High-risk command identification method and device of bastion host, computer equipment and storage medium
By setting up a character module and loading custom rules for session state transitions in the bastion host, the problem of low accuracy in identifying high-risk commands is solved, improving the command control capabilities and user experience of the bastion host.
Patent Information
- Application Number
- CN202510933041.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-07
- Publication Date
- 2025-11-07
AI Technical Summary
Existing bastion hosts have low accuracy in identifying high-risk commands, which affects command control capabilities and user experience.
Configure a character module in the bastion host, including an SSH server, a core processing module, and an SSH client. After the session starts, load the custom rules corresponding to the target device into the output state processor, and use the echo data and custom rules to perform session state transitions to accurately identify high-risk commands.
It improves the accuracy of high-risk command identification, enhances the command control capabilities of the bastion host, and improves the user experience.
Smart Images
Figure CN120910848A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of bastion hosts, and in particular to a high-risk command identification method and device for a bastion host, a computer device, and a storage medium. BACKGROUND
[0002] A bastion host is a technology that is used to monitor and record the operation behavior of an operation and maintenance personnel on a server, network device, security device, database, and the like in a network in order to protect the network and data from intrusion and damage from external and internal users.
[0003] The current bastion host forwards and analyzes the traffic of both parties by using a built-in character module after establishing a session, so as to achieve the purpose of monitoring the session. The current high-risk command identification is performed when a user submits a command. The character module identifies whether the user submits a command based on whether the user inputs a carriage return (the character module considers that the user submits a command only when the user inputs a carriage return). For example, the user inputs a carriage return in the interactive command line of vi or vim, and actually does not submit a command, but only edits content. At this time, if the high-risk command identification is triggered, the normal editing content of the user is identified as a high-risk command. This reduces the accuracy of high-risk command identification, reduces the command control ability of the bastion host, and affects the user experience.
[0004] There is no effective solution to the low accuracy of high-risk command identification, the reduction of the command control ability of the bastion host, and the influence on the user experience in the related art. SUMMARY
[0005] The present application provides a high-risk command identification method and device for a bastion host, a computer device, and a storage medium, to solve the problem of low accuracy of high-risk command identification, reduction of the command control ability of the bastion host, and influence on the user experience in the related art.
[0006] In a first aspect, the present application provides a high-risk command identification method for a bastion host. A character module provided in the bastion host includes an SSH server, a core processing module, and an SSH client connected in sequence. A session from a user client to a target device is established by the SSH server, the core processing module, and the SSH client. The method includes the following steps.
[0007] After the session is started, a custom rule corresponding to the target device is loaded to an output state processor of the character module based on a configuration file. The custom rule is a judgment logic of a feature code when a session state is converted for different target devices.
[0008] transmitting echo data corresponding to the last command input by the user client into the output state processor;
[0009] In the output state processor, the echo data, the custom rules and preset built-in rules are matched, and the session state is converted according to the matching result to enter a corresponding session state.
[0010] When the corresponding session state is entered and it is determined that the current command input by the user client is submitted, the current command is identified as a high-risk command.
[0011] In some embodiments, the echo data corresponding to the last command input by the user client is transmitted into the output state processor, including:
[0012] The last command input by the user client is submitted to the target device.
[0013] The returned echo data is received in a target device output reading thread, and the echo data is transmitted into the output state processor.
[0014] In some embodiments, after the session is started, the custom rules corresponding to the target device are loaded into the output state processor of the character module based on a configuration file, including:
[0015] After the session is started, the system type, terminal type and Shell interpreter type of the target device are obtained and matched with the configuration file.
[0016] When the matching is passed, the custom rules corresponding to the target device are loaded into the output state processor of the character module based on the configuration file, and expressions configured in state conditions are compiled during the loading process; the state conditions include entering state conditions, exiting state conditions and maintaining state conditions.
[0017] In some embodiments, in the output state processor, the echo data, the custom rules and preset built-in rules are matched, and the session state is converted according to the matching result to enter a corresponding session state, including:
[0018] In the output state processor, the echo data is transmitted into the compiled expressions for calculation to determine whether the state conditions are hit.
[0019] If the state conditions are hit, the session state is converted to convert the current session state to an entering state, an exiting state or a maintaining state.
[0020] If the state condition is not hit, the current session state is determined to be transferred to an entering state, a leaving state or a keeping state according to the echo data and the built-in rule.
[0021] In some embodiments, the method further comprises:
[0022] The built-in rule is set in the output state processor, and the logic of the expression is converted into corresponding code in the setting process.
[0023] In some embodiments, the current session state is determined to be transferred to an entering state, a leaving state or a keeping state according to the echo data and the built-in rule, comprising:
[0024] The echo data is transmitted into the code for execution to determine whether the state condition is hit;
[0025] If the state condition is hit, the session state is transferred to an entering state, a leaving state or a keeping state;
[0026] If the state condition is not hit, the process is stopped.
[0027] In some embodiments, the priority of the custom rule is higher than that of the built-in rule.
[0028] In some embodiments, the method further comprises:
[0029] The SSH server and the user client establish an SSH connection, and the SSH client and the target device establish an SSH connection to complete the establishment of the session.
[0030] In a second aspect, a bastion host is provided in the embodiment, which comprises a character module; the character module comprises an SSH server, a core processing module and an SSH client connected in sequence; the SSH server, the core processing module and the SSH client establish a session from a user client to a target device; the core processing module is used to execute the high-risk command identification method of the bastion host in the first aspect.
[0031] In a third aspect, a storage medium is provided in the embodiment, which stores a computer program; the program is executed by a processor to implement the high-risk command identification method of the bastion host in the first aspect.
[0032] Compared with the related art, the high-risk command identification method, device, computer device and storage medium of the bastion host provided in the embodiment can load the customized rule corresponding to the target device to the output state processor of the character module based on the configuration file after the session is started; the customized rule is the judgment logic of the feature code when the session state is switched for different target devices; the echo data corresponding to the last command input by the user client is transmitted to the output state processor; in the output state processor, the echo data, the customized rule and the preset built-in rule are matched, the session state is switched according to the matching result to enter the corresponding session state; when the corresponding session state is entered and it is determined that the current command input by the user client is submitted, the current command is identified as a high-risk command, which solves the problem that the related art has low high-risk command identification accuracy, reduces the command control ability of the bastion host and affects the user experience, and uses the customized rule to realize accurate session state switching, thereby maintaining the accuracy of high-risk command identification, improving the command control ability of the bastion host and enhancing the user experience.
[0033] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS
[0034] The drawings described herein are intended to provide further understanding of the present application, and constitute a part of the present application. The illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute an improper limitation of the present application. In the drawings:
[0035] Figure 1 is a structural block diagram of the bastion host provided by an embodiment of the present application;
[0036] Figure 2 is a structural block diagram of the core processing module provided by an embodiment of the present application;
[0037] Figure 3 is a flowchart of the high-risk command identification method of the bastion host provided by an embodiment of the present application;
[0038] Figure 4 is a flowchart of step S210;
[0039] Figure 5 is a flowchart of step S230;
[0040] Figure 6 is a schematic diagram of the decision process of the output state processor provided by an embodiment of the present application. DETAILED DESCRIPTION
[0041] To make the purpose, technical solution and advantages of the present application more apparent, the present application is described and explained in the following with reference to the drawings and embodiments.
[0042] Unless otherwise defined, technical terms or scientific terms used in the present application shall have the same meaning as those commonly understood by a person of ordinary skill in the art to which the present application belongs. The terms "one", "a", "an", "the", "these", and similar terms in the present application do not mean "only one" or "exactly one", but can mean "one or more". The terms "include", "contain", "have", and any variant thereof in the present application are intended to cover the non-exclusive inclusion; for example, a process, method, system, product or device containing a series of steps or modules (units) is not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. The terms "connect", "connected", "coupled" and the like in the present application are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The term "multiple" in the present application means two or more. The term "and / or" describes the association relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. Generally, the character " / " means that the objects before and after the " / " are in an "or" relationship. The terms "first", "second", "third" and the like in the present application are only used to distinguish similar objects, and do not represent a specific order of the objects.
[0043] The method embodiments provided in the present embodiment can be executed in a bastion host. Figure 1 is a hardware structure block diagram of the bastion host of the present embodiment. As shown in Figure 1 , the bastion host comprises a character module; the character module comprises an SSH server, a core processing module and an SSH client connected in sequence; and a session of a user client to a target device is established by the SSH server, the core processing module and the SSH client. Those skilled in the art can understand that Figure 1 The structure shown in the figure is only schematic, and does not limit the structure of the above-mentioned bastion host. For example, the bastion host can further comprise more or less components than those shown in Figure 1 , or have a different configuration from that shown in Figure 1 .
[0044] The SSH server and the SSH client are components of a character module for building a session; the two SSH connections using the SSH protocol are established, including two processes. The first process is that the user client initiates an SSH connection request to the SSH server, completes key exchange and user authentication, generates a session ID, and allocates resources, and a new SSH client is created. The second process is that the SSH server forwards the SSH target information of the user client to the SSH client, and the SSH client establishes an SSH connection with the target device using a preset key or credential, and verifies the identity of the target device. Specifically, in the SSH protocol, the communication process is divided into multiple levels: the transport layer (Transport Layer) is responsible for encryption, authentication, and integrity protection. The user authentication layer (User Authentication Layer) verifies the user's identity. The connection layer (Connection Layer) manages multiple logical channels (Channels) for different sessions (such as shell, SFTP, port forwarding, etc.).
[0045] The shell interpreter is an interface between the user and the operating system kernel, which is responsible for interpreting the commands input by the user and converting them into system calls or other instructions that the operating system can execute. The shell interpreter provides an interactive way to communicate with the operating system, and the user can perform various operations by inputting commands. Common shell interpreters include Bash, Zsh, Csh, etc. In this embodiment, after the SSH connection is established, a shell interpreter will be started on the target device, which will return the corresponding echo data to the user client according to the commands input by the user on the user client. The user client will parse the echo data returned by the shell interpreter and finally render it on the window for the user to view.
[0046] Specifically, as Figure 2As shown, the core processing module includes a user input receiving thread and a target device output reading thread; wherein the user input receiving thread includes a user input processor, an input state processor, and a high-risk command identification module; the user input processor acquires the command input by the user on the user client and submits it to the input state processor; the input state processor can be a finite state machine, which divides the session into four states: a waiting command input state, a processing command input response character state, a processing command execution output state, and a special processing mode state; wherein the special states include an ignore output state (ignoreMode), a Zmodem state (zmodemMode), and a paging state (moreMode). The input state processor can check the session state; if the check result is returned to the user input processor; when the check result is the ignore output state of the special state, the command is directly submitted to the target device. The high-risk command identification module identifies the current command as a high-risk command when entering the corresponding session state and determining the submission of the current command input by the user client. Among them, regular expressions, syntax trees, context awareness, and machine learning models can be used to identify high-risk commands for the current command, and this is not limited. For example: the high-risk command rule is composed of multiple regular expressions and execution actions, and if the current command input by the user in the SSH session process matches the regular expression, the bastion host will execute the corresponding execution action, and the execution action includes: “reject” — do not execute the command, “allow” — can execute the command, “terminate the session” — disconnect the current session, and the like.
[0047] Among them, the output state processor contains specific control sequences (feature codes) in the echo data returned by the target device, which will make the current session enter the corresponding state. For example: in the xterm terminal, if the control sequence “\033[?1049h” is encountered, it means that the session enters the interactive command line of the vi command; but the user inputs a carriage return in the interactive command line of vi, which actually does not submit the command, but only edits the content; at this time, if the high-risk command identification is triggered (triggered by the carriage return), the normal editing content of the user will be identified as a high-risk command; which will reduce the accuracy of high-risk command identification, reduce the command control ability of the bastion host, and affect the user experience.
[0048] The target device output reading thread comprises a processing echo data module and an output state processor. The processing echo data module receives echo data returned by the target device and transmits the echo data to the output state processor. The output state processor checks the change state of the echo data, i.e., matches the echo data, the custom rule and the preset built-in rule, performs session state conversion according to the matching result to enter a corresponding session state, and identifies a high-risk command of a current command when the corresponding session state is entered and the current command is submitted, thereby avoiding the influence of state conversion on the accuracy of high-risk command identification.
[0049] A high-risk command identification method of a bastion host is provided in the embodiment, Figure 3 A flowchart of the high-risk command identification method of the bastion host of the embodiment is shown in FIG. 2, which comprises the following steps: Figure 3
[0050] In step S210, after a session is started, a custom rule corresponding to a target device is loaded to an output state processor of a character module based on a configuration file. The custom rule is a judgment logic of a feature code when session state conversion is set for different target devices.
[0051] In step S220, echo data corresponding to a last command input by a user client is transmitted to the output state processor.
[0052] In step S230, the echo data, the custom rule and a preset built-in rule are matched in the output state processor, and session state conversion is performed according to a matching result to enter a corresponding session state.
[0053] In step S240, when the corresponding session state is entered and a current command input by the user client is submitted, the current command is identified as a high-risk command.
[0054] Specifically, the configuration file is preset in the background of the bastion host and can be in xml, yml, json or other formats. The configuration file can set the judgment logic of the feature code when the session state conversion is performed for different target devices. After the configuration file is configured to the bastion host, the character module of the bastion host can use different judgment logics of the feature code for different target devices according to the configuration, thereby accurately evaluating the conversion of the session state. The content of the configuration file is that the custom rule supporting the entry, exit, ignore output state (ignoreMode), Zmodem state (zmodemMode) and paging state (moreMode) can be configured, and the configurable items include terminal type, system type, Shell interpreter, entry state condition, exit state condition and the like.
[0055] The custom rule includes three configurations of terminal type, system type and Shell interpreter for defining the scope of the rule. The exclusion condition and the inclusion condition are included in the entering state condition and the exiting state condition, which are an expression and are executed by the QLExpress expression engine. The input parameters of the expression are b (byte sequence of echo data), off (offset of the first byte of echo data) and len (valid length of echo data). In order to improve the security of use, the method of calling the expression is limited by a whitelist, and the method includes but is not limited to byteArrayEndsWith (whether the byte sequence ends with a sequence), byteArrayIndexOf (whether the byte sequence contains a sequence), byteArrayStartsWith (whether the byte sequence starts with a sequence) and the like. Meanwhile, the execution time of each expression is limited to no more than 500 ms. The expression needs to output true or false, which is used to control whether to enter, exit or maintain the corresponding state.
[0056] For example, Table 1 describes a custom rule for controlling the entering and exiting of ignoreMode, which can be configured in the configuration file.
[0057] Table 1
[0058]
[0059]
[0060] After the SSH connection is established, the user client can start a session for accessing the target device through the bastion host. At this time, the custom rule corresponding to the target device is loaded into the output state processor of the character module based on the above-mentioned configuration file, so as to accurately convert the session state in the output state processor.
[0061] In the process of the session, the session state can be converted after the execution of the command of the user, and the current command is identified as a high-risk command every time the user submits the current command based on the enter key. Since the conversion of the session state affects the accuracy of the identification of the high-risk command, it is important to accurately convert the session state. In this embodiment, the echo data of the last command, the custom rule and the preset built-in rule are matched, and the session state is converted according to the matching result, so as to accurately enter the corresponding session state. Therefore, by accurately controlling the conversion of the session state, the problem of low accuracy of the identification of the high-risk command caused by the conversion of the session state is eliminated, and the command management ability of the bastion host is improved, and the user experience is enhanced.
[0062] In the related art, high-risk command identification is performed when a user submits a command; a character module identifies whether the user submits a command based on whether the user inputs a carriage return (the character module considers that the user submits a command only when the user inputs a carriage return character). For example, the user inputs a carriage return in the interactive command line of vi or vim, and actually does not submit a command, but only edits content. At this time, if high-risk command identification is triggered, the user's normal editing content is identified as a high-risk command, which reduces the accuracy of high-risk command identification, reduces the command management capability of the bastion host, and affects the user experience. The application loads a custom rule corresponding to the target device to the output state processor of the character module after the session is started; the custom rule is the judgment logic of the feature code when the session state is converted for different target devices; the echo data corresponding to the last command input by the user client is transmitted to the output state processor; in the output state processor, the echo data, the custom rule, and the preset built-in rule are matched, and the session state is converted according to the matching result to enter the corresponding session state; when the corresponding session state is entered and it is determined that the current command input by the user client is submitted, the current command is identified as a high-risk command, which solves the problem of low accuracy of high-risk command identification in the related art, reduces the command management capability of the bastion host, and affects the user experience. The custom rule is used to realize accurate session state switching, thereby maintaining the accuracy of high-risk command identification, improving the command management capability of the bastion host, and enhancing the user experience.
[0063] The above steps are described in detail as follows:
[0064] In some embodiments, the step of transmitting the echo data corresponding to the last command input by the user client to the output state processor in step S220 includes the following steps:
[0065] Step S221: submitting the last command input by the user client to the target device;
[0066] Step S222: receiving the returned echo data in the target device output reading thread, and transmitting the echo data to the output state processor.
[0067] Specifically, the last command input by the user client can be confirmed by a carriage return key or the like, and then the last command input by the user client is submitted to the target device.
[0068] When the target device receives the last command, a Shell interpreter in the target device generates corresponding echo data according to the last command; a processing echo data module of the target device output reading thread receives the echo data returned by the target device, and transmits the echo data to the output state processor.
[0069] Through the embodiment, the echo data processing module in the target device output reading thread and the output state processor cooperate to quickly transmit the echo data corresponding to the last command into the output state processor, to prepare for subsequent session state conversion.
[0070] In some embodiments, as shown in FIG. 10, after the session is started, the custom rules corresponding to the target device are loaded into the output state processor of the character module based on the configuration file, including the following steps: Figure 4
[0071] In step S211, after the session is started, the system type, terminal type and Shell interpreter type of the target device are obtained and matched with the configuration file.
[0072] In step S212, when the matching is passed, the custom rules corresponding to the target device are loaded into the output state processor of the character module; and the expressions configured in the state conditions are compiled during the loading process; the state conditions include the entering state condition, the exiting state condition and the maintaining state condition.
[0073] Specifically, after the session is started, the character module obtains the system type, terminal type and Shell interpreter type of the target device, and matches them with the terminal type, system type and Shell interpreter in Table 1 of the configuration file; if all the terminal type, system type and Shell interpreter are consistent, it is considered that the matching is passed, and the corresponding custom rules are loaded into the output state processor; and the expressions configured in the state conditions are compiled during the loading process, for subsequent execution; wherein the state conditions include the entering state condition, the exiting state condition and the maintaining state condition. After the loading, the feature code corresponding to the custom rules takes effect, for subsequent session state conversion.
[0074] If one or more of the terminal type, system type and Shell interpreter are not consistent, the matching is not passed, and the custom rules are not loaded; and the subsequent session state conversion is performed by the preset built-in rules.
[0075] Through the embodiment, the configuration file is used to complete the adaptation of different types of devices, to solve the problem caused by the incompatibility of the devices.
[0076] Further, the bastion host generates logs during execution for the same target device; specifically, when the log level of the character module is set to trace in the management page of the bastion host, the echoed data returned by the target device to the character template is output in hexadecimal form to the logs. At this time, some operations and commands are repeatedly executed; the corresponding characteristic code can be found in the logs. For example, a problem occurs in the current session when using vt100 terminal, and the phenomenon is that the session does not enter ignoreMode state after executing the vi command, and the echoed data of the vi command is recorded in the command echo. At this time, the log level is set to trace, and the vi command is executed multiple times. By observing the hexadecimal output of the printed echoed data in the logs, it can be observed that the target device returns a data packet starting with the control sequence "\r\n\033[?7h\033[?1l" each time vi is entered. At this time, the characteristic code starting with the control sequence "\r\n\033[?7h\033[?1l" can be used as a characteristic code for using the vi command in the vt100 terminal.
[0077] The characteristic code is embodied in the configuration file as: vt100 terminal, and the inclusion condition for entering ignoreMode is ShellUtils.byteArrayStartsWith(b, len, "\r\n\033[?7h\033[?1l").
[0078] Of course, the characteristic code of some operations in some devices can be complex, and multiple conditions are needed to judge. At this time, the corresponding judgment condition can be set in the entering state condition and the exiting state condition to handle. For example, there are multiple characteristic codes for exiting the vi command in different systems in the vt100 terminal. At this time, the inclusion condition for exiting ignoreMode of the vt100 terminal can be configured as ShellUtils.byteArrayIndexOf(b, len, "\033[K\033[?7h\033>") || ShellUtils.byteArrayIndexOf(b, len, "\033[?25h\033[?7h").
[0079] Through the embodiment, the characteristic code of the entering state condition and the exiting state condition of the target device can be obtained by analyzing the logs. After obtaining the characteristic code, the configuration file can be correctly configured, and the incompatible target device can be directly adapted, the time for waiting for the release of a new version is reduced, and the efficiency of solving the compatibility problem is improved.
[0080] Further, the loaded configuration file can be collected and added as a built-in rule of the bastion host in subsequent versions.
[0081] In some embodiments, such as Figure 5As shown, in the output state processor in step S230, matching is performed according to the echo data, the custom rule and the preset built-in rule, and session state conversion is performed according to the matching result to enter a corresponding session state, including the following steps:
[0082] In step S231, in the output state processor, the echo data is transmitted into a compiled expression for calculation to determine whether a state condition is hit.
[0083] In step S232, if the state condition is hit, session state conversion is performed to convert the current session state to an entering state, a leaving state or a keeping state.
[0084] In step S233, if the state condition is not hit, the current session state is determined to be converted to the entering state, the leaving state or the keeping state according to the echo data and the built-in rule.
[0085] In the embodiment, it can be considered that the loaded custom rule and the built-in rule have taken effect; then the custom rule and the built-in rule participate in session state conversion together, thereby improving the accuracy of session state conversion.
[0086] Specifically, since the expression compilation has been completed in the process of loading the custom rule, the echo data is transmitted into the compiled expression, the expression is executed through the QLExpress expression engine to obtain a calculation result of true or false; whether the state condition is hit can be determined according to the calculation result (such as the description in Table 1); if the state condition is hit, session state conversion is performed to convert the current session state to the entering state, the leaving state or the keeping state; if the state condition is not hit, the current session state is determined to be converted to the entering state, the leaving state or the keeping state according to the echo data and the built-in rule. In other embodiments, AviatorScript, MVEL, Janino and the like can also be used to calculate the expression.
[0087] The following examples are used to explain whether the state condition is hit under the custom rule:
[0088] For example:
[0089] For example: Figure 6As shown, after receiving the echo data, it is judged whether it is in the state specified by the custom rule; if it is not in the state specified by the custom rule, it is judged whether the entering state condition-exclusion condition is hit; if the entering state condition-exclusion condition is hit, it is controlled to enter the holding state; if the entering state condition-exclusion condition is not hit, it is judged whether the entering state condition-inclusion condition is hit, and if the entering state condition-inclusion condition is hit, it is controlled to enter the entering state; if the entering state condition-inclusion condition is not hit, built-in rule matching is used. If it is in the state specified by the custom rule, it is judged whether the exiting state condition-exclusion condition is hit; if the exiting state condition-exclusion condition is hit, it is controlled to enter the holding state; if the exiting state condition-exclusion condition is not hit, it is judged whether the exiting state condition-inclusion condition is hit; if the exiting state condition-inclusion condition is hit, it is controlled to enter the leaving state; if the exiting state condition-inclusion condition is not hit, built-in rule matching is used.
[0090] Through the embodiment, the custom rule and the built-in rule are used to accurately realize session state conversion to the entering state, the leaving state or the holding state.
[0091] In some of the embodiments, the high-risk command identification method of the bastion host further includes the following steps:
[0092] The built-in rule is set in the output state processor; in the setting process, the logic of the expression is converted into corresponding code.
[0093] Specifically, the built-in rule refers to the original output state processor, and is the default rule for changing the session state without configuring the custom rule. After the custom rule is executed, it can be added to the built-in rule to become a new built-in rule before the subsequent version is released.
[0094] The built-in rule is generally written by a software development engineer using java language, and the code is fixed in the code of the output state processor of the character module before the version is released, so that the setting of the built-in rule is completed. Then the calculation result of the built-in rule can be obtained by executing the code. It should be noted that the built-in rule is not supported to be set by users, administrators and the like, so that the performance can be improved while the security is further improved; and new customers of subsequent bastion hosts can obtain more compatibility support.
[0095] For example, the built-in rule is:
[0096] 1. The session uses the xterm terminal, and the feature code for leaving the vi interactive command line is "\033[?1049l". When the control sequence "\033[?1049l" is detected in the echo data, the session should leave the ignore output state (ignoreMode).
[0097] 2. The session uses vt100 terminal, the feature code for entering vi interactive command line is "\033[2;1H", when detecting the control sequence "\033[2;1H" at the beginning of the echo data packet, the session should enter ignoreMode.
[0098] 3. The session uses xterm terminal, the feature code for entering more mode is "\033[27m", when detecting the control sequence "\033[27m" at the end of the echo data packet, the session should enter moreMode.
[0099] Through the embodiment, the built-in rule can be updated according to the requirement before the version is released, so that the session state conversion is more accurate and faster.
[0100] In some embodiments, the step S233 of determining the current session state conversion to enter state, leave state or keep state according to the echo data and the built-in rule comprises the following steps:
[0101] The step S2331 is that the echo data transmission code is executed to determine whether the state condition is hit.
[0102] The step S2332 is that if the state condition is hit, the session state conversion is performed to convert the current session state to enter state, leave state or keep state.
[0103] The step S2333 is that if the state condition is not hit, the process is stopped.
[0104] Specifically, because the corresponding code has been fixed to the output state processor in the process of setting the built-in rule, the echo data is transmitted into the code for execution, so that the calculation result of the built-in rule is obtained; the state condition is determined according to the calculation result of the built-in rule; if the state condition is hit, the session state conversion is performed to convert the current session state to enter state, leave state or keep state; if the state condition is not hit, the process is stopped.
[0105] Through the embodiment, the built-in rule is used to accurately realize the session state conversion.
[0106] In some embodiments, the priority of the custom rule is higher than that of the built-in rule.
[0107] Specifically, the custom rules and the built-in rules interact with each other, and the priority of the custom rules is higher than that of the built-in rules. The priority among the plurality of custom rules is related to the order of the custom rules; it can be considered that the custom rule with higher priority is in front of the custom rule with lower priority. In the same rule (custom rule or built-in rule), the entering state condition has higher priority than the exiting state condition.
[0108] Through the embodiment, the set priority is used to ensure that the custom rules are completed in priority, and the compatibility of the operation is improved.
[0109] It should be noted that the steps shown in the above flow or the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.
[0110] In addition, in combination with the high-risk command identification method of the bastion host provided in the above embodiment, a storage medium can also be provided to implement it in the embodiment. The storage medium has a computer program stored thereon; the computer program is executed by a processor to implement any one of the high-risk command identification methods of the bastion host in the above embodiments.
[0111] It should be noted that the information and data involved in the present application are all information and data authorized by the user or fully authorized by all parties, which will be used legally.
[0112] It should be understood that the specific embodiments described herein are only used to explain this application, but not to limit it. According to the embodiments provided in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.
[0113] Obviously, the accompanying drawings are only some examples or embodiments of the present application, and those of ordinary skill in the art can also apply the present application to other similar situations without creative labor according to the accompanying drawings. In addition, it can be understood that although the work done in the development process may be complex and long, some design, manufacture or production changes according to the technical content disclosed in the present application are only routine technical means for those of ordinary skill in the art, and should not be regarded as insufficient disclosure of the present application.
[0114] The word "implementation" in this application refers to the specific features, structures, or characteristics described in connection with an implementation can be included in at least one implementation of the present application. The phrase appears in various places throughout the specification is not necessarily meant to refer to the same implementation, nor is it meant to imply that the features, structures, or characteristics so described can not be implemented in other implementations. It will be apparent to those having ordinary skill in the art that the implementations described herein can be combined with other implementations without losing the intended effect.
[0115] The above-described implementations are merely some implementations of the present application, which are described in a more specific and detailed manner, but should not be understood as a limitation on the scope of patent protection. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these are all within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.
Claims
1. A high-risk command identification method of a bastion host, characterized by, The character module arranged in the bastion host comprises an SSH server, a core processing module and an SSH client connected in sequence; The method comprises: After the session is started, a custom rule corresponding to the target device is loaded into an output state processor of the character module based on a configuration file; the custom rule is a judgment logic of a feature code when a session state is switched for different target devices; Echo data corresponding to a last command input by the user client is transmitted into the output state processor; In the output state processor, the echo data, the custom rule and a preset built-in rule are matched, and a session state is switched according to a matching result to enter a corresponding session state; When a current command input by the user client is determined to be submitted, the current command is identified as a high-risk command.
2. The high-risk command identification method of a bastion according to claim 1, characterized in that, The method comprises: The last command input by the user client is submitted to the target device; In a target device output reading thread, returned echo data is received and transmitted into the output state processor. 3.The high-risk command identification method of the bastion according to claim 1, characterized in that, After the session is started, the custom rule corresponding to the target device is loaded into the output state processor of the character module based on the configuration file, which comprises: After the session is started, a system type, a terminal type and a Shell interpreter type of the target device are acquired and matched with a configuration file; When the matching is passed, the custom rule corresponding to the target device is loaded into the output state processor of the character module based on the configuration file; expressions configured in state conditions are compiled in the loading process; the state conditions comprise an entering state condition, an exiting state condition and a maintaining state condition.
4. The high-risk command identification method of the bastion according to claim 3, wherein, In the output state processor, the echo data, the custom rule and the preset built-in rule are matched, and a session state is switched according to a matching result to enter a corresponding session state, which comprises: In the output state processor, the echo data is transmitted into the compiled expressions to be calculated to determine whether a state condition is hit; If the state condition is hit, a session state is switched to convert a current session state to an entering state, an exiting state or a maintaining state; If the state condition is not hit, the echo data and the built-in rule are used to determine that the current session state is switched to the entering state, the exiting state or the maintaining state.
5. The high-risk command identification method of the bastion according to claim 4, wherein, The method further comprises: The built-in rule is set in the output state processor; in the setting process, a logic of an expression is converted into a corresponding code.
6. The high-risk command identification method of the bastion according to claim 5, wherein, The echo data and the built-in rule are used to determine that the current session state is switched to the entering state, the exiting state or the maintaining state, which comprises: The echo data is transmitted into the code to be executed to determine whether the state condition is hit; If the state condition is hit, a session state conversion is performed to convert the current session state to an entering state, a leaving state or a holding state. If the state condition is not hit, the process is stopped.
7. The high-risk command identification method of a bastion according to claim 5, wherein, The priority of the custom rule is higher than that of the built-in rule.
8. The high-risk command identification method of a bastion according to claim 1, wherein, The method further comprises: The SSH server establishes an SSH connection with the user client and an SSH connection between the SSH client and the target device to complete the establishment of the session.
9. A bastion machine, characterized by, The character module comprises an SSH server, a core processing module and an SSH client connected in sequence; the SSH server, the core processing module and the SSH client establish a session from the user client to the target device. The core processing module is configured to perform the steps of the high-risk command identification method of the bastion host in any one of claims 1 to 8.
10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the steps of the high-risk command identification method of the bastion host in any one of claims 1 to 8.