Secure shell (SSH) remote connection process management method and computing device

Abstract

Embodiments of the present application relate to the technical field of server, and specifically provide a secure shell (SSH) remote connection process management method and a computing device, wherein the method comprises: obtaining a login session identifier of a user; determining whether the login session identifier is in a blacklist; in response to the login session identifier being in the blacklist, adding an SSH process of the user into a cgroup resource control group; and in response to the login session identifier not being in the blacklist, monitoring resource usage of the SSH process of the user. Embodiments of the present application can achieve dynamic, real-time and fine resource management for remote connection sessions.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of server, and particularly relates to a secure shell (SSH) remote connection process management method and a computing device. BACKGROUND

[0002] Remote connection refers to the process of connecting from a local computer to a remote computer over a network and performing operations and accessing resources on the remote computer. Among them, the secure shell (SSH) is an encrypted network protocol used to securely operate and transfer data over an insecure network. It protects user login information and other sensitive data through encryption technology, and is a common way to remotely log in to another computer or server. In the SSH login Linux multi-user scenario, if multiple users log in and use a large amount of system resources such as processors, memories, disks, and networks at the same time, it may cause resource competition and contention risks. Such a situation will have a negative impact on system performance and response speed, and may even cause system crashes or unavailability.

[0003] In order to reduce such risks, the industry usually adopts the way of operating system level control or separate SSH session control to limit and manage the resource usage of processes. Specifically, this control can be achieved through some built-in tools and mechanisms such as resource control groups (cgroups) and resource limits (ulimit). In addition, for SSH sessions, the operating system systemd configuration can be used to achieve the way of adding separate session process identifiers (PIDs) to cgroups control groups. This means that each SSH session can be individually limited and managed to avoid resource contention between multiple sessions. Through the above measures, system administrators can limit the resource usage of each user or session, ensure fair and reasonable resource allocation between users, and reduce the risk of system crashes or unavailability, thereby improving the stability and performance of the system.

[0004] However, if there are a large number of SSH sessions to be controlled, each session needs to be independently set and managed, which will increase the workload and complexity of administrators. And the SSH login time is uncertain, and the manual management method has limitations. When resource control is performed at the operating system systemd configuration level, the limitation of resources is usually applied to the entire process group or user group. This may cause some users or processes to be unnecessarily limited and unable to be finely managed, which needs to be solved urgently. SUMMARY

[0005] To solve the above problems, embodiments of the present application provide a secure shell (SSH) remote connection process management method and a computing device, which achieve real-time and fine remote connection session resource limitation.

[0006] To this end, embodiments of the present application adopt the following technical solutions:

[0007] In a first aspect, the embodiments of the present application provide an SSH remote connection process management method, which includes: obtaining a login session identifier of a currently logged-in SSH remote connection process; obtaining user information based on the login session identifier; determining whether the user information is in a blacklist; and in the case that the user information is in the blacklist, adding the SSH remote connection process to a resource control group; wherein the resource control group is used to limit the resource usage of the SSH remote connection process.

[0008] In this embodiment, when a user logs in to a system through remote connection, the current login session can be identified by recording the session identifier of the user login. Meanwhile, the system maintains a blacklist list, which records the session identifiers that are prohibited from accessing. When the user logs in, the system checks whether the login session identifier is in the blacklist to determine whether special processing is needed. If the login session identifier of the user is in the blacklist, the system adds the SSH remote connection process of the user to a cgroup resource control group set in advance. Through the cgroup resource control group, the SSH remote connection process can be limited in resource, such as CPU usage, memory occupation, etc. In this way, real-time and more fine remote connection session resource limitation can be achieved.

[0009] As an implementable embodiment, the method further includes: in the case that the login session identifier is not in the blacklist, obtaining the resource usage of the SSH remote connection process; determining whether the resource usage of the SSH remote connection process exceeds a limit condition; and in the case that the resource usage of the SSH remote connection process of the user exceeds the limit condition, adding the SSH remote connection process to the resource control group and adding the login session identifier to the blacklist.

[0010] For the login session identification not in the blacklist, the system continues to monitor the resource usage of the SSH remote connection process of the user, including CPU, memory, etc., to determine whether the resource limit condition set in advance is exceeded. If the resource usage of the SSH remote connection process of the user exceeds the limit condition, the system writes the login session identification of the user into the blacklist. If the limit condition is not exceeded, the user's SSH remote connection process is allowed to continue to execute. In this way, the resource usage of the user's SSH remote connection process can be monitored in real time, and the specified SSH remote connection process resource usage can be discovered and limited in time, which can prevent malicious users or abnormal behaviors from abusing system resources and protect the stability and security of the system. For the SSH remote connection process that excessively occupies resources, the system can automatically determine and limit the resource usage of the user's SSH remote connection process through the cgroup resource control group, thereby reducing the manual management burden of the administrator. Through the combined use of the blacklist, cgroups, and resource monitoring mechanism, the dynamic, real-time, and more refined remote connection session resource limitation is achieved.

[0011] As an implementable embodiment, determining whether the resource usage of the SSH remote connection process exceeds the limit condition includes: determining whether the resource usage of the SSH remote connection process exceeds a resource threshold; and in a case where the resource usage of the SSH remote connection process exceeds the resource threshold, determining whether a number of times that the resource usage of the SSH remote connection process exceeds the resource threshold exceeds a limit number.

[0012] As an implementable embodiment, in a case where the resource usage of the SSH remote connection process of the user exceeds the limit condition, the SSH remote connection process is added to the resource control group and the user information is added to the blacklist, including: in a case where the resource usage of the SSH remote connection process exceeds the resource threshold, and in a case where the number of times that the resource usage of the SSH remote connection process exceeds the resource threshold exceeds the limit number, the SSH remote connection process is added to the resource control group and the user information is added to the blacklist.

[0013] In this embodiment, when the user's SSH remote connection process resource utilization reaches the set threshold, it is determined whether the number of times that the SSH process resource exceeds the threshold reaches the limit number. If the user's SSH remote connection process resource utilization exceeds the resource threshold but does not reach the limit number, the number of times that the resource usage exceeds is recorded for subsequent judgment, and the process resource usage of the user is continuously monitored. When the number of times that the user's SSH remote connection process resource usage exceeds the resource threshold reaches the set limit number, the user information of the user is written into the blacklist, and the SSH remote connection process is added to the cgroup resource control group for resource limitation. In this way, the login session identifier of the user is written into the blacklist by multiple conditions, which can more reasonably limit the resource of the specific SSH remote connection process to avoid unnecessary limitation of some users or processes.

[0014] As an implementable embodiment, the user information includes the IP address and the username of the user of the currently logged-in SSH remote connection process. The user information is obtained based on the login session identifier, including: obtaining the IP address and the username of the user of the currently logged-in SSH remote connection process from the system log based on the login session identifier.

[0015] In this embodiment, the IP address of the user is used to uniquely identify the network device where the user is located; the user account name represents the account name of the user in the system, which is used to identify the user identity; and the PID process identifier represents the unique identifier of the ssh process of the user. The login session identifier including the IP address, the user account name and the PID process identifier can more accurately identify and manage the remote connection login connection of the user. Only when the source IP information and the logged-in user account name of the remote connection login to be limited are consistent, the remote connection resource limitation is started to avoid unnecessary limitation of some users or processes.

[0016] As an implementable embodiment, before the SSH remote connection process is added to the resource control group, the method further includes: creating the resource control group.

[0017] In this implementation, by creating a resource control group, a specific process or process group can be isolated in an independent resource environment. Resource control groups allow resource limits, such as CPU usage, memory usage, and disk IO, to be set for processes in each group. This effectively manages and controls resource allocation in the system, ensuring fair resource sharing between processes or process groups. Furthermore, the cgroup resource control group can impose individual resource limits on different users' SSH processes, enabling fine-grained control and management. Placing a user's SSH process in an independent cgroup effectively isolates its resource usage, preventing it from impacting other processes or users and improving system stability and reliability.

[0018] As a feasible implementation method, when the user information is in the blacklist, adding the SSH remote connection process to the resource control group includes: adding the SSH remote connection process and its subprocesses to the resource control group.

[0019] In this embodiment, by adding the SSH remote connection process and its subprocesses to the resource control group, resource restrictions can be imposed on them, such as CPU usage, memory usage, disk IO, etc. This can prevent malicious users from occupying system resources through the SSH remote connection process.

[0020] As a feasible implementation method, obtaining the login session identifier of the currently logged-in SSH remote connection process includes: obtaining a pseudo terminal device; and obtaining the login session identifier of the remote connection login session through the pseudo terminal device.

[0021] In this embodiment, the system usually records the user's login information and activity logs. The user's login IP, username, and pseudo terminal device information can be obtained by analyzing the system logs, thereby better managing and monitoring the user login activities of the system.

[0022] As a feasible implementation method, the resource restricted by the resource control group includes at least one of CPU share, memory size, and IO bandwidth, wherein the CPU share is the percentage of CPU usage.

[0023] In this implementation, the cgroup resource control group is used to limit the CPU share, memory limit, and IO bandwidth of the SSH process. Through the resource control function of the cgroup, fine-grained and flexible resource management and restriction of the user's SSH process is achieved, thereby enhancing the security and stability of the system.

[0024] As a feasible implementation method, the resource threshold is the CPU share usage of the SSH remote connection process.

[0025] In this embodiment, by setting the resource threshold as the CPU share usage rate of the SSH remote connection process, the user's SSH remote connection process can be effectively controlled to occupy the system CPU resources, ensuring the stability and fairness of the system. In this way, the CPU resource allocation in the system can be flexibly managed, preventing the process of a certain user from negatively affecting the performance of the entire system. At the same time, the threshold of the CPU share usage rate can be dynamically adjusted according to the actual situation to adapt to the changes in system load and the needs of different users.

[0026] As an implementable embodiment, the CPU share is the time interval of using the CPU and the total amount of time using the CPU.

[0027] In this embodiment, by setting the CPU share as the time interval of using the CPU and the total amount of time using the CPU, the actual use of CPU resources by the user's SSH remote connection process can be accurately controlled, ensuring the stability and fairness of the system; and the CPU resource allocation in the system can be precisely managed, avoiding a certain user's process from occupying too much CPU resource for a long time, thereby improving the overall performance and resource utilization efficiency of the system.

[0028] As an implementable embodiment, the resource usage of the user's SSH remote connection process is monitored by a Linux monitoring tool

[0029] In this embodiment, by using common Linux monitoring tools to monitor the resource usage of the SSH remote connection process of a specific user, real-time monitoring and resource optimization functions can be realized to ensure the performance stability and resource utilization efficiency of the system, and to ensure that user activities comply with the specifications.

[0030] In a second aspect, the embodiments of the present application provide a secure shell protocol (SSH) remote connection process management device, comprising: an acquisition unit configured to acquire a login session identifier of a currently logged-in SSH remote connection process (SSH) and acquire user information based on the login session identifier; a first judgment unit configured to judge whether the login session identifier is in a blacklist; a first processing unit configured to, in a case where the user information is in the blacklist, add the SSH remote connection process to a resource control group; wherein the resource control group is configured to limit the resource usage of the SSH remote connection process; and in a case where the user information is not in the blacklist, monitor the resource usage of the user's SSH remote connection process; a second judgment unit configured to judge whether the resource usage of the user's SSH process exceeds a limit condition; and a second processing unit configured to, in a case where the resource usage of the user's SSH remote connection process exceeds the limit condition, write the login session identifier of the user into the blacklist.

[0031] As an implementable embodiment, the second determining unit is further configured to determine whether the resource usage of the SSH remote connection process of the user exceeds a resource threshold; and in a case where the resource usage exceeds the resource threshold, determine whether a number of times that the resource usage of the SSH remote connection process exceeds the resource threshold exceeds a limit number; and the second processing unit is further configured to, in a case where the number of times that the resource usage of the SSH remote connection process exceeds the resource threshold does not exceed the limit number, increase the number of times that the resource usage of the SSH remote connection process exceeds the resource threshold; and in a case where the number of times that the resource usage of the SSH remote connection process exceeds the resource threshold exceeds the limit number, write user information of the user into a blacklist.

[0032] In a third aspect, an embodiment of the present application provides a computing device, including a processor and a memory; the memory and the processor are coupled, and the memory has computer program instructions stored therein, and the computer program instructions are run by the processor to execute the method in the first aspect.

[0033] In a fourth aspect, the present application provides a computer readable storage medium, which has a computer program stored thereon, and the computer program, when executed in a computer, causes the computer to execute the embodiments of the possible implementations of the first aspect.

[0034] In a fifth aspect, the present application provides a computer program product, which has instructions stored thereon, and the instructions, when executed in a computer, cause the computer to implement the embodiments of the possible implementations of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the description of the embodiments or the prior art. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0036] Figure 1 It is a schematic diagram of an operating system level SSH session resource control process;

[0037] Figure 2 It is a schematic diagram of a process in which a single SSH session resource control is completed by manual management;

[0038] Figure 3 It is a schematic diagram of a secure shell protocol (SSH) remote connection process management method provided by an embodiment of the present application;

[0039] Figure 4 It is a schematic diagram of an example process of an SSH remote connection process management method provided by an embodiment of the present application;

[0040] Figure 5 Another flowchart of a process of an SSH remote connection process management method provided in an embodiment of the present application is shown in FIG. 8;

[0041] Figure 6 A flowchart of a process of determining whether the resource used by the SSH process of a user exceeds the limit condition provided in an embodiment of the present application is shown in FIG. 9;

[0042] Figure 7 A flowchart of an example process of an SSH remote connection process management method provided in an embodiment of the present application is shown in FIG. 10;

[0043] Figure 8 A structure diagram of an SSH remote connection process management apparatus provided in an embodiment of the present application is shown in FIG. 11;

[0044] Figure 9 An implementation process diagram of a limiting specified SSH remote connection process resource usage apparatus provided in an embodiment of the present application is shown in FIG. 12;

[0045] Figure 10 A system framework diagram of an SSH remote connection process management provided in an embodiment of the present application is shown in FIG. 13.

[0046] Figure 11 A structure diagram of a computing device provided in an embodiment of the present application is shown in FIG. 14. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

[0048] In the description of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "multiple" is at least two, such as two, three, etc., unless otherwise specifically limited.

[0049] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "exemplarily", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0050] In order to facilitate the understanding of the scheme of the embodiments of the present application, the technical terms involved in the present application are first explained as follows.

[0051] Secure Shell (SSH): A technology for remotely logging into another computer or server through a network, which is a network protocol based on Secure Sockets Layer (SSL) or Transport Layer Security (TLS), used for secure communication between client and server, and is one of the most commonly used login methods in Linux system.

[0052] Control groups (cgroups): A resource management mechanism provided by Linux kernel, which can be used to limit and allocate resource usage of process groups. It allows administrators to create and manage cgroups control groups on the system, and allocate resource limits such as processor, memory, disk, network, etc. to each cgroup; exemplary processor can be central processing unit (CPU).

[0053] User: In Linux system, user (User) refers to an individual or entity in the system, representing a specific operating system account.

[0054] System daemon systemd: A system and service manager under Linux system, which is responsible for starting, stopping and managing other processes and services in the system, and also provides a series of resource control functions.

[0055] User resource limit ulimit: a Linux command used to limit process resources. It is used to set and display various resource limits for a process, such as maximum file size, maximum number of open files, maximum number of processes, etc. Through the ulimit command, you can view the resource limits of the current process, and you can use the ulimit command to dynamically modify these limits. The ulimit command is usually used in the command line terminal, for example: ulimit-n 1024, the above command will limit the number of files that can be opened by the current process to 1024.

[0056] Process identifier (PID): a numerical identifier used by the operating system to uniquely identify a running process. Each running process is assigned a unique PID value. PID is a non-negative integer, usually represented as a number, hence also known as identification number.

[0057] Remote connection refers to the process of connecting from a local computer to a remote computer over a network and performing operations and accessing resources on the remote computer. Remote connection can achieve interaction and communication between computers across regions and networks. Remote connection can be achieved through various protocols and technologies, the most common of which include SSH (secure shell), Telnet, rlogin, VNC (virtual network computing), etc. These protocols not only provide different functions and security levels, but also are suitable for different operating systems and services. In remote connection, the local computer needs to use remote connection client software to establish a connection with the remote computer. Once the connection is successfully established, the user can perform operations such as executing commands, managing files, running programs, etc. on the remote computer. Remote connection can also achieve remote desktop access, remote server management, remote technical support, etc. The secure shell protocol SSH remote connection process management method and computing device provided in the embodiments of the present application can limit any one of SSH, Telnet, rlogin and VNC remote connection process resources, which is not strictly limited in the present application. For the sake of convenience, the embodiments of the present application will be exemplarily described taking SSH as an example, which can be understood without being limited thereto.

[0058] Figure 1 An operating system level SSH session resource control flow diagram is shown. As shown in Figure 1 , in the Linux system, the resource control at the operating system level mainly relies on the increase of systemd configuration to achieve. For example, when SSH logs in, it is first judged whether the systemd resource limit is configured, if the systemd resource limit is configured, there is a resource limit, if the systemd resource limit is not configured, there is no resource limit.

[0059] If you want to limit the resources of the ssh session, you can add configurations such as CPU shares, memory limit, IO bandwidth, etc. in the service file of the sshd service. Specifically, by configuring the service file of the sshd service, you can set CPU shares, memory limit, IO bandwidth, etc. for the processes that log in remotely through SSH, thereby limiting the use of system resources by these processes.

[0060] For example:

[0061] 1. CPUShares = 500, which means that the process is allocated 50% of the CPU time relative to other processes. This configuration item is used to specify the priority of the process in competing for CPU resources, and the larger the value, the higher the priority, i.e. more CPU time can be obtained.

[0062] 2. MemoryLimit = 1G, which means that the memory limit of the process is 1GB. This configuration item is used to limit the size of physical memory that the process can use, and exceeding this limit will trigger the memory limit processing mechanism.

[0063] 3. BlockIOWeight = 500, which means that the process is allocated 50% of the disk IO resources relative to other processes. This configuration item is used to control the weight of the process's access to disk IO, and the larger the value, the more disk IO bandwidth can be obtained.

[0064] 4. TasksMax = 100, which means that the systemd unit allows a maximum of 100 processes. This configuration item is used to limit the maximum number of processes that a systemd unit (such as a service) can create, avoiding excessive system load caused by too many processes.

[0065] If the sshd service is configured with resource limits, the processes that log in remotely through SSH will be subject to resource limits. In this way, the occupation of system resources by remote login processes can be effectively controlled, thereby avoiding the situation where some remote login processes excessively occupy resources, causing system performance to decline or even crash. This is of great help to the stability and security of the system.

[0066] It can be understood that the sshd service refers to the SSH server program running on the Linux system server, which provides secure remote login and command execution functions. When other computers connect to the local machine through the SSH protocol, the sshd service is responsible for authenticating user identity, establishing an encrypted channel, and providing a secure remote shell environment or file transfer function. The sshd service is a very important service in the system, and its normal operation ensures the security and convenience of remote access. The service file of the sshd service refers to the.service file corresponding to each service managed by systemd in Linux using systemd as the resource control configuration. This file stores configuration information and control instructions about the service. For the sshd service, the service file of the sshd service contains definitions of start, stop, restart, status query and other operations, as well as various configuration parameters of the service, such as resource limits, dependencies, execution paths, etc. This file is usually stored in the system's unit file directory (usually / lib / systemd / system / or / etc / systemd / system / ) and has a.service extension. That is, the sshd service is the actual running SSH server program, and the service file of the sshd service is the configuration file for systemd to manage the sshd service, which defines the behavior and attributes of the sshd service so that systemd can start, stop, control and monitor the running of the sshd service according to these definitions.

[0067] It should be noted that when resource control is performed at the operating system level, the limits on resources are usually applied to the entire process group or user group. Due to the coarse granularity of the limits, some users or processes may be unnecessarily limited and cannot be managed in a fine-grained manner. For example, only a few processes in a process group need more CPU time, while other processes do not need it. However, due to the limitation on the entire process group, all processes are subject to the same limitation. If certain specific processes or users in the system need to be customized for resource allocation, the traditional operating system resource control method may not meet the needs.

[0068] To solve these problems, some advanced resource management technologies such as cgroup v2 and the resource control mechanism in systemd provide more fine-grained resource control capabilities, allowing administrators to manage resources more flexibly and finely for individual processes. This allows system administrators to better balance the use of system resources, avoid unnecessary limitations, and achieve more fine-grained management of system resources.

[0069] For example, refer to Figure 2, Figure 2 The following figure shows the process flow of manual management of individual SSH session resource control. Figure 2 As shown in the figure, after logging in through SSH, the system checks whether its resource usage is high. If not, the system continues to execute. If the SSH session resource usage is high, the administrator will obtain the PID of the SSH session and add it to the control group for resource control. However, if the administrator does not detect the SSH session with high resource usage, the SSH session will continue to execute. In other words, in this process, resource control of individual SSH sessions is mainly completed manually and implemented through cgroups technology. The system administrator obtains the PID of the SSH session and writes the process ID to a cgroup with resource control capabilities to implement resource control for the individual SSH session.

[0070] However, if there are a large number of SSH sessions that need to be controlled, manual management has certain limitations and difficulties. Specifically, if a large number of users need to remotely log in to the server via the SSH protocol to perform operations, each session must be independently configured and managed, including permission configuration, security policies, session monitoring, etc. This increases the administrator's workload and complexity, and is prone to omissions or incorrect settings, leading to security risks and management confusion. In addition, because SSH login times are uncertain and users can log in and out at any time, manual management makes it difficult to monitor and manage these sessions in a timely manner. In particular, manual management cannot meet these needs when real-time auditing of user behavior or emergency response is required, as administrators cannot effectively monitor the status and activity of all SSH sessions. In other words, the uncertainty of SSH login times leads to certain limitations in manual management.

[0071] In summary, both of the above methods for SSH session resource control require complex configuration and operation. For those unfamiliar with or lacking operating system knowledge, correctly configuring and managing these resource limits can be challenging. Furthermore, the resource control granularity of these two methods is relatively coarse, preventing fine-grained resource control.

[0072] Therefore, in order to realize dynamic, real-time and more refined SSH session resource limitation, the embodiment of the application provides a secure shell protocol (SSH) remote connection process management method. The method mainly sets the IP address and username information of the SSH session to be limited in a blacklist, compares the information in the blacklist with the source IP information of the initiated SSH session, and if the information in the blacklist is consistent with the source IP information of the initiated SSH session, acquires the corresponding SSH session process PID, adds the PID to a corresponding cgroups resource limitation group, and realizes resource limitation. Meanwhile, for the IP address not in the blacklist, the application monitors the resource usage of the IP address, and once the resource usage exceeds the limitation condition (exceeds the set resource usage threshold + exceeds the number of times), the application automatically writes the IP and the login user into the blacklist and adds the corresponding PID to the resource limitation group. Through combined use of the blacklist, the cgroups and the resource monitoring mechanism, dynamic, real-time and more refined SSH session resource limitation is realized.

[0073] Exemplarily, Figure 3 A flowchart of a secure shell protocol (SSH) remote connection process management method provided in the embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the method is applied to a Linux system and can include the following steps. Figure 3

[0074] S301, acquiring a login session identifier of a currently logged SSH remote connection process.

[0075] It can be understood that the login session identifier of the SSH is a SSH session process PID, and the PID process identifier represents a unique identifier of the ssh process of a user. In the embodiment, the pseudo terminal device (such as pts / 0) information of the currently logged SSH remote connection process SSH is acquired through a system log, and the PID process identifier of the ssh login session is acquired through the pseudo terminal device.

[0076] It is worth mentioning that in the Linux system, each terminal device has a specific name, usually starting with tty (such as tty1, tty2, etc.), and when a user remotely logs in through SSH or the like, a pseudo terminal device (pseudo terminal, referred to as pts) is allocated to provide an interactive session. The pts device has a number, such as pts / 0, pts / 1, etc., for uniquely identifying different terminal sessions. The bash process number of the ssh login session is acquired through the pseudo terminal device, and the bash process number of the ssh login session refers to the PID of the bash shell process started in the user login process, for indicating the interactive session process of the user. Common linux commands are generally as follows:

[0077] ​ps -ef | grep "pts / 0" | grep bash | awk '{print $2}'

[0078] All subsequent processes under this ssh session are child processes of this bash process.

[0079] S302, obtain user information based on the login session identifier.

[0080] It should be noted that the user information includes the user's IP address and user account name. The user's IP address and username user of the currently logged in SSH remote connection process ssh are obtained from the system log based on the login session identifier. In Linux systems, user login information and activity logs are usually recorded, and user IP addresses, user account names, and pseudo-terminal device information can be obtained by analyzing system logs, which are usually found in / var / log / auth.log or similar log files.

[0081] Among them, the user's IP address refers to the unique identifier of the device used by the user in the network. Every device connected to the Internet, whether it is a computer, a mobile phone, a tablet or other network devices, will be assigned an IP address for communication and data exchange on the network. IP addresses are usually composed of numbers, such as IPv4 addresses, which are usually represented by four decimal numbers, while IPv6 addresses are more complex and use longer hexadecimal representations. The user's IP address can be used to determine the user's approximate geographic location and for routing and data transmission in network communication. The user account name indicates the user's account name in the system, which is used to identify the user's identity.

[0082] S303, determine whether the user information is in the blacklist.

[0083] For example, the format of the blacklist is shown in Table 1:

[0084] Table 1

[0085] IP USER 192.168.100.100 root 192.168.100.101 test

[0086] As shown in the above table, the blacklist contains source IP information and login username information that need to be restricted, such as IP information 192.168.100.100 and USER username information root, or IP information 192.168.100.100 and USER username information test. Only when both of these two information are met, the next step will be started and the ssh resource restriction will be performed.

[0087] S304: If the user information is in the blacklist, add the SSH remote connection process to a resource control group; wherein the resource control group is used to limit resource usage of the SSH remote connection process.

[0088] For example, the SSH remote connection process and its child processes are added to the resource control group. That is, the PID of the blacklisted SSH process is added to a specific cgroup resource control group for resource control. Specifically, the bash process ID of the SSH process is written to the cgroup.procs file of the cgroups resource group to implement resource restrictions on the bash process and its child processes.

[0089] It's understandable that in an SSH session, when a user logs in to the system via SSH and starts a bash shell process as an interactive session, this bash process becomes the parent process of the session. Subsequently, all processes started by the user in this session become child processes of the bash process. cgroups (control groups), a mechanism provided by the Linux kernel, are used to manage and restrict resources for process groups. They place a group of related processes into the same resource group and implement resource limits, control, and monitoring for the processes in that resource group.

[0090] In cgroups, each resource group has a cgroup.procs file, which lists all process PIDs (process IDs) in the resource group. By writing the PID of a process into the cgroup.procs file, the process is added to the corresponding resource group. For example, suppose we have a cgroups resource group named "my_group", and there will be a cgroup.procs file in its corresponding directory. If we write the PID of a process into this file, for example, the PID is 12345, then the process will be added to the "my_group" resource group and will be subject to the resource limits of the resource group. By operating the cgroup.procs file, dynamic management of processes in a specific resource group can be achieved, including adding, removing, and querying operations. This is very useful for resource limiting, monitoring, and control, especially for resource management in scenarios such as batch tasks and containerized environments.

[0091] Therefore, by writing the PID of the bash process to the cgroup.procs file of the cgroups resource group, resource limits can be applied to the bash process and its child processes. All child processes spawned by the bash process will be automatically added to the corresponding resource group and thus subject to resource limits. This approach facilitates unified resource management and limits for all processes in a session, ensuring that they stay within the specified range when using system resources, thereby enhancing system stability and security.

[0092] Based on the above description, the following example uses the user with IP address 192.168.100.100 and user name root to log in to the Liunx server. Figure 4 , Figure 4 The following is an example of a SSH remote connection process management method provided by an embodiment of the present application; specifically, it is a flow chart of logging into a Liunx server using 192.168.100.100. Figure 4 As shown in the figure, first obtain the login IP, user, and PID information through the log, and then verify that the blacklist contains IP 192.168.100.100 and user name root. This means that the user with IP 192.168.100.100 and user name root meets the blacklist requirements. Then, add the PID to the restricted cgroup resource group to achieve the resource limit.

[0093] Figure 5 This is a flow chart of another SSH remote connection process management method provided in the embodiment of this application. Figure 5 As shown, the method is applied to a Linux system and includes:

[0094] S501. Create a cgroups resource group.

[0095] It should be noted that, in this implementation, a cgroups resource group can be automatically created by creating a directory in the cgroups file system.

[0096] Specifically, to create a cgroups resource group on a Linux system, you can do the following:

[0097] Confirm whether cgroups is enabled: First, confirm whether the Linux kernel has cgroups enabled. You can confirm whether cgroups is available by checking the system mount point ( / sys / fs / cgroup) or viewing the kernel configuration file ( / boot / config-uname-r).

[0098] Mount the cgroups file system: If the cgroups function is not enabled, you need to mount the cgroups file system on the system. You can use the following command to mount the cgroups file system:

[0099] bash

[0100] mount-t cgroup-o[subsystem][cgroup_path]

[0101] Among them, [subsystem] represents the specified cgroups subsystem, such as cpu, memory, etc.; [cgroup_path] represents the mount path.

[0102] Create a cgroups resource group: Once the cgroups file system is mounted successfully, you can create a cgroups resource group by creating a directory in the file system. For example, you can use the following command to create a cgroups resource group:

[0103] bash

[0104] mkdir / sys / fs / cgroup / [subsystem] / [resource_group_name]

[0105] Among them, [subsystem] represents the specified cgroups subsystem, such as cpu, memory, etc.; [resource_group_name] represents the name of the resource group.

[0106] Setting resource limits: After creating a resource group, you can set resource limits, such as CPU quotas and memory limits, by writing values ​​to the corresponding cgroups file.

[0107] For example, you can set CPU quotas by modifying the / sys / fs / cgroup / cpu / resource_group_name / cpu.cfs_quota_us file.

[0108] Add the script or program written above to the system startup script to ensure automatic running when the server starts. In this way, the specified cgroups resource group will be automatically created after each server startup. Through the above steps, you can create a cgroups resource group on a Linux system and limit the resources of the pid process added to it. This way you can limit and manage the resource usage of specific processes or users. It should be noted that the specific operation may vary depending on the system version and cgroups subsystem. The above is an example of the explanation, and the developer can make appropriate adjustments according to the actual situation.

[0109] S502, obtain the login session identifier of the SSH remote connection process SSH user currently logged in.

[0110] S503, obtain user information based on the login session identifier.

[0111] S504, determine whether the user information is in the blacklist. If the user information is in the blacklist, execute flow S505. If the user information is not in the blacklist, execute flow S506.

[0112] S505, in the case where the user information is in the blacklist, add the user's ssh process to the cgroup resource control group; wherein the resource control group is used to limit the resource usage of the SSH remote connection process ssh.

[0113] In another embodiment, continuing to refer to Figure 5 , the method of limiting the resource usage of the specified SSH remote connection process based on the login session identifier not being in the blacklist can further include:

[0114] S506, in the case where the login session identifier is not in the blacklist, monitor the resource usage of the user's ssh process.

[0115] For example, the resource usage of the ssh process of the user is monitored by a Linux monitoring tool. For example, the bash process number of the ssh process and the resource usage of the child processes thereof can be obtained by a Linux monitoring tool such as ps-aux or top. It should be noted that the ps command is used to display the process state in the current system. Using the "ps-aux" command can list detailed information of all processes, including the PID, CPU usage, memory occupation, etc. of the process. Among them, the "-a" option means to display all user processes, the "-u" option means to output the result in the format of the user display, and the "-x" option means to display the processes without a control terminal at the same time. For example, the "ps-aux" command is used to find the PID of the target process, and the target process can usually be filtered according to the process name, user, etc. After obtaining the PID of the target process, the "ps-aux|grep <pid>" command to view detailed information about the process, including CPU usage, memory usage, etc., to monitor the resource usage of the target process and its child processes in real time.

[0116] The top command is used to dynamically monitor the system's operating status and process activities in real time. It displays the resource usage of each process in an interactive manner and provides real-time updated information. Through the top command, you can view the process's PID, CPU usage, memory usage, process priority and other information. For example, if you use the top command, you can press the "p" key on the top interface, then enter the PID of the target process and press Enter to confirm. In this way, the top command will only display information about the process and its child processes, including CPU usage, memory usage, etc. In this way, you can monitor the resource usage of the target process and its child processes in real time to understand the system load and process performance in real time.

[0117] Exemplarily, the Linux monitoring tool can also be any one of htop, iostat, nmon, sar and dstat, which can be selected and used according to needs to better obtain the resource usage of the ssh process. The embodiments of the present application are not strictly limited here.

[0118] It should be noted that htop is an improved version of the top command, which provides a more intuitive and interactive interface and supports mouse operations. iostat is used to monitor the system's input and output devices and CPU utilization, and provides statistical information about disks, networks, and TTY devices. nmon is a comprehensive system monitoring tool that can provide real-time performance data, including CPU, memory, disk, network, and file system. sar is a system activity reporting tool that can collect, report, and analyze system resource usage, including CPU, memory, disk, network, and file system. dstat is an all-round system resource statistics tool that can monitor CPU, disk, network, memory, IO and other performance indicators in real time.

[0119] S507, determine whether the user's ssh process resource usage exceeds the limit. If the user's ssh process resource usage does not exceed the limit, then execute process S508. If the user's ssh process resource usage exceeds the limit, then execute process S509.

[0120] S508: If the resource usage of the user's ssh process does not exceed the limit, continue to execute the user's ssh process.

[0121] S509: When the resource usage of the user's ssh process exceeds the limit, the user information of the user is written into a blacklist.

[0122] For example, the IP and user in the user information are written into the blacklist, and the PID of the user's ssh process is added to the cgroup resource control group to limit the resource of the ssh process.

[0123] Thus, the method in the embodiment can automatically create a cgroup resource control group on the logged-in server to implement resource control, and monitor the IP, user, and bash process number PID obtained from the system log after a new ssh connection. Next, the information is compared with the blacklist. If the user IP and user name user are in the blacklist, the bash process number PID is written into the cgroup.procs file of the cgroup resource group to limit the resource. If not, the resource usage of the bash process number and the child process is monitored. Once it is found that the resource usage exceeds the limit condition set in the embodiment, the bash process number and its child process are written into the cgroup.procs file of the cgroup resource group. Meanwhile, the user IP and user name user of the ssh login are also written into the blacklist to limit the resource usage of the user in the next login.

[0124] Referring to Figure 6 , Figure 6 A flowchart for determining whether the resource usage of the user's ssh process exceeds the limit condition is shown. As shown in Figure 6 , for example, determining whether the resource usage of the user's ssh process exceeds the limit condition includes:

[0125] S601, monitoring the PID resource usage.

[0126] It should be noted that the description of the implementation of step S601 is the same as the description of step S506 described above, and the specific implementation can be referred to the description above, which will not be repeated here.

[0127] S602, determining whether the resource usage of the user's ssh process exceeds the resource threshold.

[0128] In this implementation process, the resource threshold can be set to specify the maximum limit of the CPU share usage rate of each user's SSH process. This can be achieved by the time interval of the CPU in the cgroup group and the total amount of time using the CPU. For example, the resource threshold is set to 80% of the CPU share usage rate. If the CPU share usage rate of the ssh process does not reach or equal to the set resource threshold, the process S601 is continued. If the CPU share usage rate of the SSH process exceeds the set threshold, the process S603 is executed.

[0129] S603, in the case that the resource usage exceeds the resource threshold, obtaining the number of times that the resource usage of the ssh process exceeds the resource threshold and the limit number, and determining whether the number of times that the resource usage of the ssh process exceeds the resource threshold exceeds the limit number. If the number of times that the resource usage of the ssh process exceeds the resource threshold does not exceed (is less than or equal to) the limit number, the flow S604 is executed. If the number of times that the resource usage of the ssh process exceeds the resource threshold exceeds (is greater than) the limit number, the flow S605 is executed.

[0130] It can be understood that the limit number is the upper limit number of times that the resource usage of the ssh process exceeds the resource threshold, and the specific number of the limit number can be set by a person skilled in the art as needed, for example, 5, 6, 7, 8, which is not specifically limited herein.

[0131] S604, in the case that the number of times that the resource usage of the ssh process exceeds the resource threshold is less than or equal to the limit number, the number of times that the resource usage of the ssh process exceeds the resource threshold is increased by one, and then the flow S601 is continuously executed.

[0132] S605, in the case that the number of times that the resource usage of the ssh process exceeds the resource threshold exceeds the limit number, the pid of the ssh process of the user is written into the cgroups resource control group.

[0133] S606, the ip and the user of the ssh process of the user are written into the blacklist.

[0134] In the embodiment, two judgment conditions are set: one is to determine whether the resource usage threshold is exceeded, for example, to determine whether the CPU usage exceeds 80%; the other is to determine the number of times that the threshold is exceeded if the resource usage has exceeded the threshold, and if the number of times exceeds the limit, the device considers that the use of the operating system habit of the user ip is a great probability to exceed the limit in the use process, and automatically writes it into the blacklist for resource limitation; if the resource threshold is exceeded but the limit number is not exceeded, the method considers that it is only an occasional exceeding of the resource limit use behavior, and the number of times that the threshold is exceeded is increased by one, and the process resource usage is continuously monitored. Thus, unnecessary limitation of some users or processes can be avoided.

[0135] Based on the above description, the following exemplary illustrates a user ip 192.168.100.101, and a user name user as test logs in a Liunx server, refer to Figure 6 , Figure 6 shows an example of an SSH remote connection process management method, specifically a flow diagram of logging in a Liunx server using 192.168.100.101 in the embodiment of the application. As Figure 6 As shown, first, the login ip, user, and pid information are obtained through the log, then it is verified that the ip 192.168.100.100 and user root in the blacklist, which indicates that the ip 192.168.100.101 and user test do not meet the blacklist, then the resource usage of the pid and child process is monitored, specifically including judging whether the resource usage of the pid and child process exceeds the resource threshold, if not, the resource usage of the pid and child process is continuously monitored; if the resource usage of the pid and child process exceeds the resource threshold, the number of times of exceeding the threshold is judged; if the number of times does not exceed the limit, the number of times of exceeding the resource threshold of the ssh process is increased, then the resource usage of the pid and child process is continuously monitored; if the number of times exceeds the limit, the pid is written into the cgroup resource control group to achieve resource limitation, finally, the ip 192.168.100.101 and user name user are written into the blacklist.

[0136] Therefore, the method for limiting resource usage of a specified SSH remote connection process provided by the embodiments of the present application realizes dynamic and real-time SSH session resource limitation by combining the use of a blacklist, cgroups, and a resource monitoring mechanism. Compared with traditional static resource configuration, the scheme has the following innovations and advantages:

[0137] Dynamic limitation: By using a blacklist and PID dynamic management, specific SSH session resources can be limited in real time according to requirements without static configuration. This allows more flexible and accurate resource limitation for sessions.

[0138] Automatic management: The scheme describes an automatic monitoring and limitation mechanism for IP addresses not in the list. If the resource usage exceeds the limit, the system automatically writes the relevant IP address into the blacklist and adds the corresponding PID to the resource limitation group. This automated management reduces the workload of administrators.

[0139] Customized limitation: Using the cgroups resource limitation function, different sessions can be personalized for resource limitation according to requirements. Administrators can configure corresponding limitations according to specific requirements, such as CPU share, memory limitation, etc.

[0140] Improved security: Through the blacklist and resource limitation, unauthorized SSH sessions can be prevented from abusing system resources. Only verified sessions can obtain appropriate resource quotas, thereby improving the security and stability of the system.

[0141] In summary, the present application innovatively combines a blacklist, cgroups, and a resource monitoring mechanism to realize dynamic and automated SSH session resource limitation, which has the advantages of improving system security and resource management efficiency.

[0142] The above is a secure shell (SSH) remote connection process management method provided in an embodiment of the present application. The following is an embodiment of a secure shell (SSH) remote connection process management device provided in the embodiment of the present application.

[0143] Referring to Figure 8 , Figure 8 FIG. 8 is a structural schematic diagram of an SSH remote connection process management device provided in an embodiment of the present application. As shown in Figure 8 , the device 800 can be divided into an obtaining unit 810, a first judging unit 820, a first processing unit 830, a second judging unit 840, and a second processing unit 850 according to the execution functions. The device 800 implements the process as follows. Figure 9 , Figure 9 FIG. 8 is a structural schematic diagram of an SSH remote connection process management device provided in an embodiment of the present application. As shown in Figure 9 , the device 800 is installed on the logged-in server, and the device 800 automatically creates a cgroups resource group to implement resource limitation, and the cgroups resource control group limits 80% of CPU usage. The device 800 implements the functions of the units as follows.

[0144] The obtaining unit 810 is configured to obtain a login session identifier of a user in response to an ssh login connection of the user. The login session identifier of the SSH is an SSH session process PID, and the user IP address and the user name user of the current logged-in SSH remote connection process ssh are obtained from a system log based on the login session identifier.

[0145] The first judging unit 820 is configured to judge whether the user information is in a blacklist. The information recorded in the blacklist can be, for example, a user ID (such as 192.168.100.100) and a user name user (such as root).

[0146] The first processing unit 830 is configured to add the ssh process of the user to a cgroup resource control group in the case that the user information is in the blacklist. For example, the pid of the ssh process is added to the limited cgroup resource group, and the CPU resource usage is limited. In the case that the user information is not in the blacklist, the resource usage of the ssh process of the user is monitored. For example, the cpu resource usage of the pid and the child process is monitored.

[0147] The second judging unit 840 is configured to judge whether the resource usage of the ssh process of the user exceeds a limitation condition.

[0148] The second processing unit 850 writes the login session identifier of the user into the blacklist in the case that the resource usage of the ssh process of the user exceeds the limit condition. Specifically, the pid is added into the cgroup resource group of the limit, and the resource usage of the CPU is limited; the user name user and the user id information are written into the blacklist. In this way, the device 800 limits the further CPU resource acquisition of the ssh process of the user, so as to ensure that other processes and tasks in the system can obtain sufficient CPU resources, ensure the fair and reasonable resource allocation between users, thereby reducing the risk of system crash or unavailability, and improving the stability and performance of the system.

[0149] In an embodiment, the second judging unit 840 is further configured to judge whether the resource usage of the ssh process of the user exceeds a resource threshold value; and in the case that the resource usage exceeds the resource threshold value, judge whether the number of times that the resource usage of the ssh process exceeds the resource threshold value exceeds a limit number of times. The second processing unit 850 is further configured to, in the case that the number of times that the resource usage of the ssh process exceeds the resource threshold value does not exceed the limit number of times, increase the number of times that the resource usage of the ssh process exceeds the resource threshold value; and in the case that the number of times that the resource usage of the ssh process exceeds the resource threshold value exceeds the limit number of times, write the login session identifier of the user into the blacklist. It should be noted that the description of judging whether the resource usage of the ssh process of the user exceeds the limit condition is the same as the description of judging whether the resource usage of the ssh process of the user exceeds the limit condition, and details can be referred to the above description, which will not be repeated here. Figure 6

[0150] Referring to Figure 10 , Figure 10 is a schematic diagram of a system architecture of an embodiment of the present application. As shown in Figure 10 , the system is composed of software of a client and a server. The server is a daemon which runs in the background and responds to the connection request from the client. The server is generally an sshd process which provides the processing of remote connection, generally including public key authentication, key exchange, symmetric key encryption and non-secure connection. The client includes the ssh program and other application programs such as scp (remote copy), slogin (remote login), sftp (secure file transfer) and the like. The working mechanism is that the local client sends a connection request to the remote server, the server checks the package and IP address of the application and sends the key to the SSH client, and the local client sends the key back to the server, and the connection is established.

[0151] ​The device 800 in the embodiment of the present application is configured on a service end, and the service end is further configured with an ssh service and a cgroup control group. The ssh service on the service end includes port connection, identity authentication interactive session and system log. Through the system log, the obtaining unit 810 in the device 800 obtains login ip, user information and session pid. The first judging unit 820 judges whether the login session identifier is in a blacklist. The user login ip+user is recorded in the blacklist. If the blacklist matches, the first processing unit 830 writes the pid into the cgroup control group, and the cgroup control group limits the resource of the process through its own cpu resource group and mem resource group. If the blacklist does not match, the second judging unit 840 judges whether the resource used by the ssh process of the user exceeds the limit condition (exceeds the set resource use threshold value + exceeds the number of times), if the resource used by the ssh process exceeds the set resource use threshold value and the number of times exceeds the limit number of times, the second processing unit 850 writes the ip and user into the blacklist, and then writes the pid into the cgroup group to limit the resource.

[0152] Compared with the related art unified limit, the resource limiting method without distinction, the device for limiting the resource use of the SSH remote connection process in the embodiment combines the use of the blacklist, the cgroups and the resource monitoring mechanism, and more accurately limits the resource of the ssh session which has a great probability of exceeding the resource limit. Moreover, the device of the present application runs in the background of the system in real time without manual operation of the system administrator, avoids the problems of untimely manual management caused by the uncertainty of SSH login time, and incorrect resource limit caused by manual error configuration, and has certain improvement on the management efficiency and system security.

[0153] In order to more completely understand the present application, the following implementation scenario is given. The implementation scenario is used to specifically illustrate the implementation scheme of the present application, and should not be understood as limiting the scope of the present application in any way.

[0154] The SSH remote connection process management method and device provided by the embodiment of the present application realize more refined, dynamic and real-time SSH session resource limitation by innovatively combining the blacklist, the cgroups and the resource monitoring mechanism.

[0155] Future application scenarios can include:

[0156] Security management: The device can be used as a security management tool to limit the resource usage of remote SSH sessions. By setting a blacklist, unauthorized IP addresses and login users can be prevented from accessing the system, thereby strengthening access control to the system. At the same time, for authorized IP addresses and login users, the device can monitor and limit their resource usage, such as limiting the use of CPU, memory, disk, etc., to prevent abuse and excessive use. This helps to improve the security of the system and prevent malicious attacks and unauthorized access.

[0157] Resource optimization: In a server cluster environment, the resource usage of SSH sessions can affect the overall system performance. Through the device, resource limits can be set for each session to ensure reasonable allocation of resources occupied by each session, improving the overall performance and stability of the system. By monitoring and limiting the resource usage of SSH sessions, it can be avoided that a certain session occupies too many resources and affects other sessions, thereby optimizing the utilization efficiency of system resources.

[0158] Cloud computing environment: In a cloud computing environment, the device can be used to limit the resource usage of SSH sessions. For cloud server providers, different resource limits can be set for different SSH sessions according to customer needs and payment plans, thereby providing customized services. For cloud server users, the device can be used to monitor and control the resource usage of their own SSH sessions to avoid additional costs and performance losses. This helps to improve the flexibility and cost control ability of cloud services, while ensuring fair allocation of resources among users.

[0159] Data center management: In a large data center, the device can be used to manage the resources of SSH sessions. Administrators can set blacklists as needed to limit the resource usage of specific IP addresses or users, ensuring the stability and priority of critical tasks. This helps data center administrators better manage and optimize resource allocation, ensuring the normal operation of critical tasks, while avoiding system performance degradation due to resource competition.

[0160] In summary, the device 800 provided by the embodiments of the present application can be applied to security management, resource optimization, cloud computing environment and data center management, etc. By monitoring and limiting the resource usage of SSH sessions, the security, performance and resource utilization efficiency of the system can be improved.

[0161] As shown in Figure 11 The embodiments of the present application also provide a computing device 900. The computing device 900 can include a processor 901, a memory 902, a communication interface 903 and a bus 904. The processor 901, the memory 902 and the communication interface 903 can be connected through the bus 904.

[0162] The processor 901 is a control center of the computing device 900, and can be a general central processing unit (CPU), or other general processor, etc. The general processor can be a microprocessor or any conventional processor, etc. In embodiments of the present application, the SSH remote connection process management method can be executed by the processor 901 in the computing device 900.

[0163] As an example, the processor 901 can include one or more CPUs.

[0164] The memory 902 can be a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program codes in the form of instructions or data structures and capable of being accessed by a computer, but is not limited thereto.

[0165] In a possible implementation, the memory 902 can exist independently of the processor 901. The memory 902 can be connected to the processor 901 through the bus 904, for storing data, instructions or program codes. When the processor 901 invokes and executes the instructions or program codes stored in the memory 902, the SSH remote connection process management method provided by the embodiments of the present application can be implemented.

[0166] In another possible implementation, the memory 902 can also be integrated with the processor 901.

[0167] The communication interface 903 is used for connecting the computing device 900 with other devices through a communication network, which can be an Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc. The communication interface 903 can include a receiving unit for receiving data, and a sending unit for sending data.

[0168] The bus 904 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 11 In the figure, only one thick line is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0169] It should be noted that Figure 11 The structure shown in the figure does not constitute a limitation on the computing device 900, except Figure 11 The computing device 900 can include more or fewer components than shown, or combine some components, or different component arrangements. The computing device includes a processor and a memory, which are coupled. The memory is used to store computer program instructions, and the processor is used to invoke the computer program instructions in the memory to execute the SSH remote connection process management method shown in the above embodiments. For example, the processor is used to invoke the computer program instructions in the memory, so that the computing device executes the SSH remote connection process management method as shown in Figures 3-6 The above-mentioned corresponding protected technical solutions, so that the computing device has the technical effects of the above-mentioned protected technical solutions.

[0170] The computer readable storage medium in the embodiments of the present application stores a computer program, and when the computer program is executed in a computer, the computer executes the above-mentioned Figures 3-6 The secure shell (SSH) remote connection process management method described in any one of the above-mentioned corresponding description contents.

[0171] The computer program product in the embodiments of the present application stores instructions, and the instructions make the computer implement the above-mentioned Figures 3-6 The secure shell (SSH) remote connection process management method described in any one of the above-mentioned corresponding description contents.

[0172] Those skilled in the art can realize the units and algorithm steps of each example described in connection with the embodiments disclosed herein can be realized in electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the particular application and design constraints. Those skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0173] Moreover, various aspects or features of the disclosure can be implemented as a method, apparatus, or article of manufacture using standard programming and / or engineering techniques. The term "article of manufacture" as used in the application is intended to encompass a computer program accessible from any computer-readable device, carrier, or media. For example, computer-readable media can include but are not limited to magnetic storage devices (e.g., hard disk, floppy disk, magnetic strips, etc.), optical disks (e.g., compact disk (CD), digital versatile disk (DVD), etc.), smart cards, and flash memory devices (e.g., EPROM, card, stick, or key drive, etc.). Additionally, various storage media described herein can represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" can include, without being limited to, wireless channels and various other media capable of storing, containing, and / or carrying instruction(s) and / or data.

[0174] In the above-described embodiments, Figure 8 The secure shell protocol (SSH) remote connection process management apparatus 800 described above can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, digital video disc (DVD)), or semiconductor media (for example, solid state disk (SSD)) and the like.

[0175] It should be understood that the size of the sequence number of each process described above in various embodiments of the embodiments of the present application does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0176] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the above-described device, apparatus and unit can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0177] In several embodiments provided in the present application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the apparatus embodiments described above are only schematic. For example, the division of the units is only a logical function division, and actual implementation can have another division manner. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0178] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0179] The functions, if implemented in the form of software functional units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or an access network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0180] Finally, it is pointed out that the above embodiments are only used to illustrate the technical solutions of the present application. Those skilled in the art should understand that although the present application has been described in detail with reference to the foregoing embodiments, the technical solutions described in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones. The modification or replacement does not make the corresponding technical solution deviate from the spirit and scope of the technical solutions in the embodiments of the present application.< / pid>

Claims

1. A method for managing an SSH remote connection process, characterized by, The method comprises: obtaining a login session identifier of a currently logged SSH remote connection process; obtaining user information based on the login session identifier; determining whether the user information is in a blacklist; in a case where the user information is in the blacklist, adding the SSH remote connection process to a resource control group; wherein the resource control group is used to limit resource usage of the SSH remote connection process; in a case where the user information is not in the blacklist, obtaining resource usage of the SSH remote connection process; in a case where the resource usage exceeds a resource threshold and the number of exceeding the resource threshold exceeds a limit number, adding the SSH remote connection process to the resource control group and adding the user information to the blacklist.

2. The method of claim 1, wherein, The user information comprises an IP address and a username of a user of the currently logged SSH remote connection process. The obtaining of the user information based on the login session identifier comprises: obtaining the IP address and the username of the user of the currently logged SSH remote connection process from a system log based on the login session identifier.

3. The method of claim 1, before joining the SSH remote connection process to a resource control group, the method further comprising: The method further comprises:

4. The method of claim 1, wherein, creating the resource control group. The adding of the SSH remote connection process to the resource control group in the case where the user information is in the blacklist comprises:

5. The method of claim 1, wherein, adding the SSH remote connection process and its child processes to the resource control group. The obtaining of the login session identifier of the currently logged SSH remote connection process comprises: obtaining a pseudo terminal device; 6. The method according to any one of claims 1 to 5, characterized in that, obtaining a login session identifier of a remote connection login session through the pseudo terminal device.

7. A computing device, comprising: The resource limited by the resource control group comprises at least one of a CPU share, a memory size and an IO bandwidth, wherein the CPU share is a percentage of occupied CPU. The computer device comprises a memory and a processor; the memory and the processor are coupled, wherein the memory is used to store computer program instructions, and the computer program instructions are run by the processor to make the computer device execute the method according to any one of claims 1-6.

Images