchronizes to Redis to accelerate the search efficiency.

[0025] Device Examples

[0026] According to an embodiment of the present invention, an apparatus for implementing audit playback of a bastion host is provided. Figure 3 This is a schematic diagram of the bastion host audit playback implementation device according to an embodiment of the present invention, as shown below. Figure 3 As shown, the bastion host audit playback implementation device according to an embodiment of the present invention specifically includes:

[0027] Module 30 is used to obtain the pseudo-login shell script that calls the screen recording software. The script can directly call screen recording software such as script, asciinema, etc.

[0028] The binding module 32 is used to configure the user login session to be bound to the pseudo login shell script, so that if either the login session or the pseudo login shell script is interrupted, the entire session will be interrupted.

[0029] The listening module 34 is used by the pseudo-login shell script to autonomously create directories and record listening files. It can create and record directories based on login host address, username, date, time, and other event factors. It listens for Linux handle signals of the directory where the logging file is stored and synchronizes this multi-factor information to the Redis server, accelerating the search speed.

[0030] The embodiments of the present invention are device embodiments corresponding to the above method embodiments. The specific operation of each module can be understood with reference to the description of the method embodiments, and will not be repeated here.

[0031] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for implementing audit playback of a bastion host, characterized in that, include: Obtain the pseudo-login shell script that invokes the screen recording software; If the user login session or the pseudo login shell script is interrupted, the entire session is interrupted, and the user login session is configured to be bound to the pseudo login shell script. The pseudo-login shell script autonomously creates directories and records listening log files, specifically including: autonomously creating directories and recording listening log files based on event factors using the pseudo-login shell script, storing the listening log files in the Linux handle signal of the directory, wherein the event factors specifically include: login host address, login username, and / or login date and time; and synchronizing the relevant event factors to the Redis server.

2. A device for implementing audit playback of a bastion host, characterized in that, include: The acquisition module is used to acquire the pseudo-login shell script that calls the screen recording software; The binding module is used to interrupt the entire session when the user login session or the pseudo login shell script is interrupted, and to configure the user login session to be bound to the pseudo login shell script. The monitoring module is used to autonomously create directories and record monitoring log files via the pseudo-login shell script; specifically, it is used for: The pseudo-login shell script autonomously creates directories and records listening log files based on event factors, storing the listening log files in the Linux handle signal of the directory. The event factors specifically include: login host address, login username, and / or login date and time. The relevant event factors are synchronized to the Redis server.

Images