Server login management method and related equipment

Abstract

The embodiment of the invention relates to a server login management method and related equipment. The method comprises the following steps: sending a transfer machine login certificate to a user after receiving a result that a server login application of the user passes approval; creating an account number and a login certificate of the server according to the identity of the user and the server login application, and configuring the authority of the server; associating the user, the account of the server and the server through an authorization rule, and returning an accessible server set to the user; the account number and the login certificate of the server are stored in the transfer machine; and after a user logs in the transfer machine to initiate a target server connection request, monitoring a session between the user and the target server, and if an alarm triggering operation is detected, sending an alarm notification, and / or intervening the session. The server authority is automatically distributed, and the authority management efficiency is improved; and if an alarm triggering operation (such as a high-risk operation) is detected, an alarm notification is sent out and / or a session is intervened, so that the safety audit capability is improved.

Description

Technical Field

[0001] This invention relates to the field of information technology, specifically to a server login management method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] In the current IT infrastructure architecture of internet companies, server access management commonly adopts an authentication mechanism based on SSH keys, and its permission allocation and access control are usually configured and managed by the operations and maintenance department. However, the traditional method can only complete basic operations such as account creation and key distribution. Complete server access security management also needs to solve problems such as dynamic permission control, operation auditing, and real-time risk interception.

[0003] However, currently, enterprises mainly use the following two methods for server login management:

[0004] Direct external network access mode: Create user accounts directly on the server and configure SSH keys to allow users to connect to the server directly via public IP address;

[0005] Jump server relay mode: Users first log in to a jump server with external network access, and then use the jump server as a jump host to connect to the internal network server.

[0006] However, the two traditional solutions mentioned above have the following key shortcomings:

[0007] 1. Inefficient access control

[0008] The permission activation process is cumbersome: new employee onboarding or temporary permission application requires maintenance personnel to manually log in to each server for configuration. When the number of servers reaches hundreds, the configuration work is time-consuming and labor-intensive.

[0009] Untimely revoke of permissions: After an employee leaves or changes positions, permission cleanup relies on manual operation, which is prone to omissions, especially in a distributed microservice architecture where permissions may be scattered across hundreds of servers.

[0010] Lack of granular permission control: Users are usually granted root or sudo privileges directly, which cannot achieve fine-grained command-level control (such as allowing viewing of logs but prohibiting modification of configuration).

[0011] 2. Weak security audit capabilities

[0012] Incomplete operation logs: Traditional solutions only record login / logout logs. The actual commands executed by the user depend on the server's command history (bash_history), which may be tampered with or overwritten by the user.

[0013] Lack of real-time monitoring: It is unable to monitor the user's actions in the current session in real time and to detect high-risk commands (such as rm -rf). Summary of the Invention

[0014] To solve or partially solve the above-mentioned technical problems, the present invention provides a server login management method and related equipment, which adopts the method of automatically creating server accounts and login credentials, and configuring server permissions to improve the efficiency of permission management; it adopts session management to monitor the session between the user and the target server, and if an operation that triggers an alarm (such as a high-risk operation) is detected, an alarm notification is issued and / or the session is intervened to improve security auditing capabilities.

[0015] In a first aspect, embodiments of the present invention provide a server login management method. The method includes:

[0016] After receiving the approval result of the user's server login application, a relay login credential is sent to the user;

[0017] Create a server account, login credentials, and configure server permissions based on the user's identity and server login request;

[0018] The system associates user and server accounts and servers through authorization rules, and returns a set of accessible servers to the user; the server accounts and login credentials are stored in a relay machine.

[0019] After a user initiates a connection request to the target server during login, the system monitors the user's session with the target server. If an operation that triggers an alarm is detected, an alarm notification is issued, and / or the session is intervened.

[0020] In one embodiment, the method further includes:

[0021] Obtain the user's latest identity information;

[0022] Adjust the configured server permissions based on changes in user identity.

[0023] In one embodiment, the method further includes:

[0024] If the user's latest identity information shows an employment status of "left job," then the authorization rules related to the user will be deleted, and the user's account on the corresponding server will be cancelled.

[0025] In one implementation, the step of creating a server account, login credentials, and configuring server permissions based on the user's identity and server login request includes:

[0026] Based on the user's server login request, determine the set of servers the user requested to log in to, and create accounts and login credentials for each server in the server set;

[0027] Configure permissions for each server based on the user's identity.

[0028] Secondly, embodiments of the present invention provide a server login management device. The device includes:

[0029] The relay login credential sending module is used to send a relay login credential to the user after receiving the result of the user's server login application approval.

[0030] The server permission distribution module is used to create server accounts, login credentials, and configure server permissions based on user identity and server login requests.

[0031] The authorization rules module is used to associate user and server accounts and servers through authorization rules, and return the set of servers that the user can access; the server accounts and login credentials are stored in the relay machine;

[0032] The monitoring module is used to monitor the user's session with the target server after the user initiates a connection request to the target server during the login process. If an operation that triggers an alarm is detected, an alarm notification is issued, and / or the session is intervened.

[0033] In one embodiment, the device further includes:

[0034] The user information update module is used to obtain the user's latest identity information;

[0035] The permission adjustment module is used to adjust the configured server permissions based on changes in user identity.

[0036] In one embodiment, the device further includes:

[0037] The server permission revocation module is used to delete the authorization rules related to the user and cancel the user's corresponding server account if the user's latest identity information shows that the employment status is "left the company".

[0038] In one implementation, the server permission distribution module includes:

[0039] The account creation submodule is used to determine the set of servers that the user has requested to log in to based on the user's server login request, and to create accounts and login credentials for each server in the server set;

[0040] The permission configuration submodule is used to configure permissions for each server based on the user's identity.

[0041] Thirdly, the present invention provides an electronic device, the electronic device comprising:

[0042] At least one processor; and

[0043] A memory communicatively connected to the at least one processor; wherein,

[0044] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the server login management method described above.

[0045] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions that are used to cause a processor to execute the above-described server login management method.

[0046] In this embodiment of the invention, after receiving the approval result of a user's server login application, a relay machine login credential is sent to the user; a server account and login credential are created based on the user's identity and server login application, and server permissions are configured; the user, server account, and server are associated through authorization rules, and a set of accessible servers is returned to the user; the server account and login credential are stored in the relay machine; after the user initiates a connection request to the target server after logging into the relay machine, the session between the user and the target server is monitored; if an operation triggering an alarm is detected, an alarm notification is issued, and / or the session is intervened. This achieves automated distribution of server permissions, improving the efficiency of permission management; if an operation triggering an alarm (such as a high-risk operation) is detected, an alarm notification is issued and / or the session is intervened, thereby improving security auditing capabilities. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart of a server login management method provided in Embodiment 1 of the present invention;

[0049] Figure 2 This is a schematic diagram of the structure of a server login management device provided in Embodiment 2 of the present invention;

[0050] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0051] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0052] Figure 1 This is a flowchart of a server login management method provided in Embodiment 1 of the present invention. This embodiment can be applied to a server login management device, such as... Figure 1 As shown, this embodiment may include the following steps:

[0053] Step 101: After receiving the result of the user's server login application being approved, send the relay login credential to the user.

[0054] Users can submit server login requests on the permission approval platform. Once the request is approved, the platform automatically sends the approval result to the server login management device. If the request is rejected, there is no need to send the result to the management device.

[0055] After receiving the approval result of the user's server login application, the system can display the relay login credential to the user through the display interface of the server login management device, or send the relay login credential to the user via email, SMS or other means.

[0056] The relay login credential can be an SSH key pair (such as an SSH public key and a private key), or a combination of a static password and a dynamic password, etc. This embodiment does not limit the specific type of the relay login credential.

[0057] Step 102: Create a server account, login credentials, and configure server permissions based on the user's identity and server login request.

[0058] In this step, the user's identity information can be retrieved from the enterprise employee management system in real time or periodically. The user's identity information may include one or more of the following: the user's name (or ID), email address, job title, employment status, and projects participated in.

[0059] The server login management device can connect to the enterprise asset management system to synchronize all server information of the enterprise from the enterprise asset management system and obtain a list of server assets. The list may include hostname, serial number, IP address of SSH connection, port, internal and external network, tag, host type, and information such as the IDC data center where it is located.

[0060] The server login request can record the server the user requested to log in to. Based on the user's server login request, the set of servers the user requested to log in to can be determined. This server set can be one or more servers from all the enterprise's servers. After determining the set of servers the user requested to log in to, accounts and login credentials for each server in the server set are created, and permissions for each server are configured according to the user's identity. For example, if the user is a regular employee, they are a regular server user and are only authorized to execute basic viewing commands (such as `top`, `cat`, etc.) using `sudo`. Alternatively, if the user is a manager-level employee, they are a server administrator user and are authorized to switch to root status using `sudo su`, thereby gaining the highest system access privileges. It should be understood that the permissions for each server can be further refined based on the project the user participates in. For example, if the user is a regular employee and also serves as the project leader for a certain project, their permissions can be further increased or elevated beyond simply being authorized to execute basic viewing commands (such as `top`, `cat`, etc.) using `sudo`.

[0061] Step 103: Associate the user, server account, and server through authorization rules, and return the set of servers that the user can access; the server account and login credentials are stored in the relay machine.

[0062] In this step, using authorization rules to associate users (such as user accounts), server accounts, and server IPs or tags can avoid security risks caused by conflicting permissions and improve the efficiency and compliance of permission management. After associating users, server accounts, and servers through authorization rules, the set of servers that the user can access is returned.

[0063] The server's account and login credentials are stored in the relay machine. When a user accesses the server through the relay machine, there is no need to manually enter the server account and login credentials (such as password and key). The relay machine can automatically call the stored login credentials to complete the authentication, reducing the cost of repeated input.

[0064] Step 104: After the user initiates a connection request to the target server during the login relay, monitor the session between the user and the target server. If an operation that triggers an alarm is detected, issue an alarm notification and / or intervene in the session.

[0065] In this step, after the user logs into the target server through the relay, the session between the user and the target server is monitored. For example, the user's operation commands on the server are monitored. If an operation that triggers an alarm is detected, such as when a regular employee executes a high-risk command (such as rm -rf), an alarm notification is sent to the user and / or the administrator, and the session can be directly intervened, such as terminating the connection.

[0066] In one embodiment, the server login management method may further include:

[0067] Step 105: Obtain the user's latest identity information.

[0068] Step 106: Adjust the configured server permissions according to the changes in user identity.

[0069] For example, a scheduled task (such as 2 AM every day) can be used to retrieve user identity information from the enterprise employee management system. If a user's identity changes, such as a change in job title, the configured server permissions can be adjusted accordingly.

[0070] In one embodiment, the server login management method may further include:

[0071] Step 107: If the user's latest identity information shows an employment status of "left job", then delete the authorization rules related to the user and cancel the user's account on the corresponding server.

[0072] In this step, for departing employees, server permissions are revoked by deleting the authorization rules related to the user and canceling the user's corresponding server account.

[0073] In this embodiment of the invention, after receiving the approval result of a user's server login application, a relay machine login credential is sent to the user; a server account and login credential are created based on the user's identity and server login application, and server permissions are configured; the user, server account, and server are associated through authorization rules, and a set of accessible servers is returned to the user; the server account and login credential are stored in the relay machine; after the user initiates a connection request to the target server after logging into the relay machine, the session between the user and the target server is monitored; if an operation triggering an alarm is detected, an alarm notification is issued, and / or the session is intervened. This achieves automated distribution of server permissions, improving the efficiency of permission management; if an operation triggering an alarm (such as a high-risk operation) is detected, an alarm notification is issued and / or the session is intervened, thereby improving security auditing capabilities.

[0074] Corresponding to the server login management method in this invention, this invention also provides a server login management device. Figure 2 This is a schematic diagram of the structure of a server login management device. Figure 2 As shown, the server login management device includes:

[0075] The relay login credential sending module 201 is used to send a relay login credential to the user after receiving the result of the user's server login application approval.

[0076] The server permission distribution module 202 is used to create server accounts, login credentials, and configure server permissions based on the user's identity and server login request.

[0077] The authorization rules module 203 is used to associate user and server accounts and servers through authorization rules, and return the set of servers that can be accessed to the user; the server accounts and login credentials are stored in the relay machine;

[0078] The monitoring module 204 is used to monitor the session between the user and the target server after the user initiates a connection request to the target server during the login process. If an operation that triggers an alarm is detected, an alarm notification is issued and / or the session is intervened.

[0079] In one embodiment, the device further includes:

[0080] The user information update module is used to obtain the user's latest identity information;

[0081] The permission adjustment module is used to adjust the configured server permissions based on changes in user identity.

[0082] In one embodiment, the device further includes:

[0083] The server permission revocation module is used to delete the authorization rules related to the user and cancel the user's corresponding server account if the user's latest identity information shows that the employment status is "left the company".

[0084] In one embodiment, the server permission distribution module 202 includes:

[0085] The account creation submodule is used to determine the set of servers that the user has requested to log in to based on the user's server login request, and to create accounts and login credentials for each server in the server set;

[0086] The permission configuration submodule is used to configure permissions for each server based on the user's identity.

[0087] The server login management device provided in this embodiment of the invention can execute a server login management method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0088] Figure 3A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0089] like Figure 3 As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory (ROM) 32 or a random access memory (RAM) 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the ROM 32 or loaded from storage unit 38 into the RAM 33. The RAM 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0090] Multiple components in electronic device 30 are connected to I / O interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0091] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as server login management methods.

[0092] In some embodiments, the server login management method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 30 via ROM 32 and / or communication unit 39. When the computer program is loaded into RAM 33 and executed by processor 31, one or more steps of the server login management method described above may be performed. Alternatively, in other embodiments, processor 31 may be configured to execute the server login management method by any other suitable means (e.g., by means of firmware).

[0093] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0095] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0096] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0097] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0098] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0099] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0100] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A server login management method, characterized in that, The method includes: After receiving the approval result of the user's server login application, a relay login credential is sent to the user; Create a server account, login credentials, and configure server permissions based on the user's identity and server login request; The system associates user and server accounts and servers through authorization rules, and returns a set of accessible servers to the user; the server accounts and login credentials are stored in a relay machine. After a user initiates a connection request to the target server during login, the system monitors the user's session with the target server. If an operation that triggers an alarm is detected, an alarm notification is issued, and / or the session is intervened.

2. The method according to claim 1, characterized in that, Also includes: Obtain the user's latest identity information; Adjust the configured server permissions based on changes in user identity.

3. The method according to claim 2, characterized in that, Also includes: If the user's latest identity information shows an employment status of "left job," then the authorization rules related to the user will be deleted, and the user's account on the corresponding server will be cancelled.

4. The method according to claim 1, characterized in that, The process of creating a server account and login credentials based on the user's identity and server login request, and configuring server permissions, includes: Based on the user's server login request, determine the set of servers the user requested to log in to, and create accounts and login credentials for each server in the server set; Configure permissions for each server based on the user's identity.

5. A server login management device, characterized in that, The device includes: The relay login credential sending module is used to send a relay login credential to the user after receiving the result of the user's server login application approval. The server permission distribution module is used to create server accounts, login credentials, and configure server permissions based on user identity and server login requests. The authorization rules module is used to associate user and server accounts and servers through authorization rules, and return the set of servers that the user can access; the server accounts and login credentials are stored in the relay machine; The monitoring module is used to monitor the user's session with the target server after the user initiates a connection request to the target server during the login process. If an operation that triggers an alarm is detected, an alarm notification is issued, and / or the session is intervened.

6. The apparatus according to claim 5, characterized in that, Also includes: The user information update module is used to obtain the user's latest identity information; The permission adjustment module is used to adjust the configured server permissions based on changes in user identity.

7. The apparatus according to claim 6, characterized in that, Also includes: The server permission revocation module is used to delete the authorization rules related to the user and cancel the user's corresponding server account if the user's latest identity information shows that the employment status is "left the company".

8. The apparatus according to claim 5, characterized in that, The server permission distribution module includes: The account creation submodule is used to determine the set of servers that the user has requested to log in to based on the user's server login request, and to create accounts and login credentials for each server in the server set; The permission configuration submodule is used to configure permissions for each server based on the user's identity.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the server login management method according to any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the server login management method according to any one of claims 1-5.

Images