Operation and maintenance auditing method and access auditing system

Abstract

The invention provides an operation and maintenance auditing method and an access auditing system, and relates to the technical field of security and network communication. The method comprises the following steps: in response to request information, starting a target virtual network computing service at a target position of a server so as to establish a virtual desktop corresponding to a virtual network agent module, and starting a database operation application program; establishing communication connection with the virtual network agent module through the target virtual network computing service, and displaying a virtual desktop on the terminal equipment through the virtual network agent module; when the database operation application program runs, the database is loaded on the virtual desktop through the connection information of the database, and the database is accessed according to the operation of a user on the database. According to the method and the device, the access channel is established for the user by establishing the communication connection between the target virtual network computing service and the virtual network agent module, and a scheme for carrying out data filling on behalf of another in the Linux server is provided, so that the problem of lack of a filling-on-behalf scheme in the Linux server is solved.

Description

Technical Field

[0001] The present application relates to the field of security and network communication technology, and in particular to an operation and maintenance audit method and an access audit system. Background Art

[0002] With the continuous deepening of enterprise informatization construction, database operation and maintenance management plays an important role in ensuring data security and improving operation and maintenance efficiency. In the Windows operation and maintenance environment, database connection tools (such as Navicat) are widely used for database connection and operation. However, traditional operation and maintenance methods usually require operation and maintenance personnel to manually enter database connection information, which not only increases the complexity of operation, but may also lead to the leakage of sensitive information. In order to solve this problem, the existing technology proposes a solution to automatically fill in the database connection information through a filling tool, and generates an encrypted operation and maintenance resource identifier (Uniform Resource Identifier, URI) through the operation and maintenance audit system. The filling tool parses the URI and writes the target asset information into the Windows registry. The Navicat client directly reads the information from the registry and establishes a connection, thereby avoiding the operation and maintenance personnel from directly accessing the password.

[0003] However, while existing solutions solve the auto-fill problem in Windows environments, they lack a similar auto-fill service in Linux environments. Furthermore, in Linux environments, there's no auditing function for user operations (such as querying, modifying, and deleting data) within Navicat, and no comprehensive monitoring and recording of specific operations. Summary of the Invention

[0004] The purpose of this application is to provide an operation and maintenance audit method and an access audit system to address the deficiencies in the above-mentioned existing technologies, so as to solve the problems in the existing technologies of lacking a proxy filling service in a Linux operation and maintenance environment, lacking an audit function for user operations performed in Navicat in a Linux operation and maintenance environment, and being unable to comprehensively monitor and record specific operation behaviors.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of the present application are as follows:

[0006] In a first aspect, an embodiment of the present application provides an operation and maintenance audit method, which is applied to a server in an access audit system, wherein the access audit system includes the server and a terminal device, and a virtual network agent module is deployed on the terminal device. The method includes:

[0007] receiving a request message sent by the virtual network proxy module, wherein the request message includes connection information of a database to be accessed;

[0008] In response to the request information, starting a target virtual network computing service at a target location of the server to establish a virtual desktop corresponding to the virtual network agent module, and starting a database operation application;

[0009] Establishing a communication connection with the virtual network proxy module through a target virtual network computing service, and displaying the virtual desktop on the terminal device through the virtual network proxy module;

[0010] When the database operation application is running, the database is loaded on the virtual desktop through the connection information of the database, and the database is accessed according to the user's operation on the database.

[0011] As a possible implementation manner, starting the target virtual network computing service at the target location of the server includes:

[0012] The target virtual network computing service is started at the target location, and service connection information is allocated to the target virtual network computing service, where the service connection information includes a port and a password.

[0013] As a possible implementation, starting the database operation application includes:

[0014] Establishing a session directory corresponding to the virtual network proxy module, creating a target file in the session directory, and storing the connection information of the database in the target file;

[0015] The database operation application is started, and a session directory variable in the environment variable of the database operation application is set to the session directory, and a display variable of the database operation application is set to the virtual desktop.

[0016] As a possible implementation, before establishing a communication connection with the virtual network proxy module through the target virtual network computing service, the method further includes:

[0017] Sending service connection information of the target virtual network computing service to the virtual network agent module;

[0018] The establishing of a communication connection with the virtual network proxy module through the target virtual network computing service includes:

[0019] The target virtual network computing service receives a connection request sent by the virtual network agent module, wherein the connection request includes the service connection information;

[0020] Establishing a communication connection with the virtual network proxy module according to the connection request.

[0021] As a possible implementation, when the database operation application is running, the database is loaded on the virtual desktop through the database connection information, and the database is accessed according to the user's operation on the database, including:

[0022] When the database operation application is running, the connection information of the database is read from the target file in the session directory;

[0023] Reading the data of the database through the connection information of the database, and displaying the data of the database on the virtual desktop;

[0024] The user's operation data on the virtual desktop is obtained, and the database is accessed according to the operation data.

[0025] As a possible implementation, the method further includes:

[0026] Create a log file in the session directory.

[0027] The user's operation data on the virtual desktop is stored in the log file.

[0028] As a possible implementation manner, after storing the user's operation data on the virtual desktop in the log file, the method further includes:

[0029] Read each line of operation data record in the log file;

[0030] For the character string in each row of operation data record, determine whether the character string is a database programming statement. If so, perform grammatical parsing on the character string to obtain user operation instructions, and send the user operation instructions to the terminal device so that the terminal device can audit the user operation instructions.

[0031] In a second aspect, an embodiment of the present application provides another operation and maintenance audit method, which is applied to a terminal device, wherein a virtual network agent module and an authentication module are deployed on the terminal device; the method comprises:

[0032] The virtual network proxy module obtains user access information and sends the user access information to the authentication module, wherein the user access information includes an access string, and the access string is used to indicate connection information of a database to be accessed;

[0033] The authentication module performs authentication processing on the user access information, and sends the connection information of the database to be accessed to the virtual network agent module after the authentication is passed.

[0034] As a possible implementation manner, the authentication processing of the user access information includes:

[0035] Determining whether the access string is issued by the operation and maintenance audit system running on the terminal device;

[0036] If so, it is determined that the authentication is successful.

[0037] In a third aspect, an embodiment of the present application provides an access audit system, the access audit system comprising a server and a terminal device;

[0038] The server is used to execute the steps of the operation and maintenance audit method according to any one of the first aspects;

[0039] The terminal device is used to execute the steps in the operation and maintenance audit method described in any one of the second aspects.

[0040] In a fourth aspect, an embodiment of the present application provides a terminal device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the terminal device is running, the processor and the storage medium communicate through the bus, and the processor executes the machine-readable instructions to perform the steps of the operation and maintenance audit method as described in any one of the second aspects above.

[0041] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, the steps of the operation and maintenance audit method described in any one of the first and second aspects above are executed.

[0042] According to the operation and maintenance audit method and access audit system of the embodiment of the present application, the access audit system includes a server and a terminal device, and a virtual network agent module is deployed on the terminal device. The server receives the request information sent by the virtual network agent module and responds to the request information. It starts the target virtual network computing service at the target location of the server to establish a virtual desktop corresponding to the virtual network agent module, and starts the database operation application. It establishes a communication connection with the virtual network agent module through the target virtual network computing service, and displays the virtual desktop on the terminal device through the virtual network agent module. When the database operation application is running, the database is loaded on the virtual desktop through the database connection information, and the database is accessed according to the user's operation on the database. According to the embodiment of the present application, after receiving the request information sent by the virtual network agent module deployed on the terminal device, the server automatically starts the target virtual network computing service at the target location and establishes a virtual desktop corresponding to the virtual network agent module. This process does not require the user to manually enter the connection information. The filling function can be automatically completed through the communication connection between the virtual network agent module and the target virtual network computing service. Furthermore, when the database operation application is started in the virtual desktop, it directly loads the database by reading the connection information, thereby realizing the automatic connection of the user's remote access to the database operation application. On this basis, the database operation application can record the operation data of users accessing the database in real time. The target virtual network computing service reads the operation data and returns the operation data to the terminal device, so that the terminal device can monitor and audit the user operation data. This not only provides a filling service in the Linux operation and maintenance environment, but also solves the problem of lack of filling service in the Linux operation and maintenance environment in the existing technology. Moreover, by establishing a user access channel, the user operation data is stored on the terminal device in a timely manner, which facilitates comprehensive monitoring and auditing of the user operation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 A schematic diagram of the architecture of an access audit system provided by an embodiment of the present application is shown;

[0045] Figure 2 A schematic diagram of a process flow of an operation and maintenance audit method provided in an embodiment of the present application is shown;

[0046] Figure 3A schematic diagram of a process for starting a database operation application program provided in an embodiment of the present application is shown;

[0047] Figure 4 A schematic diagram of a process flow of an audit method provided in an embodiment of the present application is shown;

[0048] Figure 5 A flow chart of another operation and maintenance audit method provided in an embodiment of the present application is shown;

[0049] Figure 6 An interactive diagram of a method for implementing application access and auditing based on a Linux application publishing server provided in an embodiment of the present application is shown;

[0050] Figure 7 A schematic structural diagram of a terminal device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of illustration and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowcharts can be implemented out of sequence, and steps without logical context can be reversed or implemented simultaneously. In addition, those skilled in the art, under the guidance of the contents of this application, can add one or more other operations to the flowchart, or remove one or more operations from the flowchart.

[0052] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0053] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0054] Figure 1 The following is a schematic diagram showing the architecture of an access audit system provided by an embodiment of the present application. Figure 1As shown, the access audit system includes a terminal device and a server, wherein the server is a Linux application publishing server, which is essentially a Linux system with a desktop. The terminal device is a computer or other device, and an operation and maintenance audit system is running on the terminal device. Users can access the operation and maintenance audit system through a browser, and a virtual network proxy module (Virtual Network Computing, VNC proxy module) is deployed on the terminal device. The operation and maintenance audit system can establish a connection with the Linux system through the VNC protocol based on the VNC proxy module to operate applications on the Linux system.

[0055] Optionally, an authentication module is also deployed on the terminal device. Users access the operation and maintenance audit system running on the terminal device through a browser, specifically accessing the VNC proxy module based on the front-end page provided by the operation and maintenance audit system. The VNC proxy module sends user access information to the authentication module for authentication. After authentication, the authentication module sends the connection information of the database to be accessed corresponding to the user access information to the VNC proxy module. The VNC proxy module sends the connection information of the database to be accessed to the Postman service in the Linux application publishing server. The Postman service then launches the target Virtual Network Computing service (Xvnc service) to establish a virtual desktop and launches a database operation application (i.e., Navicat, a database connection tool). Navicat can seamlessly connect to multiple databases from a single application. Furthermore, a session connection is established between the VNC proxy module and the Xvnc service based on the service connection information, and a virtual desktop is displayed on the terminal device. When Navicat runs, the database connection information is used to load the database on the virtual desktop, and the user can perform operations on the database to access it.

[0056] The postman service is a session management and application proxy service within the Linux application publishing server. It's primarily responsible for starting the Xvnc service and delivering session information to terminal devices. It also provides tools for launching database connections and implementing auditing. The Xvnc service is essentially an X Virtual Network Computing server based on the standard X server. It provides a virtual screen rather than a physical one, accessible through a VNC viewer.

[0057] Optionally, an audit module is also deployed on the terminal device. The postman service can obtain the user's operation data on the database on the virtual desktop and store it in a log file, and perform a preliminary analysis of the log file. Specifically, it can filter database programming statements (Structured Query Language, SQL statements) from the operation data, and parse the SQL statements to obtain user operation instructions. Based on the session connection between the VNC proxy module and the Xvnc service, the user operation instructions are sent to the audit module so that the audit module can audit the user operation instructions.

[0058] Based on this, the access audit system provided by this application establishes access for users by establishing a session connection between the VNC proxy module and the Xvn c service, and records the user's entire session operation data on the database connection tool Navicat through the VNC proxy on the operation and maintenance audit system, so as to subsequently replay and monitor the operation by parsing the session operation data, thereby ensuring the security of the operation and maintenance audit system and the traceability of user operations.

[0059] The following combines the above Figure 1 The content described in the access audit system shown is a detailed description of the operation and maintenance audit method provided in the embodiment of the present application.

[0060] Reference Figure 2 FIG. 1 is a flow chart of an operation and maintenance audit method provided in an embodiment of the present application. The execution subject of the method is a server in an access audit system. The method specifically includes the following steps:

[0061] S201: Receive request information sent by a virtual network proxy module.

[0062] Optionally, the virtual network proxy module is also known as the VNC proxy module. The user accesses the operation and maintenance audit system running on the terminal device through a browser, and accesses the VNC proxy module through the VNC operation and maintenance method on the front-end page provided by the operation and maintenance audit system, carrying an identification token. The identification token is a unique string generated by the operation and maintenance audit system and stored in the operation and maintenance audit system, and the identification token corresponds to the connection information of the database to be accessed. Furthermore, the VNC proxy module will send the identification token to the authentication module for authentication, and after the authentication module passes the authentication, the connection information of the database to be accessed corresponding to the identification token will be sent to the VNC proxy module. The VNC proxy module then sends a request message to the Postman service in the Linux application publishing server. The request message includes the connection information of the database to be accessed, such as the database server network address (Internet Protocol Address, IP address), port, account number and password.

[0063] S202 : In response to the request information, start the target virtual network computing service at the target location of the server to establish a virtual desktop corresponding to the virtual network proxy module, and start the database operation application.

[0064] Optionally, the Postman service in the Linux application publishing server receives the request information sent by the virtual network proxy module and, in response to the request information, starts a target virtual network computing service (target Xvnc service) at a target location on the Linux application publishing server to establish a virtual desktop for the current user's session through the virtual network proxy module (VNC proxy module). The target location refers to the location of the target Xvnc service on the server, which is indicated by the environment variable DISP LAY. Thus, by starting the target Xvnc service at the target location, different virtual desktops can be established for different user sessions, ensuring that user sessions do not affect each other.

[0065] Optionally, when the postman service starts the target Xvnc service, it will also start a database operation application. In order to enable the database operation application to read the connection information of the database to be accessed uploaded by the VNC proxy module after it is started and run to achieve the purpose of filling in the database information, the postman service will set the session directory variable HOME in the started database operation application to the session target for storing the connection information of the database to be accessed, and set the display variable DISPLAY of the database operation application to the virtual desktop corresponding to the target Xvnc service.

[0066] S203: Establish a communication connection with the virtual network proxy module through the target virtual network computing service, and display the virtual desktop on the terminal device through the virtual network proxy module.

[0067] Optionally, after the postman service starts the target virtual network computing service (target Xvnc service), it will assign a random string as a password to the target Xvnc service, and generate a service connection information based on the port and other information, and send the service connection information to the virtual network proxy module (VNC proxy module). The VNC proxy module receives the service connection information and sends a connection request to the target Xvnc service through the VNC protocol to establish a session connection between the target virtual network computing service and the virtual network proxy module, and display the virtual desktop on the terminal device through the VNC proxy module.

[0068] S204 , when the database operation application is running, the database is loaded on the virtual desktop through the database connection information, and the database is accessed according to the user's operation on the database.

[0069] Optionally, since the postman service will create a session directory and store the connection information of the database to be accessed in the session directory, and after starting the database operation application, the postman service sets the session directory variable HOME in the database operation application to the session target for storing the connection information of the database to be accessed, and sets the display variable DISPLAY of the database operation application to the virtual desktop corresponding to the target Xvnc service, the database operation application can directly read the session directory when it is running, parse the session directory to obtain the connection information of the database to be accessed, and load the database on the virtual desktop according to the database connection information, so that the user can operate on the database to access the database.

[0070] Based on this, according to the operation and maintenance audit method provided by the embodiment of the present application, after receiving the request information sent by the virtual network agent module deployed on the terminal device, the server automatically starts the target virtual network computing service at the target location and establishes a virtual desktop corresponding to the virtual network agent module. This process does not require the user to manually enter the connection information. The proxy filling function can be automatically completed through the communication connection between the virtual network agent module and the target virtual network computing service. Furthermore, when the database operation application is started in the virtual desktop, the database is directly loaded by reading the connection information, thereby realizing the automatic connection of the user's remote access to the database operation application. On this basis, the database operation application can record the user's operation data of accessing the database in real time. The target virtual network computing service reads the operation data and returns the operation data to the terminal device, so that the terminal device can monitor and audit the user's operation data. This not only provides a proxy filling service in the Linux operation and maintenance environment, but also solves the problem of the lack of proxy filling service in the Linux operation and maintenance environment in the prior art. In addition, by establishing a user access channel, the user operation data is stored on the terminal device in a timely manner, which facilitates comprehensive monitoring and auditing of the user operation data.

[0071] As a possible implementation manner, starting a target virtual network computing service at a target location of a server includes: starting the target virtual network computing service at the target location, and allocating service connection information for the target virtual network computing service.

[0072] Optionally, the service connection information includes: a port and a password. The postman service starts the target virtual network computing service (target Xvnc service) through a command line or an automated script to generate an independent virtual desktop. At this time, the target Xvnc service will listen to a specific port and wait for the terminal device, which is a client, to connect. The postman service will assign a random password, such as a random string, to the started target Xvnc service, and generate service connection information based on the port number of the specific port being listened to and the random string, such as integrating the port number and the random string into a connection string, and sending the connection string as service connection information to the VNC proxy module.

[0073] Optionally, the VNC proxy module receives the service connection information sent by the postman service, uses the VNC protocol to initiate a connection request to the target Xvnc service, verifies the password and establishes a session, thereby establishing a session connection between the VNC proxy module and the target Xvnc service. The database operation application (i.e., the database connection tool Navicat) can be accessed through the VNC proxy module on the terminal device client to run the virtual desktop provided by the target Xvnc service.

[0074] Based on this, the postman service starts the target Xvnc service at the target location and generates a random password and port combination to form service connection information. Based on the service connection information, a session connection is established between the VNC proxy module and the target Xvnc service, providing the user with an access channel to achieve remote access.

[0075] Figure 3 The flowchart of a method for starting a database operation application program provided by an embodiment of the present application is shown. Figure 3 As shown, the above steps start the database operation application, which specifically includes the following steps:

[0076] S301: Establish a session directory corresponding to the virtual network proxy module, create a target file in the session directory, and store database connection information in the target file.

[0077] For example, for different user session requests, the postman service will start a new Xvnc service and create a session directory, and create a target file in the session directory, which can be recorded as a connections.json file, and then store the connection information of the database to be accessed by the user in the connections.json file.

[0078] It should be noted that the purpose of establishing a session directory and setting the connections.json file is to create a connection by filling in the database account, port, account, password and other connection information.

[0079] S302: Start a database operation application, set a session directory variable in the environment variable of the database operation application to the session directory, and set a display variable of the database operation application to the virtual desktop.

[0080] Exemplarily, the postman service starts a database operation application, and in order to enable the database operation application to read the connection information of the database to be accessed uploaded by the VNC proxy module after it is started and run to achieve the purpose of filling in the database information, the postman service will set the session directory variable HOME in the started database operation application to the session target for storing the connection information of the database to be accessed, and set the display variable DISPLAY of the database operation application to the virtual desktop corresponding to the target Xvnc service.

[0081] It should be noted that the Postman service starts the database operation application and sets the session directory variable HOME and display variable DISPLAY of the database operation application, which ensures that the database operation application can parse the data in the session directory when it starts to fill in the database information.

[0082] Based on this, the Postman service starts the database operation application and sets the environment variables of the database operation application, providing a solution for filling in data in the Linux application publishing server, solving the problem of the lack of a filling solution in the Linux application publishing server.

[0083] As a possible implementation, before establishing a communication connection between the target virtual network computing service and the virtual network proxy module, the method further includes: sending service connection information of the target virtual network computing service to the virtual network proxy module.

[0084] Exemplarily, before the target virtual network computing service establishes a communication connection with the virtual network proxy module, it is necessary to send the service connection information generated by the postman service for the target virtual network computing service (target Xvnc service) to the virtual network proxy module (VNC proxy module), so that after receiving the service connection information, the VNC proxy module sends a connection request to the target Xvnc service through the VNC protocol, thereby establishing a communication connection between the target virtual network computing service and the virtual network proxy module.

[0085] Furthermore, establishing a communication connection with the virtual network proxy module through the target virtual network computing service includes: the target virtual network computing service receives a connection request sent by the virtual network proxy module, the connection request including service connection information; and establishing a communication connection with the virtual network proxy module according to the connection request.

[0086] For example, after receiving the service connection information, the virtual network proxy module (VNC proxy module) generates a connection request containing the service connection information and sends the connection request to the target virtual network computing service (target Xvnc service) via the VNC protocol. The target Xvnc service responds to the connection request and establishes a communication connection with the VNC proxy module. In this way, the VNC proxy module connects to the target Xvnc service on the Linux application publishing server.

[0087] Based on this, the VNC proxy module of the client establishes a session connection with the target Xvnc service in the Linux application publishing server, providing an access channel for the user to remotely access the application on the Linux application publishing server.

[0088] As a possible implementation, when the database operation application in step S204 is running, the database is loaded on the virtual desktop through the database connection information, and the database is accessed according to the user's operation on the database, including:

[0089] When the database operation application is running, it reads the database connection information from the target file in the session directory, reads the database data through the database connection information, displays the database data on the virtual desktop, obtains the user's operation data on the virtual desktop, and accesses the database based on the operation data.

[0090] For example, since the session directory variable HOME in the launched database operation application Navicat has been set as the session target for storing the connection information of the database to be accessed, when the database operation application Navicat is run, it can directly read the stored database connection information from the connections.json file in the created session directory, read the database data based on the database connection information, and then display the database data on the virtual desktop. Furthermore, the user can perform corresponding operations on the virtual desktop, and the database operation application Navicat obtains the user's operation data on the virtual desktop and accesses the database based on the operation data.

[0091] Based on this, the database operation application Navicat reads and parses the database connection information stored in the connections.json file in the session directory, displays the database on the virtual desktop, and accesses the database, thereby achieving remote access to the application on the Linux application publishing server.

[0092] As a possible implementation manner, the method further includes: creating a log file in the session directory, and storing the user's operation data on the virtual desktop in the log file.

[0093] For example, after starting a database operation application on a virtual desktop, the operation interface of the database connection tool Navicat will be displayed on the virtual desktop, and the database connection information will be displayed in the menu bar of the operation interface. The user performs corresponding operations and accesses the database according to the database connection information. Some user operations will be generated in this process. In order to facilitate subsequent auditing of user operations, the postman service creates a session directory. In addition to creating a connections.json file in the session directory to store the database connection information, a log file will also be created in the session directory. The log file can be recorded as QueryExec.log, and the user operation data will be stored in the QueryExec.log file.

[0094] Further, refer to Figure 4 As shown, after the user's operation data on the virtual desktop is stored in the log file, each line of operation data record in the log file is read, and for the character string in each line of operation data record, it is determined whether the character string is a database programming statement. If so, the character string is parsed to obtain the user operation instruction, and the user operation instruction is sent to the terminal device so that the terminal device can audit the user operation instruction.

[0095] For example, after displaying database data on a virtual desktop, users can perform operations such as querying, modifying, and deleting the database data, thereby generating some user operation data. The Postman service obtains this user operation data and stores it in the QueryExec.log log file. Because the user operation data stored in the QueryExec.log log file includes the user operation time and specific SQL operation instructions, the Postman service reads the user operation data recorded in the QueryExec.log log file and determines, for each line of operation data record read, whether each line of operation data record is a specific SQL operation instruction.

[0096] Specifically, for the character string in each row of operation data record, determine whether the character string is a database programming statement, that is, an SQL statement. If so, perform SQL semantic and grammatical analysis on the character string through database monitoring tools and SQL parsing tools (such as druid tools) to obtain user operation instructions, and send the user operation instructions to the terminal device and upload them to the audit module so that the audit module can audit the user operation instructions.

[0097] Based on this, the SQL operation instructions executed by the user's database connection tool Navicat can be recorded and transmitted to the operation and maintenance audit system through the log file QueryExec.log to ensure the security of the operation and maintenance audit system and the traceability of operations.

[0098] Figure 5 The following is a flow chart of another operation and maintenance audit method provided by an embodiment of the present application. Figure 5 As shown, the method is applied to a terminal device in an access audit system, and specifically includes the following steps:

[0099] S501. The virtual network proxy module obtains user access information and sends the user access information to the authentication module.

[0100] For example, since a user accesses a virtual network proxy module (VNC proxy module) through VNC operation and maintenance with an identification token, the VNC proxy module can obtain the identification token, which is user access information, and send it to the authentication module for authentication, thereby authenticating the user's access. The user access information includes an access string, also known as the identification token. The identification token is used to indicate the connection information of the database to be accessed. It is typically generated and stored by the operation and maintenance audit system. The identification token can be used to find the corresponding database's IP address, port number, account number, password, and other connection information.

[0101] S502: The authentication module performs authentication processing on the user access information, and sends the connection information of the database to be accessed to the virtual network agent module after the authentication is passed.

[0102] Optionally, performing authentication processing on the user access information includes: determining whether the access character string is issued by the operation and maintenance audit system running on the terminal device, and if so, determining that the authentication is passed.

[0103] For example, the authentication module authenticates the user's access information, i.e., determines whether the identification token is issued by the operation and maintenance audit system. This also authenticates the user's identity to ensure access security. If the identification token is determined to be issued by the operation and maintenance audit system, the authentication is deemed to be successful. After successful authentication, the authentication module transmits the connection information of the database to be accessed corresponding to the identification token to the virtual network proxy module (VNC proxy module).

[0104] Based on this, since the identification token is bound to the user identity, by using the identification token to authenticate VNC access in the operation and maintenance audit system, user access is authenticated, which improves user access security and avoids some potential security risks.

[0105] Figure 6 The following is an interactive diagram of an application access and audit method based on a Linux application publishing server provided in an embodiment of the present application. Figure 6As shown, the user accesses the operation and maintenance audit system running on the terminal device through a browser, and accesses the VNC proxy module with an identification token through the VNC operation and maintenance method on the front-end page provided by the operation and maintenance audit system. The VNC proxy module sends the user access information including the identification token to the authentication module for authentication processing. After the authentication is passed, the authentication module sends the connection information of the database to be accessed corresponding to the identification token to the VNC proxy module. The VNC proxy module then sends the connection information of the database to be accessed to the postman service in the Linux application publishing server. The postman service starts the target virtual network computing service (target Xvnc service) at the target location of the Linux application publishing server to establish a virtual desktop for a conversation with the current user through the virtual network proxy module (VNC proxy module), and starts and runs the database operation application, and assigns a random string as a password to the target Xvnc service, and generates a service connection information based on the port and other information, and sends the service connection information to the VNC proxy module to establish a communication connection between the VNC proxy module and the target Xvnc service.

[0106] Furthermore, when Navicat is running, it can directly read the session directory and parse the session directory to obtain the connection information of the database to be accessed. The database can then be loaded on the virtual desktop based on the database connection information, and the user can then perform operations on the database to access the database. In addition, after the database data is displayed on the virtual desktop, the user can query, modify, delete, and other operations on the database data, thereby generating some user operation data. The Postman service obtains user operation data and stores the user operation data in a log file. For each line of operation data record stored in the log file, it determines whether each line of operation data record is a specific SQL operation instruction, parses the user operation instruction, and uploads the user operation instruction to the audit module so that the audit module can audit the user operation instruction.

[0107] Based on this, this application establishes an access channel for users through the Xvnc service and records VNC protocol data on the operation and maintenance audit system through the VNC proxy, so that user operations can be replayed and monitored by parsing the VNC protocol data. In this way, the application provides a Linux application publishing server-based application access and auditing method, which can achieve comprehensive monitoring of user operations on Navicat and audit user operation instructions.

[0108] The present application embodiment also provides a terminal device 700, such as Figure 7As shown, a schematic diagram of the structure of a terminal device 700 provided in an embodiment of the present application includes: a processor 701, a memory 702, and optionally, a bus 703. The memory 702 stores machine-readable instructions executable by the processor 701. When the terminal device 700 is running, the processor 701 communicates with the memory 702 via the bus 703. When the machine-readable instructions are executed by the processor 701, the steps of the operation and maintenance audit method described in any of the above items are performed.

[0109] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in any one of the operation and maintenance audit methods are executed.

[0110] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0111] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] The above is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the protection scope of the present application.

Claims

1. An operation and maintenance audit method, characterized in that: The method is applied to a server in an access audit system, wherein the access audit system includes the server and a terminal device, and a virtual network agent module is deployed on the terminal device; the method includes: receiving a request message sent by the virtual network proxy module, wherein the request message includes connection information of a database to be accessed; In response to the request information, starting a target virtual network computing service at a target location of the server to establish a virtual desktop corresponding to the virtual network agent module, and starting a database operation application; Establishing a communication connection with the virtual network proxy module through a target virtual network computing service, and displaying the virtual desktop on the terminal device through the virtual network proxy module; When the database operation application is running, the database is loaded on the virtual desktop through the connection information of the database, and the database is accessed according to the user's operation on the database.

2. The method according to claim 1, characterized in that The starting of the target virtual network computing service at the target location of the server includes: The target virtual network computing service is started at the target location, and service connection information is allocated to the target virtual network computing service, where the service connection information includes a port and a password.

3. The method according to claim 1, characterized in that The starting of the database operation application comprises: Establishing a session directory corresponding to the virtual network proxy module, creating a target file in the session directory, and storing the connection information of the database in the target file; The database operation application is started, and a session directory variable in the environment variable of the database operation application is set to the session directory, and a display variable of the database operation application is set to the virtual desktop.

4. The method according to claim 2, characterized in that Before establishing a communication connection with the virtual network agent module through the target virtual network computing service, the method further includes: Sending service connection information of the target virtual network computing service to the virtual network agent module; The establishing of a communication connection with the virtual network proxy module through the target virtual network computing service includes: The target virtual network computing service receives a connection request sent by the virtual network agent module, wherein the connection request includes the service connection information; According to the connection request, a communication connection is established with the virtual network proxy module.

5. The method according to claim 3, characterized in that When the database operation application is running, the database is loaded on the virtual desktop through the connection information of the database, and the database is accessed according to the user's operation on the database, including: When the database operation application is running, the connection information of the database is read from the target file in the session directory; Reading the data of the database through the connection information of the database, and displaying the data of the database on the virtual desktop; The user's operation data on the virtual desktop is obtained, and the database is accessed according to the operation data.

6. The method according to claim 3, characterized in that The method further comprises: Create a log file in the session directory. The user's operation data on the virtual desktop is stored in the log file.

7. The method according to claim 6, characterized in that After storing the user's operation data on the virtual desktop in the log file, the method further includes: Read each line of operation data record in the log file; For the character string in each row of operation data record, determine whether the character string is a database programming statement. If so, perform grammatical parsing on the character string to obtain user operation instructions, and send the user operation instructions to the terminal device so that the terminal device can audit the user operation instructions.

8. An operation and maintenance audit method, characterized in that: Applied to a terminal device, the terminal device is deployed with a virtual network proxy module and an authentication module; the method includes: The virtual network proxy module obtains user access information and sends the user access information to the authentication module, wherein the user access information includes an access string, and the access string is used to indicate connection information of a database to be accessed; The authentication module performs authentication processing on the user access information, and sends the connection information of the database to be accessed to the virtual network agent module after the authentication is passed.

9. The method according to claim 8, characterized in that The authentication module performs authentication processing on the user access information, including: Determining whether the access string is issued by the operation and maintenance audit system running on the terminal device; If so, it is determined that the authentication is successful.

10. An access audit system, characterized in that: The access audit system includes a server and a terminal device; The server is used to perform the steps of the operation and maintenance audit method according to any one of claims 1 to 7; The terminal device is used to execute the steps in the operation and maintenance audit method described in any one of claims 8-9.

Images