Method, apparatus, system and computer readable storage medium for intercepting content of an ssh login session

Abstract

The application relates to a method, device, system and computer readable storage medium for intercepting SSH login session content. The method for intercepting SSH login session content comprises the following steps: S1, duplicating SSH login session input data input by a client to a Linux kernel through an SSH service program, processing the input data into input messages, saving the input messages into an input message queue, and then calling a virtual terminal module of the Linux kernel to transmit the input data to a process of an application program; S2, duplicating SSH login session output data transmitted to the Linux kernel when a process executes output, processing the output data into output messages, saving the output messages into an output message queue, and then calling the virtual terminal module of the Linux kernel to transmit the output data to the SSH service program and send the output data to the client. The method for intercepting SSH login session content of the application can perform user behavior auditing on input / output content of an SSH login session without additionally increasing an agent.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, apparatus, system, and computer-readable storage medium for intercepting SSH login session content. Background Technology

[0002] Linux kernel-based operating systems are currently the mainstream server operating systems, and SSH (Secure Shell) service is the primary and most commonly used method for users to remotely log in to servers for operation and management. SSH service uses encrypted communication, and even if SSH communication messages are intercepted over the network, it is generally difficult to decrypt the SSH session content. Normally, after a user logs into a Linux-like operating system via SSH, their session content is not recorded by the operating system. However, for operational and security auditing purposes, server administrators sometimes need to obtain and record SSH login session content to understand what operations the user performed on the server and to trace and collect evidence from the user session.

[0003] Currently, there are two main types of technologies to achieve this goal:

[0004] One method is based on a network proxy. This involves setting up / deploying a proxy server between the SSH client and the Linux server. The SSH client initiates an SSH session to the proxy server. After successful login, the target Linux server is selected, and the proxy server initiates an SSH session to the target Linux server. The proxy server then forwards the session content between the SSH client and the Linux server, with the input / output of both sides serving as each other's input / output. In this scenario, the proxy server is at the endpoint of both sessions, naturally obtaining the session content. This allows for analysis and monitoring of the session content, saving it to disk, and enabling querying, retrieval, and playback. Figure 1 As shown, user 111 is logging into server 131, and users 112 and 113 are logging into server 132. These three login sessions are forwarded through the session auditing system 120 of the proxy server and are recorded and saved by the system.

[0005] The second method involves intercepting shell commands. On the target Linux server, each line of command entered by the user in the session is submitted to the shell for parsing. This parsing breaks the command into basic program calls, which are then submitted to the kernel for execution. By modifying the user's shell configuration file, the command line can be sent to a command collector before the shell parses and executes the commands. Figure 2As shown. The command collector will perform some analysis on the command line, and will issue an alert if there are any abnormal commands. The command collector can also save the command line to a file or database for future query and auditing.

[0006] The above two methods are currently the main methods for intercepting SSH session content, and are used in the vast majority of operation and maintenance auditing systems. They can solve basic operation and maintenance auditing needs, but they still have some drawbacks:

[0007] 1. The network proxy-based method requires the installation and deployment of a dedicated auditing system on the network. The auditing system is not transparent to users, and in some scenarios, it may not be feasible to deploy an additional dedicated auditing system, or users may not want to be aware of the existence of the auditing system.

[0008] 2. While network proxy-based methods can record the output of the entire session, they are difficult to determine whether the programs executed in the session have unauthorized permissions.

[0009] 3. Methods for intercepting shell commands can only obtain the command line input by the user and the name of the executed program. It is impossible to know whether the executed program is in violation of the rules, nor can it record the output of the executed program. Summary of the Invention

[0010] The technical problem to be solved by this application is to provide a method, apparatus, system and computer-readable storage medium for intercepting SSH login session content, which can perform user behavior auditing on the input / output content of SSH login sessions without adding an additional agent, in order to address the above-mentioned deficiencies of the prior art.

[0011] This application, in order to solve its technical problem, proposes a method for intercepting SSH login session content in a first aspect, the method comprising the following steps:

[0012] S1. Copy the SSH login session input data entered by the client into the Linux kernel through the SSH service program, process it into an input message and save it to the input message queue, and then call the virtual terminal module of the Linux kernel to transmit the input data to the application process.

[0013] S2. Copy the SSH login session output data sent to the Linux kernel when the process executes, process it into an output message and save it to the output message queue. Then, call the Linux kernel's virtual terminal module to send the output data to the SSH service program and send it to the client.

[0014] According to one embodiment of the first aspect of this application, both the input message and the output message include a message header and message data, wherein the message data is SSH login session input / output data, and the message header includes a login UID field and a process current UID field.

[0015] According to one embodiment of the first aspect of this application, step S1 further includes: sending the input messages in the input message queue to the session audit server via the network, and then clearing the input message queue;

[0016] Step S2 further includes: sending the output messages in the output message queue to the session audit server via the network, and then clearing the output message queue.

[0017] According to one embodiment of the first aspect of this application, step S1 further includes: at each time interval or when the input message queue is full, sending the input messages in the input message queue to the session audit server via the network, and then clearing the input message queue;

[0018] Step S2 further includes: at regular intervals or when the output message queue is full, sending the output messages in the output message queue to the session audit server via the network, and then clearing the output message queue.

[0019] To address its technical problem, this application provides, in a second aspect, an apparatus for intercepting SSH login session content, comprising:

[0020] The input processing module copies the SSH login session input data entered by the client through the SSH service program into the Linux kernel, processes it into input messages, saves them to the input message queue, and then calls the Linux kernel's virtual terminal module to transmit the input data to the application process; and

[0021] The output processing module is used to copy the SSH login session output data sent to the Linux kernel when the process executes, process it into an output message and save it to the output message queue, and then call the Linux kernel's virtual terminal module to send the output data to the SSH service program to send it to the client.

[0022] According to one embodiment of the second aspect of this application, both the input message and the output message include a message header and message data, wherein the message data is SSH login session input / output data, and the message header includes a login UID field and a process current UID field.

[0023] According to one embodiment of the second aspect of this application, the input processing module further includes:

[0024] The input processing unit is used to copy the SSH login session input data entered by the client into the Linux kernel through the SSH service program, process it into input messages, and save it to the input message queue; and

[0025] The first storage unit is used to send the input messages in the input message queue to the session audit server over the network, and then clear the input message queue.

[0026] The output processing module further includes:

[0027] The output processing unit is used to copy the SSH login session output data sent to the Linux kernel during process execution, process it into an output packet, and save it to the output packet queue; and

[0028] The second storage unit is used to send the output messages in the output message queue to the session audit server over the network, and then clear the output message queue.

[0029] According to one embodiment of the second aspect of this application, the first storage unit is further configured to send the input messages in the input message queue to the session audit server via the network at regular intervals or when the input message queue is full, and then clear the input message queue.

[0030] The second storage unit is further used to send the output messages in the output message queue to the session audit server via the network at regular intervals or when the output message queue is full, and then clear the output message queue.

[0031] In order to solve its technical problem, this application proposes a system for intercepting SSH login session content in a third aspect, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the method for intercepting SSH login session content as described above.

[0032] In order to solve its technical problem, this application proposes a computer-readable storage medium in a fourth aspect, which stores a computer program that, when executed by a processor, implements the steps of the method for intercepting SSH login session content as described above.

[0033] The method, apparatus, system, and computer-readable storage medium for intercepting SSH login session content according to this application have the following advantages: The method for intercepting SSH login session content according to embodiments of this application intercepts the input / output content of the SSH login session in the virtual terminal module of the Linux kernel. Compared with existing proxy-based methods, it has the advantages of not requiring the deployment of proxy devices or software and being transparent to the user. Compared with existing methods for intercepting Shell commands, it has the advantage of being able to record the entire content of the SSH session, rather than just recording the command lines entered by the user. Compared with the aforementioned two methods, the method for intercepting SSH login session content according to embodiments of this application can also record the user's UID in the input / output messages, supporting real-time detection of whether user permissions are normal and whether there are security events such as unauthorized privilege escalation. Attached Figure Description

[0034] The present application will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings:

[0035] Figure 1 This is a schematic diagram of existing methods for intercepting SSH login sessions based on network proxies;

[0036] Figure 2 This is a diagram illustrating existing methods for intercepting SSH login sessions via shell.

[0037] Figure 3 This is a schematic diagram illustrating the method for intercepting SSH login session content as described in this application;

[0038] Figure 4 This is a flowchart illustrating a method for intercepting SSH login session content according to an embodiment of this application;

[0039] Figure 5 This is a schematic diagram illustrating the process of intercepting input direction data in one embodiment of this application;

[0040] Figure 6 This is a schematic diagram illustrating the process of intercepting output direction data in one embodiment of this application;

[0041] Figure 7 This is a schematic diagram of the input / output message format in one embodiment of this application;

[0042] Figure 8 This is a logical block diagram of an apparatus for intercepting SSH login session content according to an embodiment of this application;

[0043] Figure 9 This is a logical block diagram of a system for intercepting SSH login session content according to an embodiment of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. Furthermore, the embodiments and features described herein can be combined with each other unless otherwise specified.

[0045] This application proposes a method for intercepting SSH login session content. It avoids adding an extra proxy to the network access path or intercepting shell commands. Instead, it intercepts the input / output content of the SSH login session within the Linux kernel's virtual terminal module, such as... Figure 3 As shown. SSH login session data includes two directions: from client to server and from server to client. In this application, the former is referred to as input and the latter as output.

[0046] Figure 4 A flowchart illustrating a method 200 for intercepting SSH login session content according to an embodiment of this application is shown. Figure 4 As shown, the method 200 for intercepting SSH login session content includes the following steps:

[0047] In step S210, the SSH login session input data entered by the client into the Linux kernel through the SSH service program is copied, processed into an input message and saved to the input message queue. Then, the virtual terminal module of the Linux kernel is called to transmit the input data to the application process.

[0048] See Figure 5 As shown, when a user enters input in an SSH login session, the input is first sent to the SSH service program via the client, then input to the Linux kernel via the SSH service program, then a copy of the input data is copied for input processing, the input message is obtained and saved in the input message queue, then the virtual terminal module of the Linux kernel is called, and finally the input data is passed to the application process.

[0049] Furthermore, input messages stored in the input message queue can be sent to the session audit server over the network, and then the input message queue is cleared. This saving process can be initiated at regular intervals (e.g., every 5 seconds), or it can be executed if the input message queue is found to be full when writing to it, in which case the input messages in the input message queue are sent to the session audit server over the network, and then the input message queue is cleared.

[0050] Then, in step S220, a copy of the SSH login session output data sent to the Linux kernel when the process executes is made, processed into an output message and saved to the output message queue, and then the Linux kernel's virtual terminal module is called to send the output data to the SSH service program and send it to the client.

[0051] See Figure 6 As shown, when the process executes output, it sends the output data to the Linux kernel, then copies the output data for output processing, obtains the output message, and saves the output message in the output message queue. Then, it calls the Linux kernel's virtual terminal module to continue outputting to the SSH service program, and finally sends it to the client.

[0052] Furthermore, output packets stored in the output packet queue can be sent to the session audit server over the network, and then the output packet queue is cleared. This saving process can be initiated at regular intervals (e.g., every 5 seconds), or it can be executed if the output packet queue is found to be full when writing to it, in which case the output packets in the output packet queue are sent to the session audit server over the network, and then the output packet queue is cleared.

[0053] In the method 200 for intercepting SSH login session content according to the above embodiments of this application, the input / output packets in the input / output packet queue consist of two parts: a packet header and packet data. The packet data is the input / output data of the SSH login session in the input / output direction. The packet header format is as follows: Figure 7 As shown. The definitions of each field are as follows:

[0054]

[0055]

[0056] As can be seen from the input / output message format, the message header retains the user UID used when logging into the server and the UID of the current process. These two pieces of information can be used to determine whether the user's permissions are normal and whether there has been any unauthorized privilege escalation.

[0057] Based on the method for intercepting SSH login session content described above, this application also proposes an apparatus for intercepting SSH login session content. Figure 8 A logical block diagram of an apparatus 300 for intercepting SSH login session content according to one embodiment of this application is shown. Figure 8As shown, the device 300 for intercepting SSH login session content includes an input processing module 310 and an output processing module 320. The input processing module 310 copies the SSH login session input data input by the client to the Linux kernel via the SSH service program, processes it into an input message, saves it to an input message queue, and then calls the Linux kernel's virtual terminal module to transmit the input data to the application's process. The output processing module 320 copies the SSH login session output data transmitted to the Linux kernel during process execution, processes it into an output message, saves it to an output message queue, and then calls the Linux kernel's virtual terminal module to transmit the output data to the SSH service program for delivery to the client.

[0058] like Figure 8 As shown, the input processing module 310 further includes an input processing unit 311 and a first storage unit 312. The input processing unit 311 copies the SSH login session input data entered by the client into the Linux kernel via the SSH service program, processes it into input messages, and saves it to an input message queue. The first storage unit 312 sends the input messages in the input message queue to the session audit server via the network, and then clears the input message queue. Specifically, the first storage unit 312 can send the input messages in the input message queue to the session audit server via the network at regular intervals or when the input message queue is full, and then clear the input message queue. For example... Figure 8 As shown, the output processing module 320 further includes an output processing unit 321 and a second storage unit 322. The output processing unit 321 copies the SSH login session output data transmitted to the Linux kernel during process execution, processes it into output packets, and saves them to an output packet queue. The second storage unit 322 sends the output packets in the output packet queue to the session audit server via the network, and then clears the output packet queue. Specifically, the second storage unit 322 can send the output packets in the output packet queue to the session audit server via the network at regular intervals or when the output packet queue is full, and then clear the output packet queue.

[0059] Both input and output packets in the input / output packet queue consist of a header and data. The data is the SSH login session input / output data. The header contains at least the login UID field and the current process UID field. See [link to specific format] for details. Figure 7 As shown.

[0060] The apparatus 300 for intercepting SSH login session content according to the above embodiments of this application is used to implement the aforementioned method for intercepting SSH login session content. For further detailed implementation of the various modules of the apparatus 300 for intercepting SSH login session content, please refer to the foregoing detailed description of the various steps of the method 200 for intercepting SSH login session content.

[0061] Based on the method 200 for intercepting SSH login session content according to the foregoing embodiments of this application, this application also proposes a system 400 for intercepting SSH login session content. See also Figure 9 As shown, the system 400 for intercepting SSH login session content includes a processor 410 and a memory 420, which are communicatively connected. The memory 420 stores a computer program that, when executed by the processor 410, causes the processor 410 to implement the steps of the method 200 for intercepting SSH login session content according to the foregoing embodiments of this application.

[0062] Processor 410 can be a Central Processing Unit (CPU). Processor 410 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0063] The memory 420, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the method 200 for intercepting SSH login session content in this embodiment of the invention. The processor 410 executes various server functions and data processing by running the non-transitory software programs, instructions, and modules stored in the memory 420, thereby implementing the method 200 for intercepting SSH login session content in the aforementioned embodiment.

[0064] Memory 420 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the method 200 for intercepting SSH login session content, etc. Furthermore, memory 420 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 420 may optionally include memory remotely located relative to processor 410, and these remote memories may be connected to processor 410 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0065] This application also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method 200 for intercepting SSH login session content as described in the foregoing embodiments of this application. The computer-readable storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc. The computer-readable storage medium may also include combinations of the above-mentioned types of memory.

[0066] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for intercepting SSH login session content, characterized in that, The method includes the following steps: S1. In the virtual terminal module of the Linux kernel, the input data of the SSH login session entered by the client through the SSH service program into the Linux kernel is copied, processed into an input message and saved to the input message queue. Then, the virtual terminal module of the Linux kernel is called to transmit the input data to the process of the application. The input message includes a message header and message data. The message data is the SSH login session input data. The message header contains the login UID field and the current UID field of the process. S2. In the virtual terminal module of the Linux kernel, a copy of the SSH login session output data sent to the Linux kernel when the process executes is copied, processed into an output message and saved to the output message queue. Then, the virtual terminal module of the Linux kernel is called to send the output data to the SSH service program and send it to the client. The output message includes a message header and message data. The message data is the SSH login session output data. The message header contains the login UID field and the current UID field of the process. Step S1 further includes: sending the input messages in the input message queue to the session audit server via the network, and then clearing the input message queue; Step S2 further includes: sending the output messages in the output message queue to the session audit server via the network, and then clearing the output message queue.

2. The method according to claim 1, characterized in that, Step S1 further includes: at regular intervals or when the input message queue is full, sending the input messages in the input message queue to the session audit server via the network, and then clearing the input message queue. Step S2 further includes: at regular intervals or when the output message queue is full, sending the output messages in the output message queue to the session audit server via the network, and then clearing the output message queue.

3. An apparatus for intercepting SSH login session content, characterized in that, include: The input processing module is used in the Linux kernel's virtual terminal module to copy the SSH login session input data entered by the client through the SSH service program into the Linux kernel, process it into an input message and save it to the input message queue, and then call the Linux kernel's virtual terminal module to transmit the input data to the application process. The input message includes a message header and message data. The message data is the SSH login session input data, and the message header includes a login UID field and a process current UID field. and The output processing module is used in the Linux kernel's virtual terminal module to copy the SSH login session output data sent to the Linux kernel when the process executes, process it into an output message and save it to the output message queue. Then, it calls the Linux kernel's virtual terminal module to send the output data to the SSH service program and send it to the client. The output message includes a message header and message data. The message data is the SSH login session output data. The message header contains the login UID field and the process's current UID field. The input processing module further includes: The input processing unit is used to copy the SSH login session input data entered by the client into the Linux kernel through the SSH service program, process it into input messages, and save it to the input message queue; and The first storage unit is used to send the input messages in the input message queue to the session audit server over the network, and then clear the input message queue. The output processing module further includes: The output processing unit is used to copy the SSH login session output data sent to the Linux kernel during process execution, process it into an output packet, and save it to the output packet queue; and The second storage unit is used to send the output messages in the output message queue to the session audit server over the network, and then clear the output message queue.

4. The apparatus according to claim 3, characterized in that, The first storage unit is further configured to send the input messages in the input message queue to the session audit server via the network at regular intervals or when the input message queue is full, and then clear the input message queue. The second storage unit is further used to send the output messages in the output message queue to the session audit server via the network at regular intervals or when the output message queue is full, and then clear the output message queue.

5. A system for intercepting SSH login session content, characterized in that, It includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the steps of the method for intercepting SSH login session content as described in any one of claims 1-2.

6. A computer-readable storage medium, characterized in that, The device stores a computer program that, when executed by a processor, implements the steps of the method for intercepting SSH login session content as described in any one of claims 1-2.

Images