A script storage method, system and related equipment

Abstract

The present invention provides a script saving method, system and related equipment, which receive an operation command sent by a client; obtain relevant information related to the operation command from a target server; send the relevant information to a proxy server, so that the proxy server obtains a script file executed corresponding to the operation command based on the relevant information; receives the script file executed corresponding to the operation command from the proxy server; thereby saving the script file executed corresponding to the operation command, and the saved script file provides the possibility of realizing a security audit of the user's execution of the script, thereby further improving the information security of the operating system.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and more specifically, to a script storage method, system and related equipment. Background Art

[0002] At present, operation and maintenance security auditing is an important task in the information security construction of enterprises and institutions. The commonly used operation and maintenance security auditing work is mainly to audit the conversation and the operation video of the operation and maintenance personnel. However, there is a great risk of tampering with the scripts executed in the communication interaction process, which can easily cause information security risks of the operating system. Therefore, there is currently a lack of a method to save user execution scripts, which makes it impossible to perform security audits on user execution scripts.

[0003] Based on this, how to provide a method for saving user execution scripts to implement security auditing of user execution scripts, thereby improving the information security of the operating system, has become a technical problem that needs to be solved at present. Summary of the invention

[0004] In view of this, the present invention provides a script saving method, system and related equipment to provide a method for saving user-executed scripts, thereby providing the possibility of implementing a security audit of user-executed scripts and further improving the information security of the operating system.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A script saving method, the method being applied to an operation and maintenance bastion machine, comprising:

[0007] Receive operation commands sent by the client;

[0008] Acquire relevant information related to the operation command from the target server;

[0009] Sending the relevant information to the proxy server, wherein the relevant information is used to enable the proxy server to obtain a script file executed corresponding to the operation command according to the relevant information;

[0010] Receiving a script file executed corresponding to the operation command from the proxy server;

[0011] The script file corresponding to the operation command is saved.

[0012] Preferably, the relevant information includes at least: all paths of user executable commands, the user's current execution path, and the operation command.

[0013] Preferably, the method further comprises:

[0014] Receive original file summary information of the script file executed corresponding to the operation command from the proxy server.

[0015] Preferably, after receiving the script file executed corresponding to the operation command from the proxy server, the method further includes:

[0016] Calculate the file summary information corresponding to the received script file as the target file summary information;

[0017] Determining whether the original file summary information is consistent with the target file summary information;

[0018] Correspondingly, the step of saving the script file executed corresponding to the operation command includes:

[0019] When the original file summary information is consistent with the target file summary information, the script file executed corresponding to the operation command is saved.

[0020] A script saving method, which is applied to a proxy server, comprises:

[0021] Receive relevant information related to the operation command sent by the client from the operation and maintenance bastion host;

[0022] Acquire a script file executed corresponding to the operation command according to the relevant information;

[0023] The script file executed corresponding to the operation command is sent to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine saves the script file executed corresponding to the operation command.

[0024] Preferably, the step of acquiring a script file executed corresponding to the operation command according to the relevant information includes:

[0025] Traversing all paths of user executable commands in order according to the relevant information to obtain the storage path of the execution script corresponding to the operation command;

[0026] A script file executed corresponding to the operation command is obtained from the storage path.

[0027] Preferably, after obtaining the script file executed corresponding to the operation command according to the relevant information, the method further includes:

[0028] Determine whether the type of the script file executed corresponding to the operation command is a preset script file type;

[0029] Correspondingly, sending the script file executed corresponding to the operation command to the operation and maintenance bastion machine includes:

[0030] When it is determined that the type of the script file executed corresponding to the operation command is a preset script file type, the script file executed corresponding to the operation command is sent to the operation and maintenance bastion host, so that the operation and maintenance bastion host saves the script file executed corresponding to the operation command.

[0031] An operation and maintenance bastion machine, the operation and maintenance bastion machine comprising: a processor and a memory;

[0032] Wherein, the processor is used to call and execute the program stored in the memory;

[0033] The memory is used to store the program, and the program is at least used to execute the script saving method as described above.

[0034] A proxy server, the proxy server comprising: a processor and a memory;

[0035] Wherein, the processor is used to call and execute the program stored in the memory;

[0036] The memory is used to store the program, and the program is at least used to execute the script saving method as described above.

[0037] A script storage system, the script storage system comprising: a client, an operation and maintenance bastion machine, a target server and a proxy server;

[0038] The client is used to send operation commands to the operation and maintenance bastion machine;

[0039] The maintenance bastion machine is used to obtain relevant information related to the operation command from the target server after receiving the operation command; and send the relevant information to the proxy server;

[0040] The proxy server is used to obtain a script file executed corresponding to the operation command according to the relevant information, and return the script file executed corresponding to the operation command to the operation and maintenance bastion machine;

[0041] After receiving the script file executed corresponding to the operation command, the operation and maintenance bastion machine saves the script file executed corresponding to the operation command.

[0042] It can be seen from the above technical solution that, compared with the prior art, the present invention provides a script saving method, system and related equipment, which receive an operation command sent by a client; obtain relevant information related to the operation command from the target server; send the relevant information to the proxy server, so that the proxy server obtains the script file executed corresponding to the operation command based on the relevant information; receives the script file executed corresponding to the operation command from the proxy server; thereby saving the script file executed corresponding to the operation command, and the saved script file provides the possibility of realizing a security audit of the user's execution of the script, thereby further improving the information security of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0044] Figure 1 A schematic diagram of the structure of a script storage system provided by an embodiment of the present invention;

[0045] Figure 2 A signaling flow chart of a script saving method provided by an embodiment of the present invention;

[0046] Figure 3 A flowchart of a script saving method provided by an embodiment of the present invention;

[0047] Figure 4 A flowchart of another script saving method provided by an embodiment of the present invention;

[0048] Figure 5 A flowchart of another script saving method provided by an embodiment of the present invention;

[0049] Figure 6 A flowchart of another script saving method provided by an embodiment of the present invention;

[0050] Figure 7 A schematic diagram of the structure of another script storage system provided by an embodiment of the present invention;

[0051] Figure 8 A structural block diagram of a script storage device provided by an embodiment of the present invention;

[0052] Fig. 9 This is a structural block diagram of another script storage device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] At present, operation and maintenance security auditing is an important task in the information security construction of enterprises and institutions. The commonly used operation and maintenance security auditing work is mainly to audit the sessions and the operation and maintenance personnel operation recordings. The audit of the sessions is mainly: obtaining the user operation content displayed in the session dimension, and then auditing the user operation content displayed in the session dimension; the audit of the operation and maintenance personnel operation recording is mainly: recording all operations performed by the operation and maintenance personnel through recording, and then auditing all operations performed by the operation and maintenance personnel recorded in the recording.

[0055] However, the current auditing methods only record the operation commands executed by the user. When the command executed by the user is a script file, the content of the script file cannot be recorded. If the script file is repeatedly modified, the user's operation content cannot be traced. Therefore, there is currently a lack of a method to save user-executed scripts, resulting in the inability to perform security audits on user-executed scripts.

[0056] Based on this, how to provide a method for saving user execution scripts to implement security auditing of user execution scripts, thereby improving the information security of the operating system, has become a technical problem that needs to be solved at present.

[0057] In order to solve the above technical problems, the present invention provides a script saving method, system and related equipment, which receive an operation command sent by a client; obtain relevant information related to the operation command from the target server; send the relevant information to a proxy server, so that the proxy server obtains a script file executed corresponding to the operation command based on the relevant information; receives the script file executed corresponding to the operation command from the proxy server; thereby saving the script file executed corresponding to the operation command, and the saved script file provides the possibility of implementing a security audit of user execution of the script, further improving the information security of the operating system.

[0058] The technical solution of the present invention is described in detail below with specific embodiments:

[0059] Figure 1 Schematic diagram of the structure of the script storage system provided by the embodiment of the present invention. The script storage method provided by the embodiment of the present invention can be implemented by the script storage system; Figure 1The script storage system may include: a client 10, an operation and maintenance bastion machine 20, a target server 30 and a proxy server 40; it should be noted that the proxy server 40 may be integrated in the target server 30 or exist independently, and the present invention does not make specific limitations.

[0060] The client 10 may be a mobile phone, a tablet computer, a desktop computer, etc., and the present invention does not make any specific limitation thereto.

[0061] The target server 30 may specifically be a cluster server, and the operating system running on the target server may be a UNIX / Linux system.

[0062] based on Figure 1 The script saving system shown, Figure 2 The signaling flow chart of the script saving method provided by the embodiment of the present invention is shown, referring to Figure 2 , the process may include:

[0063] Step S10: The client sends an operation command to the operation and maintenance bastion host;

[0064] Step S11, the operation and maintenance bastion machine forwards the operation command to the target server;

[0065] Step S12: the target server performs a corresponding action according to the operation command;

[0066] Step S13: The target server returns a response message to the operation and maintenance bastion host;

[0067] Step S14: The operation and maintenance bastion machine returns the response information to the client;

[0068] It should be noted that after the user authenticates through the client and logs in to the target server, the operation and maintenance bastion machine is responsible for the connection and message forwarding between the client and the target server.

[0069] Step S15: The operation and maintenance bastion host obtains relevant information related to the operation command from the target server;

[0070] Step S16: The operation and maintenance bastion host sends the relevant information to the proxy server;

[0071] Step S17: The proxy server obtains a script file executed corresponding to the operation command according to the relevant information;

[0072] Step S18: The proxy server returns a script file executed corresponding to the operation command to the operation and maintenance bastion host;

[0073] Step S19: After receiving the script file executed corresponding to the operation command, the operation and maintenance bastion host saves the script file executed corresponding to the operation command.

[0074] It should be noted that the above step S14 of the present invention is not in any particular order with step S11, and can be executed simultaneously, or step S11 can be executed first and then step S14; or, step S14 can be executed first and then step S11. Steps S15 to S19 are not in any particular order with step S14, and can be executed simultaneously, or step S14 can be executed first and then step S15 to S19; or, step S15 to S19 can be executed first and then step S14.

[0075] The script saving method provided by the embodiment of the present invention receives an operation command sent by a client; obtains relevant information related to the operation command from the target server; sends the relevant information to a proxy server, so that the proxy server obtains a script file executed corresponding to the operation command based on the relevant information; receives the script file executed corresponding to the operation command from the proxy server; thereby saving the script file executed corresponding to the operation command, and the saved script file provides the possibility of implementing a security audit of the user's execution of the script, thereby further improving the information security of the operating system.

[0076] The following is an introduction to the script saving method provided by an embodiment of the present invention from the perspective of an operation and maintenance bastion host. The script saving method described below can be referenced in correspondence with the signaling process content described above.

[0077] Figure 3 A flowchart of a script saving method provided in an embodiment of the present invention, which can be applied to the operation and maintenance of a bastion host, referring to Figure 3 , the method may include:

[0078] Step S100: receiving an operation command sent by a client;

[0079] It should be noted that the operation command may be in any form, and the present invention does not make any specific limitation thereto.

[0080] Step S110, obtaining relevant information related to the operation command from the target server;

[0081] The present invention obtains relevant information related to the operation command from the target server by sending relevant information collection instructions to the target server through the operation and maintenance bastion host.

[0082] The relevant information includes at least: all paths where the user can execute commands, the user's current execution path, and the operation command.

[0083] Step S120: sending the relevant information to the proxy server, wherein the relevant information is used to enable the proxy server to obtain a script file executed corresponding to the operation command according to the relevant information;

[0084] Specifically, since the script files executed corresponding to the operation commands are stored in the target server, after the present invention sends the relevant information to the proxy server, the proxy server obtains the script files executed corresponding to the operation commands from the target server based on the relevant information.

[0085] Furthermore, after sending the relevant information to the proxy server, the proxy server obtains the script file executed corresponding to the operation command based on the relevant information, and after obtaining the script file, the proxy server determines whether the type of the script file executed corresponding to the operation command is a preset script file type; only when the proxy server determines that the type of the script file executed corresponding to the operation command is a preset script file type, the proxy server will send the script file executed corresponding to the operation command to the operation and maintenance bastion host.

[0086] In addition to the command execution service, the target server also includes a proxy service that is responsible for analyzing and parsing script files.

[0087] Step S130: receiving a script file executed corresponding to the operation command from the proxy server;

[0088] Step S140: Save the script file executed corresponding to the operation command.

[0089] After receiving the script file returned by the proxy server, the operation and maintenance bastion machine saves the script file in a memory. Specifically, the memory for saving the script file may be an external memory or a memory integrated in the operation and maintenance bastion machine, which is not specifically limited in the present invention.

[0090] Optionally, the storage in the present invention includes a database and NFS (Network File System). The present invention can save the script file executed corresponding to the operation command in NFS, and the database stores the user's basic information, execution commands, execution results, and location information of the stored files, etc.

[0091] The present invention receives an operation command sent by a client; obtains relevant information related to the operation command from the target server; sends the relevant information to a proxy server, so that the proxy server obtains a script file executed corresponding to the operation command based on the relevant information; receives the script file executed corresponding to the operation command from the proxy server; thereby centrally and uniformly saving the script files executed corresponding to the operation commands, and the saved script files provide the possibility of implementing a security audit of user execution of scripts, thereby increasing the dimension of operation and maintenance auditing, as well as the dimension of supervision of user operating systems, and further improving the information security of the operating system.

[0092] Here is another way to save the script: Figure 4 A flowchart of a script saving method provided in an embodiment of the present invention, which can be applied to the operation and maintenance of a bastion host, referring to Figure 4 , the method may include:

[0093] Step S200: receiving an operation command sent by the client;

[0094] Step S210: Acquire relevant information related to the operation command from the target server;

[0095] Step S220: sending the relevant information to the proxy server, wherein the relevant information is used to enable the proxy server to obtain a script file executed corresponding to the operation command according to the relevant information;

[0096] Step S230: receiving a script file executed corresponding to the operation command from the proxy server;

[0097] Step S240: receiving original file summary information of the script file executed corresponding to the operation command from the proxy server;

[0098] It should be noted that the original file summary information is calculated by the proxy server according to the SM3 algorithm on the script file to be sent.

[0099] Step S250, calculating the file summary information corresponding to the received script file as the target file summary information;

[0100] After receiving the script file, the operation and maintenance bastion host will recalculate the file summary information of the received script file according to the standard SM3 algorithm of the cryptographic hash function to obtain the target file summary information.

[0101] Step S260, determining whether the original file summary information is consistent with the target file summary information; if the original file summary information is consistent with the target file summary information, executing step S270; if the original file summary information is inconsistent with the target file summary information, jumping to step S220 to reacquire the script file, if the summary information is still inconsistent, giving up saving the script file;

[0102] Specifically, the present invention can determine the integrity of the script information by determining whether the original file summary information is consistent with the target file summary information. If an error occurs in the script information during transmission, the original file summary information is inconsistent with the target file summary information. If no error occurs in the script information during transmission, the original file summary information is consistent with the target file summary information.

[0103] When the original file summary information is consistent with the target file summary information, the present invention further includes: judging whether a script file is already stored in the memory based on the target file summary information (or the original file summary information); if the script file is already stored in the memory, abandoning the saving of the script file; and if the script file is not stored in the memory, executing step S270.

[0104] Step S270: Save the script file executed corresponding to the operation command.

[0105] Specifically, after saving the script file executed corresponding to the operation command, the present invention also stores information of the script file executed by the user this time into a database, such as the storage path of the script, the execution result, the user information, etc.

[0106] The present invention receives an operation command sent by a client; obtains relevant information related to the operation command from the target server; sends the relevant information to a proxy server, so that the proxy server obtains a script file corresponding to the operation command based on the relevant information; receives the script file corresponding to the operation command from the proxy server; and saves the script file corresponding to the operation command. The saved script file provides a possibility for realizing a security audit of the user's execution of the script, further improving the information security of the operating system. At the same time, the present invention also determines the integrity of the script information by calculating the file summary information corresponding to the script file, thereby realizing the verification of the integrity of the script information and ensuring the integrity of the saved script file.

[0107] The following is an introduction to the script saving method provided by an embodiment of the present invention from the perspective of a proxy server. The script saving method described below can be referenced in correspondence with the signaling process content described above and the script saving method described from the perspective of an operation and maintenance bastion host.

[0108] Figure 5 Another flowchart of the script saving method provided by the embodiment of the present invention, the method can be applied to the proxy server, and the method needs to be combined with the script saving method from the operation and maintenance bastion host described above to implement script saving. Figure 5 , the method may include:

[0109] Step S300: Receive relevant information related to the operation command sent by the client from the operation and maintenance bastion host;

[0110] The relevant information includes at least: all paths where the user can execute commands, the user's current execution path, and the operation command.

[0111] Step S310: acquiring a script file executed corresponding to the operation command according to the relevant information;

[0112] Specifically, since the script files executed corresponding to the operation commands are stored in the target server, the proxy server of the present invention obtains the script files executed corresponding to the operation commands from the target server according to the relevant information.

[0113] Specifically, the present invention discloses the following method for obtaining a script file executed corresponding to the operation command according to the relevant information:

[0114] All paths of user executable commands are traversed in order according to the relevant information to obtain a storage path of a script executed corresponding to the operation command; and a script file executed corresponding to the operation command is obtained from the storage path.

[0115] Specifically, the present invention can obtain the storage location of the script file executed corresponding to the operation command according to the relevant information, thereby obtaining the corresponding script file at the storage location of the script file.

[0116] Step S320: Send the script file executed corresponding to the operation command to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine saves the script file executed corresponding to the operation command.

[0117] The present invention receives relevant information related to the operation command sent by the client from the operation and maintenance bastion machine through a proxy server; obtains a script file executed corresponding to the operation command based on the relevant information; and sends the script file executed corresponding to the operation command to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine will receive the script file executed corresponding to the operation command and save it centrally and uniformly. The saved script file provides the possibility of realizing security audit of user execution of scripts, thereby increasing the dimension of operation and maintenance audit and the supervision dimension of user operating system, and further improving the information security of operating system.

[0118] Here is another way to save the script: Figure 6 A flowchart of a script saving method provided by an embodiment of the present invention, which can be applied to a proxy server, referring to Figure 6 , the method may include:

[0119] Step S400: receiving relevant information related to the operation command sent by the client from the operation and maintenance bastion host;

[0120] Step S410: acquiring a script file executed corresponding to the operation command according to the relevant information;

[0121] Step S420, determining whether the type of the script file executed corresponding to the operation command is a preset script file type; if it is determined that the type of the script file executed corresponding to the operation command is a preset script file type, executing step S430;

[0122] Specifically, the proxy server in the present invention mainly classifies all acquired script files based on the file type judgment method of the operating system, for example, the file type judgment method of the UNIX / Linux system (such as the file command on the UNIX / Linux system) is used to classify all acquired script files, and the embodiment of the present invention does not make specific limitations.

[0123] The preset script file type may specifically be: a SHELL script file or a text script file, which is not specifically limited in the embodiment of the present invention.

[0124] Step S430: Send the script file executed corresponding to the operation command to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine saves the script file executed corresponding to the operation command.

[0125] The present invention will send the script file executed corresponding to the operation command to the operation and maintenance bastion host only when it is determined that the type of the script file executed corresponding to the operation command is a preset script file type, so that the operation and maintenance bastion host will save the received script file that meets the preset script file type, thereby realizing the saving of the specific type of script file. The saved script file of the specific type provides the possibility of realizing security audit of user execution of scripts, further improving the information security of the operating system.

[0126] Figure 7 A schematic diagram of another script storage system provided by an embodiment of the present invention, based on Figure 7 The structural diagram of the script saving system provided, the present invention provides an application example of the following script saving method:

[0127] 1. The user starts the SSH (Secure Shell)\Telnet client and, after identity authentication, initiates a connection to the target server through terminal emulation software or other means. An SSH channel / Telnet channel is established between the client and the operation and maintenance bastion host, and an access request is sent to the operation and maintenance bastion host.

[0128] 2. The transit module in the operation and maintenance bastion host receives the access request from the client, initiates an SSH connection / Telnet connection to the target server based on the access request from the client, parses the operation command in the access request sent by the user, and sends it to the SSH service / Telnet service execution command of the target server through the SSH channel / Telnet channel. At the same time, it sends relevant information collection instructions to the target server to enable the target server to obtain relevant information related to the operation command.

[0129] For example, all paths of commands that can be executed by users who log in to the system, the user's current execution path, and operation commands are collected.

[0130] 3. The SSH service / Telnet service of the target server executes the operation command issued by the user and returns the execution result to the transfer module in the operation and maintenance bastion host.

[0131] 4. The transfer module in the operation and maintenance bastion host returns the execution results to the client user's execution interface through the SSH channel / Telnet channel.

[0132] 5. The target server returns the obtained relevant information to the transfer module of the operation and maintenance bastion host, and the transfer module of the operation and maintenance bastion host pushes the obtained relevant information to the collection module of the operation and maintenance bastion host.

[0133] It should be noted that the process in which the transit module in the operation and maintenance bastion host transmits the execution results through the SSH channel to the client user's execution interface and the target server returns the obtained relevant information to the transit module of the operation and maintenance bastion host in the above steps 4 and 5 is not prioritized and can be executed simultaneously, or step 4 can be executed first and then step 5; or step 5 can be executed first and then step 4.

[0134] 6. The collection module of the operation and maintenance bastion host sends the received relevant information to the proxy server.

[0135] 7. Proxy Server ( Figure 7 The proxy server in the system) searches for the storage path where the command is located according to the relevant information, and obtains the script file executed corresponding to the operation command from the storage path. After obtaining the script file executed corresponding to the operation command, the file type judgment method of the UNIX / Linux system (referring to the file command on the UNIX / Linux system) is used to classify the script file type. If it is a SHELL script file or a text script file, the following steps are performed.

[0136] 8. The collection agent on the proxy server uses the SM3 algorithm to calculate the script file to be sent, obtains the summary information of the original file, and returns the summary information of the original file together with the script file to the collection module.

[0137] 9. The acquisition module receives the script file and the original file summary information transmitted by the proxy server, and recalculates the file summary information corresponding to the received script file to obtain the target file summary information, and determines whether the original file summary information is consistent with the target file summary information; when the original file summary information is consistent with the target file summary information, it determines whether the script file is already stored in the memory based on the target file summary information (or the original file summary information); if the script file is not stored, the acquisition module stores the script file in NFS.

[0138] It should be noted that, when the original file summary information is inconsistent with the target file summary information, the script file will be re-acquired and it will be determined whether the summary information is consistent. If they are still inconsistent, the script file will be abandoned.

[0139] In the case where a script file has already been stored in the memory, the saving of the script file is abandoned and only the script link needs to be stored in the database, thus avoiding repeated saving of the script file and greatly saving storage space.

[0140] 10. The collection module stores the relevant information of the script file executed by the user this time into the database DataBase, including the storage path of the script, execution results, user information, etc.

[0141] The following is an introduction to a script storage device provided by an embodiment of the present invention. The script storage device described below can be referred to in correspondence with the script storage method described above.

[0142] Figure 8 A structural block diagram of a script storage device provided in an embodiment of the present invention, wherein the script storage device may specifically be an operation and maintenance bastion machine, Figure 8 , the script storage device may include:

[0143] The command receiving unit 800 is used to receive an operation command sent by a client;

[0144] A related information acquisition unit 810, configured to acquire related information related to the operation command from the target server;

[0145] A related information sending unit 820, configured to send the related information to the proxy server, wherein the related information is used to enable the proxy server to obtain a script file executed corresponding to the operation command according to the related information;

[0146] A script file receiving unit 830, configured to receive a script file executed corresponding to the operation command from the proxy server;

[0147] The script file saving unit 840 is used to save the script file executed corresponding to the operation command.

[0148] Optionally, the relevant information includes at least: all directories of user executable commands, the current execution path of the operation command, and the operation command.

[0149] It also includes: an original file summary information receiving unit, which is used to receive the original file summary information of the script file executed corresponding to the operation command from the proxy server.

[0150] After receiving the script file executed corresponding to the operation command from the proxy server, the method further includes:

[0151] A file summary information calculation unit, used to calculate the file summary information corresponding to the received script file as the target file summary information;

[0152] A file summary information determination unit, configured to determine whether the original file summary information is consistent with the target file summary information;

[0153] Correspondingly, the script file storage unit includes:

[0154] The script file saving subunit is used to save the script file executed corresponding to the operation command when the file summary information judgment unit judges that the original file summary information is consistent with the target file summary information.

[0155] Optionally, the present invention also provides another script storage device, Fig. 9 A structural block diagram of another script storage device provided in an embodiment of the present invention, wherein the script storage device may be a proxy server, Fig. 9 , the script storage device may include:

[0156] The relevant information receiving unit 900 is used to receive relevant information related to the operation command sent by the client from the operation and maintenance bastion machine;

[0157] A script file acquisition unit 910 is used to acquire a script file executed corresponding to the operation command according to the relevant information;

[0158] The script file sending unit 920 is used to send the script file executed corresponding to the operation command to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine saves the script file executed corresponding to the operation command.

[0159] The script file acquisition unit includes:

[0160] A storage path acquisition unit, configured to sequentially traverse all paths of user executable commands according to the relevant information, and acquire a storage path of an execution script corresponding to the operation command;

[0161] The script file acquisition subunit is used to acquire, from the storage path, a script file to be executed corresponding to the operation command.

[0162] Optionally, the device further comprises:

[0163] A script file type determination unit, used to determine whether the type of the script file executed corresponding to the operation command is a preset script file type;

[0164] Correspondingly, the script file sending unit includes:

[0165] The script file sending sub-unit is used to send the script file executed corresponding to the operation command to the operation and maintenance bastion host when it is determined that the type of the script file executed corresponding to the operation command is a preset script file type, so that the operation and maintenance bastion host saves the script file executed corresponding to the operation command.

[0166] Optionally, the script storage device may be a hardware device. Accordingly, the present invention discloses an operation and maintenance bastion machine, the operation and maintenance bastion machine comprising: a processor and a memory;

[0167] Wherein, the processor is used to call and execute the program stored in the memory;

[0168] The memory is used to store the program, and the program is at least used to execute the script saving method as described above.

[0169] Optionally, the present invention further discloses a proxy server, the proxy server comprising: a processor and a memory;

[0170] Wherein, the processor is used to call and execute the program stored in the memory;

[0171] The memory is used to store the program, and the program is at least used to execute the script saving method as described above.

[0172] The technical features described in the various embodiments in this specification can be replaced or combined with each other. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0173] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0174] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0175] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A script saving method, characterized in that: The method is applied to the operation and maintenance of a bastion host, and includes: Receive operation commands sent by the client; forwarding the operation command to the target server, causing the target server to perform a corresponding action according to the operation command, receiving response information returned by the target server after performing the corresponding action, and returning the response information to the client; Acquire relevant information related to the operation command from the target server; Sending the relevant information to the proxy server, wherein the relevant information is used to enable the proxy server to obtain a script file executed corresponding to the operation command from the target server according to the relevant information; Receiving a script file executed corresponding to the operation command from the proxy server; Saving the script file executed corresponding to the operation command; The target server includes: a command execution service and a proxy service, and the proxy service is used to analyze and parse script files.

2. The method according to claim 1, characterized in that The relevant information includes at least: all paths where the user can execute commands, the user's current execution path, and the operation command.

3. The method according to claim 1, characterized in that The method further comprises: Receive original file summary information of the script file executed corresponding to the operation command from the proxy server.

4. The method according to claim 3, characterized in that After receiving the script file executed corresponding to the operation command from the proxy server, the method further includes: Calculate the file summary information corresponding to the received script file as the target file summary information; Determining whether the original file summary information is consistent with the target file summary information; Correspondingly, the step of saving the script file executed corresponding to the operation command includes: When the original file summary information is consistent with the target file summary information, the script file executed corresponding to the operation command is saved.

5. A script saving method, characterized in that: The method is applied to a proxy server, comprising: Receive relevant information related to the operation command sent by the client from the operation and maintenance bastion host; Acquire a script file executed corresponding to the operation command from the target server according to the relevant information; Sending the script file executed corresponding to the operation command to the operation and maintenance bastion machine, so that the operation and maintenance bastion machine saves the script file executed corresponding to the operation command; The target server includes: a command execution service and a proxy service, and the proxy service is used to analyze and parse script files.

6. The script storage method according to claim 5, characterized in that: The step of acquiring a script file executed corresponding to the operation command according to the relevant information includes: Traversing all paths of user executable commands in order according to the relevant information to obtain the storage path of the execution script corresponding to the operation command; A script file executed corresponding to the operation command is obtained from the storage path.

7. The script storage method according to claim 5, characterized in that: After obtaining the script file executed corresponding to the operation command according to the relevant information, the method further includes: Determine whether the type of the script file executed corresponding to the operation command is a preset script file type; Correspondingly, sending the script file executed corresponding to the operation command to the operation and maintenance bastion machine includes: When it is determined that the type of the script file executed corresponding to the operation command is a preset script file type, the script file executed corresponding to the operation command is sent to the operation and maintenance bastion host, so that the operation and maintenance bastion host saves the script file executed corresponding to the operation command.

8. An operation and maintenance bastion machine, characterized in that: The operation and maintenance bastion machine includes: a processor and a memory; Wherein, the processor is used to call and execute the program stored in the memory; The memory is used to store the program, and the program is at least used to execute the script saving method described in any one of claims 1 to 4.

9. A proxy server, characterized in that: The proxy server includes: a processor and a memory; Wherein, the processor is used to call and execute the program stored in the memory; The memory is used to store the program, and the program is at least used to execute the script saving method described in any one of claims 5-7.

10. A script storage system, characterized in that: The script storage system includes: a client, an operation and maintenance bastion machine, a target server and a proxy server; The client is used to send operation commands to the operation and maintenance bastion machine; The maintenance bastion machine is used to obtain relevant information related to the operation command from the target server after receiving the operation command; and send the relevant information to the proxy server; The proxy server is used to obtain the script file executed corresponding to the operation command from the target server according to the relevant information, and return the script file executed corresponding to the operation command to the operation and maintenance bastion server; After receiving the script file executed corresponding to the operation command, the operation and maintenance bastion machine saves the script file executed corresponding to the operation command; After the client sends an operation command to the operation and maintenance bastion machine, the maintenance bastion machine is also used to: forwarding the operation command to the target server, causing the target server to perform a corresponding action according to the operation command, receiving response information returned by the target server after performing the corresponding action, and returning the response information to the client; The target server includes: a command execution service and a proxy service, and the proxy service is used to analyze and parse script files.

Images