Remote login control method, device and equipment, and storage medium

Abstract

The application relates to the technical field of SSH remote login, and discloses a remote login control method, device and equipment and a storage medium, the method comprising the following steps: after determining that a remote login connection with a bastion host is successfully established, receiving an environment variable sent by the bastion host; establishing a remote login connection with a remote host, and sending the environment variable to the remote host, so that the remote host performs login authentication based on the environment variable, obtains a login link source and feeds back; and performing remote login control on the remote host based on the login link source fed back by the remote host. According to the application, the bastion host is introduced to control the remote login of the host and to deliver the environment variable to the control host, the control host sends the environment variable to the remote host for login authentication, and whether the login link source is the bastion host is identified to respond to or intercept the remote login of the remote host, so that the security of the SSH remote login can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of SSH remote login technology, and in particular to remote login control methods, devices, equipment and storage media. Background Technology

[0002] The goal of intranet security is to minimize the risk that attackers, after gaining access to the company's intranet from the external network, can use the compromised intranet host to further intrude into other intranet hosts.

[0003] In practice, it often happens that an attacker gains access to an internal network host and obtains the usernames and passwords of users on that host through phishing or other means. This allows the attacker to log in to other authorized hosts via SSH and further expand the scope of the attack.

[0004] Because attackers use compromised internal network hosts to intrude into other hosts, this intrusion behavior is difficult to detect, which can easily lead to more internal network hosts being attacked, thus compromising the security of SSH login.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a remote login control method, device, equipment and storage medium, which aims to solve the technical problem that attackers use compromised internal network hosts to remotely log in via SSH to intrude into other hosts, thus compromising the security of SSH login.

[0007] To achieve the above objectives, this application proposes a remote login control method, the method comprising:

[0008] After confirming a successful remote login connection with the bastion host, receive environment variables sent by the bastion host;

[0009] Establish a remote login connection with the remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source and provide feedback;

[0010] Remote login control is performed on the remote host based on the login link source fed back by the remote host.

[0011] In one embodiment, the remote login control of the remote host based on the login link source fed back by the remote host includes:

[0012] If the login link source reported by the remote host is the bastion host, a control command is sent to the remote host so that the remote host performs corresponding operations based on the control command;

[0013] If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result, and perform remote login control on the remote host based on the whitelist verification result.

[0014] In one embodiment, when the login link source reported by the remote host is the bastion host, sending control commands to the remote host includes:

[0015] If the login link source reported by the remote host is the bastion host, then receive the remote control information sent by the bastion host;

[0016] The operation object and operation content are determined based on the remote control information;

[0017] Control commands are generated based on the operation object and operation content, and then sent to the remote host.

[0018] In one embodiment, generating control instructions based on the operation object and operation content, and sending the control instructions to the remote host, includes:

[0019] Obtain operating system information from a remote host;

[0020] The corresponding control instruction format is determined based on the operating system information;

[0021] The operation object and the operation content are encoded based on the control instruction format to generate control instructions adapted to the remote host.

[0022] Send the control command to the remote host.

[0023] In one embodiment, sending the control command to the remote host includes:

[0024] Obtain the encryption key and initialization vector;

[0025] The control command is encrypted using the encryption key to obtain encrypted ciphertext.

[0026] The encrypted ciphertext and the initialization vector are merged and encoded to obtain the encrypted control command;

[0027] Send the encrypted control command to the remote host.

[0028] In one embodiment, when the login link source reported by the remote host is not the bastion host, obtaining the whitelist verification result and performing remote login control on the remote host based on the whitelist verification result includes:

[0029] If the login link source reported by the remote host is not the bastion host, the login link source is verified by a whitelist to obtain the whitelist verification result.

[0030] Remote login control is performed on the remote host based on the whitelist verification results.

[0031] In one embodiment, the step of performing whitelist verification on the login link source to obtain the whitelist verification result includes:

[0032] Obtain the first identifier information of the login link source, the second identifier information of the remote host, and the third identifier information of the user;

[0033] The whitelist verification is performed based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result.

[0034] In one embodiment, the step of performing whitelist verification based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result includes:

[0035] A preset whitelist is queried based on the first identifier information, the second identifier information, and the third identifier information. The preset whitelist includes multiple combinations of identifier information.

[0036] If the preset whitelist contains a combination of the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that no login interception is required.

[0037] If the combination of the first identifier information, the second identifier information, and the third identifier information does not exist in the preset whitelist, the whitelist verification result is determined to be that login interception is required.

[0038] In one embodiment, the step of remotely controlling login to a remote host based on the whitelist verification result includes:

[0039] If the whitelist verification result indicates that login interception is not required, a control command is sent to the remote host so that the remote host performs the corresponding operation based on the control command.

[0040] If the whitelist verification result indicates that login interception is required, the remote login connection with the remote host is interrupted.

[0041] In one embodiment, the step of interrupting the remote login connection with the remote host when the whitelist verification result indicates that login interception is required includes...

[0042] If the whitelist verification result indicates that login interception is required, an exit command is sent to the remote host to cause the remote host to perform an exit operation and terminate the remote login connection with the remote host.

[0043] Furthermore, to achieve the above objectives, this application also proposes a remote login control device, which includes:

[0044] The receiving module is used to receive environment variables sent by the bastion host after confirming that a successful remote login connection with the bastion host has been established;

[0045] The sending module is used to establish a remote login connection with a remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source, and provide feedback.

[0046] The control module is used to remotely control login to the remote host based on the login link source fed back by the remote host.

[0047] In one embodiment, the control module is further configured to send a control command to the remote host when the login link source reported by the remote host is the bastion host, so that the remote host performs a corresponding operation based on the control command;

[0048] If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result, and perform remote login control on the remote host based on the whitelist verification result.

[0049] In one embodiment, the control module is further configured to receive remote control information sent by the bastion host when the login link source reported by the remote host is the bastion host;

[0050] The operation object and operation content are determined based on the remote control information;

[0051] Control commands are generated based on the operation object and operation content, and then sent to the remote host.

[0052] In one embodiment, the control module is further configured to acquire operating system information of the remote host;

[0053] The corresponding control instruction format is determined based on the operating system information;

[0054] The operation object and the operation content are encoded based on the control instruction format to generate control instructions adapted to the remote host.

[0055] Send the control command to the remote host.

[0056] In one embodiment, the control module is further configured to acquire an encryption key and an initialization vector;

[0057] The control command is encrypted using the encryption key to obtain encrypted ciphertext.

[0058] The encrypted ciphertext and the initialization vector are merged and encoded to obtain the encrypted control command;

[0059] Send the encrypted control command to the remote host.

[0060] In one embodiment, the control module is further configured to perform whitelist verification on the login link source when the login link source reported by the remote host is not the bastion host, and obtain a whitelist verification result;

[0061] Remote login control is performed on the remote host based on the whitelist verification results.

[0062] In one embodiment, the control module is further configured to acquire first identification information of the login link source, second identification information of the remote host, and third identification information of the user;

[0063] The whitelist verification is performed based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result.

[0064] In one embodiment, the control module is further configured to query a preset whitelist based on the first identification information, the second identification information, and the third identification information, wherein the preset whitelist includes multiple combinations of identification information;

[0065] If the preset whitelist contains a combination of the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that no login interception is required.

[0066] If the combination of the first identifier information, the second identifier information, and the third identifier information does not exist in the preset whitelist, the whitelist verification result is determined to be that login interception is required.

[0067] In addition, to achieve the above objectives, this application also proposes a remote login control device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the remote login control method as described above.

[0068] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the remote login control method described above.

[0069] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the remote login control method described above.

[0070] This application provides a remote login control method. First, after successfully establishing a remote login connection with a bastion host, the method receives environment variables sent by the bastion host; then, it establishes a remote login connection with a remote host and sends the environment variables to the remote host, enabling the remote host to perform login authentication based on the environment variables, obtain the login link source, and provide feedback; finally, it controls the remote host's remote login based on the login link source feedback. Through this method, by introducing a bastion host for SSH remote login to the control host and transmitting environment variables to the control host, the control host sends the environment variables to the remote host for login authentication. By identifying whether the login link source is the bastion host, the method responds to or intercepts the remote login to the remote host. When a host in the internal network is attacked, the introduction of the bastion host as the source verification mechanism restricts attackers from lateral movement via SSH remote login after entering the internal network, effectively improving the security of SSH remote login. Attached Figure Description

[0071] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0072] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0073] Figure 1 This is a flowchart illustrating an embodiment of the remote login control method of this application.

[0074] Figure 2 A schematic diagram of an intranet system provided in an embodiment of the remote login control method of this application;

[0075] Figure 3 This is a schematic diagram illustrating an attacker's attack on an intranet system, provided as an embodiment of the remote login control method of this application.

[0076] Figure 4 This is a flowchart illustrating Embodiment 2 of the remote login control method of this application;

[0077] Figure 5 This is a schematic diagram of the module structure of the remote login control device according to an embodiment of this application;

[0078] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the remote login control method of this application embodiment.

[0079] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0080] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0081] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0082] The main solution of this application embodiment is as follows: after successfully establishing a remote login connection with the bastion host, receive environment variables sent by the bastion host; establish a remote login connection with the remote host and send the environment variables to the remote host so that the remote host performs login authentication based on the environment variables, obtains the login link source and provides feedback; and perform remote login control on the remote host based on the login link source fed back by the remote host.

[0083] The goal of internal network security is to minimize the risk that attackers, after gaining access to the company's internal network from the external network, can use the compromised internal host to further intrude into other internal hosts. In practice, it often happens that an attacker gains access to an internal host and, through phishing or other means, obtains the usernames and passwords of users on that host. This allows them to log in via SSH to other authorized hosts, further expanding the attack scope. Because the attacker uses a compromised internal host to intrude into other hosts, this intrusion is difficult to detect, easily leading to more internal hosts being attacked, and compromising the security of SSH logins.

[0084] This application introduces a bastion host for SSH remote login to the control host and transmits environment variables to the control host. The control host then sends the environment variables to the remote host for login authentication. By identifying whether the login link originates from the bastion host, the application responds to or intercepts remote login attempts to the remote host. When a host in the internal network is attacked, the introduction of the bastion host as the source of authentication restricts attackers from lateral movement via SSH remote login after entering the internal network, effectively improving the security of SSH remote login.

[0085] Based on this, this application provides a remote login control method applied to a control host, as shown in the following example. Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the remote login control method of this application.

[0086] In this embodiment, the remote login control method includes steps S10 to S30:

[0087] Step S10: After confirming that a remote login connection with the bastion host has been successfully established, receive the environment variables sent by the bastion host.

[0088] It should be noted that the execution entity in this embodiment is the control host, which is a device that controls a remote host via SSH remote login. The remote host is the remote server logged into during the SSH login process, i.e., the controlled host. In this embodiment, to prevent lateral movement via SSH after an attack enters the internal network, a bastion host is introduced. That is, after logging into the control host through the bastion host, one can log into the remote host from the control host to ensure the security of internal network data.

[0089] It is understandable that both the control host and the remote host are internal network hosts, that is, hosts in the internal network system. The internal network system also includes the bastion host. The internal network system is a relatively closed computer network used for internal communication and data sharing. The bastion host, remote host and control host communicate and transmit data in sequence via the SSH protocol to ensure the security of data transmission.

[0090] It should be understood that the intranet system includes a bastion host and multiple intranet hosts, such as... Figure 2 As shown, Figure 2 This is a diagram of an intranet system. Figure 2 The example shows a bastion host and three internal network hosts: internal network host A, internal network host B, and internal network host C.

[0091] A bastion host is a computer device used to log in to hosts on an internal network. Users access these hosts through the bastion host. Bastion hosts typically require two-factor authentication to ensure that attackers cannot obtain the bastion host's username and password to log in. In other words, provided the bastion host provides absolute security, logging into individual hosts within the internal network through it guarantees the security of those logins.

[0092] In this implementation, users can log in to multiple internal network hosts by performing SSH operations through the bastion host.

[0093] Optionally, a bastion host can allow multiple user accounts to log in to multiple internal network hosts within the internal network system simultaneously. Specifically, this includes: 1. Allowing multiple user accounts to simultaneously SSH into a single internal network host. 2. Allowing multiple user accounts to simultaneously SSH into different internal network hosts. 3. Allowing multiple user accounts to simultaneously SSH into some of the same internal network hosts. In other words, some user accounts log in to one internal network host through the bastion host, while other user accounts log in to other internal network hosts through the bastion host.

[0094] In this implementation, internal network hosts can log in to each other via SSH. For example, after a user logs in to an internal network host (i.e., the control host) through a bastion host, they can also log in to other internal network hosts (i.e., remote hosts) from the currently logged-in internal network host.

[0095] For example, such as Figure 2 As shown by the dashed line, a user can log in from the bastion host to internal network host A, then from internal network host A to internal network host B, then from internal network host B to internal network host C, and so on. Alternatively, as... Figure 2 As shown by the dotted line, a user can also log in to internal network host B from the bastion host, and then log in to internal network host A from internal network host B.

[0096] It's worth noting that each time a user logs into an internal network host (i.e., the control host) through the bastion host, the bastion host issues an authentication token. This authentication token can only be issued by the bastion host, cannot be forged, and is used to verify the bastion host's identity. The authentication token is, for example, an authentication token. During bastion host login, the authentication token is stored in the current session's environment variables, and the environment variables are set to read-only using `export readonly` to prevent modification. After successfully establishing a remote login connection between the control host and the bastion host, the bastion host passes the environment variables to the control host.

[0097] Optionally, when different user accounts log in to the same internal network host through the bastion host, the bastion host issues different verification flags for each user account to ensure the independence and isolation between each user account.

[0098] Optionally, when the same user account logs into different internal network hosts through the bastion host, the bastion host will issue different verification flags for the same user account to ensure the isolation between different internal network hosts.

[0099] For example, in this embodiment of the application, a user logs into internal network host A (i.e., the control host) through a bastion host. The bastion host sends environment variables to internal network host A, carrying an authentication flag within the environment variables. Internal network host A stores this authentication flag. When the user needs to log into internal network host B through internal network host A, internal network host A transmits the authentication flag to internal network host B (i.e., the remote host) through the environment variables. After receiving the environment variables, internal network host B also stores the authentication flag and passes it down as needed. When logging into internal network host C through internal network host B, internal network host B is the control host and internal network host C is the remote host. Internal network host B further transmits the authentication flag to internal network host C through the environment variables, and so on, ensuring that each SSH login operation can trace the login link source through the authentication flag, thereby verifying the legitimacy of the login operation.

[0100] Step S20: Establish a remote login connection with the remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source, and provide feedback.

[0101] It's important to note that after successfully receiving the environment variables from the bastion host, the control host attempts to establish an SSH remote login connection with the specified remote host. This connection process follows the SSH protocol, ensuring the security and integrity of data transmission. Once the connection is established, the control host immediately sends the previously received environment variables (including the authentication flag) to the remote host. Upon receiving these environment variables, the remote host performs a series of login authentication operations. Crucially, the remote host checks the authentication flag in the environment variables to trace the login origin, confirming whether the login operation was initiated by the bastion host. If the authentication flag is valid and indeed originates from the bastion host, the remote host considers the login operation legitimate and proceeds accordingly, such as allowing the user to access or execute related tasks. Conversely, if the authentication flag is invalid or of unknown origin, the remote host determines the login operation to be illegitimate and immediately takes appropriate measures, such as terminating the connection.

[0102] It should be understood that the control host that establishes the remote login connection to the remote host may be an internal network host compromised by the attacker. Please refer to [the relevant documentation / reference]. Figure 3 , Figure 3 This diagram illustrates an attacker's assault on an internal network system. Figure 3 As can be seen from this, when an attacker compromises a host on an internal network (such as...), Figure 3 After gaining access to internal host A (the controlling host), the attacker can obtain permissions for internal host A, as well as some or all of the user account information. Then, when the attacker wants to log in to internal host B (the remote host) through internal host A, they can exploit the fact that internal host A needs to pass environment variables (including verification flags, such as authentication tokens) to internal host B.

[0103] It's worth noting that after receiving the environment variables, the remote host can obtain the source host IP (Internet Protocol Address) of the login, but cannot obtain the previous hop's source IP, meaning it cannot trace the origin. In this situation, determining the source of the current login link becomes extremely difficult. Therefore, the following mechanism was designed: each time a user logs into an internal network host through a bastion host, the bastion host issues an authentication flag. Then, during each SSH login, the internal network host passes the authentication flag to the internal network host being logged into via environment variables. This allows the internal network host to detect whether the source of the current login link is the bastion host.

[0104] Specifically, the remote host authenticates its login by checking if an authentication flag issued by the bastion host exists in the environment variables. If the flag is present, the login path originates from the bastion host; otherwise, it is determined that the login path does not originate from the bastion host, and this determination is sent back to the control host. This design ensures that even if an attacker compromises a host on the internal network, they cannot bypass the bastion host to perform unauthorized SSH logins, as the remote host uses the authentication flag to determine the legitimacy of the login path, thus effectively improving the security of the internal network system.

[0105] It's worth noting that when environment variables are sent during direct login via a bastion host, internal host A can directly obtain the authentication flag issued by the bastion host from the environment variables, thus confirming that the bastion host is the origin of this login link. When environment variables are sent when internal host A logs into the current internal host B, or when internal host B logs into the current internal host C, the following two scenarios exist:

[0106] First, refer to Figure 2 The remote host is accessed directly or indirectly by the bastion host. Figure 2In the login chain indicated by the dashed line, internal host B logs in indirectly through the bastion host, while internal host A logs in directly through the bastion host. In this case, as mentioned earlier, the remote host can directly obtain the authentication flag passed through environment variables, or the remote host can directly obtain the authentication flag and add it to its environment variables before passing it to internal host B. Thus, internal host B can obtain the authentication flag from its environment variables, thereby confirming that the source of this login chain is the bastion host.

[0107] Second, reference Figure 3 The remote host is the internal network host that has been compromised by the attacker. Figure 3 In the case of an internal network host A), the remote host itself cannot obtain the authentication flag, and consequently, its environment variables will not carry the authentication flag. Thus, the remote host ( Figure 3 The internal network host B) could not detect the authentication flag in the environment variables, thus determining that the source of this login link was not the bastion host. Further, the SSH remote login connection can be disconnected to achieve the interception effect.

[0108] In this application's implementation, the process by which a remote host detects the presence of an authentication flag issued by the bastion host in its environment variables may include the following: In one implementation, after receiving the environment variables, the remote host first checks for the presence of the authentication flag; if the authentication passes, it logs in; otherwise, it does not log in. In another implementation, the authentication flag is checked after successful login. That is, when checking for the authentication flag, SSH login has already been successful, and the authentication flag has already been set in the remote host's environment variables.

[0109] This approach takes into account that SSH login initializes the session using commands in / etc / profile, and this initialization occurs after the authentication flag is set. Therefore, by adding an authentication command to / etc / profile, the authentication flag (token value) in the environment variables is extracted for verification. The verification can be performed locally on the remote host, and if the verification fails, the current SSH connection is disconnected.

[0110] It's important to note that in this implementation, a successful SSH login does not mean the controlling host has acquired permissions on the remote host. In fact, the controlling host only gains permissions on the remote host after successful authentication. The process of the remote host granting permissions to the controlling host can be understood as the remote host responding to environment variables.

[0111] The following example illustrates this solution:

[0112] A legitimate user logs into host A through the bastion host, and host A obtains a token issued by the bastion host. Then, the user logs into host B, where host A passes the token to host B. When logging into host C from host B, host B also passes the token to host C. Based on the received token, host C determines that the source of this login link is the bastion host, thus confirming a secure login and responding to the login request.

[0113] Considering the scenario of an attack on the internal network system, the attacker obtains the privileges of host A and the user's account password through the vulnerability and attempts to log in to host B. During this process, host A does not obtain a token and is also unable to pass the token to host B. Thus, host B does not detect the token. Since there is no token issued by the bastion host, it can be determined that the source of this login link is not the bastion host, and host B blocks this login.

[0114] Because bastion hosts are absolutely secure, attackers cannot obtain privileges on the bastion host, meaning they cannot acquire the token or forge it. Thus, once an attacker compromises an internal network host, they cannot use that compromised host to intrude into other internal network hosts, thereby improving the security of the internal network.

[0115] In this implementation, a verification flag is added to the environment variables each time an SSH operation logs into an internal network host. This allows the host to verify whether the source of the login link is a bastion host. If it is confirmed to be a bastion host, the login request is deemed normal and can be responded to. Otherwise, the SSH login request is blocked. Since attackers cannot obtain bastion host privileges, they also cannot obtain the verification flag, thus facilitating the internal network host to identify abnormal logins and achieving the goal of blocking all attackers. This process does not affect the normal login process.

[0116] In summary, the embodiments of this application, while having minimal impact on the intranet environment, effectively limit lateral intrusions by attackers via SSH after gaining access to the intranet. Furthermore, since it does not rely on database queries for each login verification, there is no significant delay even in intranet environments with high login frequency, making it more efficient than collecting SSH login data from the entire network for rule analysis. In addition, by transmitting a token during each SSH login process and tracing the logged-in intranet host, a complete abnormal SSH login chain diagram can be drawn within the intranet.

[0117] In this embodiment, after detecting the verification flag, the remote host can acquire and save the verification flag, and transmit the verification flag to other internal network hosts when needed. The process of acquiring and saving the verification flag includes, for example, the remote host, upon receiving the environment variable, storing the token carried in the environment variable in the current session's environment variables, and setting the environment variable to read-only using `export readonly` to prevent modification.

[0118] In practical applications, tokens can be transmitted in the following two scenarios.

[0119] One scenario is: Internal network host A needs to log in to internal network host B.

[0120] In this scenario, internal host A can add a token to the SendEnv option of the ssh_config file (usually located in / etc / ssh / ssh_config) to pass the token environment variable during login. Internal host B, which receives the environment variable, can add a token en to the AcceptEnv option of the sshd_config file ( / etc / ssh / ssh_config) to accept the token environment variable when logged in.

[0121] Another scenario is when executing the sudo command on internal network host A.

[0122] The sudo command discards the environment variables of the current session. If the token is not passed when executing the sudo command, the token will be lost, and you will not be able to log in to other internal network hosts after executing the sudo command.

[0123] In this embodiment of the application, the method for passing the token when executing the sudo command includes: adding Defaults_env_keep+="token" to the sudo configuration file sudoers ( / etc / sudoers) to retain the token environment variable after executing the sudo command.

[0124] Step S30: Perform remote login control on the remote host based on the login link source fed back by the remote host.

[0125] It should be noted that during the remote login control process, after receiving the login authentication result from the remote host based on environment variables, the control host will execute corresponding remote login control operations according to the determination of the login link source. If the remote host confirms that the login link source is a bastion host, i.e., the verification flag is valid and the source is clear, the control host will continue to maintain the connection with the remote host and allow the user to perform subsequent operations, such as accessing files and executing commands. This indicates that the login operation is legitimate and the user's permissions have been correctly verified and authorized.

[0126] However, if the remote host detects that the login link does not originate from the bastion host (i.e., the authentication flag is invalid or missing), this indicates a possible unauthorized login attempt, such as an attacker trying to bypass the bastion host and directly access an internal network host. In this case, the controlling host will immediately take security measures, such as terminating the connection with the remote host.

[0127] It should be understood that all legitimate login links recognized by the intranet system involve users directly or indirectly logging into various intranet hosts through a bastion host. However, bypassing the bastion host and directly logging into an intranet host may be considered an unauthorized login. For example, if a user logs into intranet host A from a bastion host, and then logs into intranet host B from host A, host B can determine that the login link is: bastion host -> a -> b. It can be seen that the source of the login link is the bastion host; therefore, host B can determine that this is a secure login.

[0128] By combining the concept of a bastion host, while preserving normal login between internal network hosts, all lateral movement operations by attackers are intercepted without the attention of the corresponding business, ensuring that even if an attacker obtains the account password of a user on one internal network host, they cannot intrude into other hosts on the internal network.

[0129] In practical applications, logging into internal network hosts via a bastion host can present obstacles in certain scenarios. For example, in operations and maintenance (O&M) scenarios, there may be a need to execute tasks on a batch of internal network hosts or to distribute tasks using O&M tools. These requirements may not be supported by the bastion host, necessitating login from a jump host. In this case, the login link no longer originates from the bastion host when logging into various internal network hosts, and therefore will be blocked. This creates obstacles for normal enterprise O&M operations.

[0130] Additionally, in business scenarios, business services rely on SSH for data and file synchronization. For example, a business service runs on host A and needs to synchronize with hosts B, C, and D. However, the login links from host A to hosts B, C, and D do not originate from the bastion host, so they will be blocked.

[0131] This embodiment provides a remote login control method. First, after successfully establishing a remote login connection with a bastion host, it receives environment variables sent by the bastion host; then, it establishes a remote login connection with a remote host and sends the environment variables to the remote host, enabling the remote host to perform login authentication based on the environment variables, obtain the login link source, and provide feedback; finally, it controls the remote host's remote login based on the login link source feedback from the remote host. Through this method, by introducing a bastion host for SSH remote login to the control host and transmitting environment variables to the control host, the control host sends the environment variables to the remote host for login authentication. By identifying whether the login link source is the bastion host, the method responds to or intercepts the remote login to the remote host. When a host in the internal network is attacked, the introduction of the bastion host as the source verification mechanism restricts attackers from lateral movement via SSH remote login after entering the internal network, effectively improving the security of SSH remote login.

[0132] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 Step S30 further includes steps S301-S302:

[0133] Step S301: If the login link source reported by the remote host is the bastion host, a control command is sent to the remote host so that the remote host performs corresponding operations based on the control command.

[0134] It's important to note that when the remote host confirms that the login link originates from the bastion host, it indicates that the current login request is legitimate and secure. At this point, the controlling host sends a series of control commands to the remote host. These commands are designed to instruct the remote host to perform specific operations or tasks. For example, control commands may include permissions to access specific files, authorization to execute specific commands, or instructions to modify remote host configuration parameters. Upon receiving the control commands, the remote host will execute the corresponding operations as required and report the results back to the controlling host.

[0135] In one feasible implementation, step S301 may include: if the login link source reported by the remote host is the bastion host, receiving remote control information sent by the bastion host; determining the operation object and operation content based on the remote control information; generating control instructions based on the operation object and operation content, and sending the control instructions to the remote host.

[0136] It should be noted that the bastion host, as a core component of intranet security, is not only responsible for user login authentication, but also bears the important responsibility of managing, monitoring, and recording all login behaviors. In this embodiment, when the controlling host confirms that the login link of the remote host originates from the bastion host, it will further receive remote control information from the bastion host. This information describes in detail the specific operations that need to be performed on the remote host, including but not limited to the objects of the operations (such as files, processes, or system configurations) and the content of the operations (such as reading, writing, executing, or modifying).

[0137] It should be understood that after receiving remote control information, the control host generates corresponding control commands based on preset rules and policies, and immediately sends them to the remote host. Upon receiving the control commands, the remote host immediately executes the required operations and provides real-time feedback of the results to the control host. In this way, the control host can achieve precise control and efficient management of remote hosts, ensuring the security and stability of the intranet system.

[0138] In one feasible implementation, the step of generating control instructions based on the operation object and operation content, and sending the control instructions to the remote host, includes: obtaining the operating system information of the remote host; determining the corresponding control instruction format based on the operating system information; encoding the operation object and operation content based on the control instruction format to generate control instructions adapted to the remote host; and sending the control instructions to the remote host.

[0139] It should be noted that different remote hosts may be running different operating systems, which may have significant differences in instruction formats, syntax rules, and operating methods. To ensure that control commands can be correctly parsed and executed by the remote host, the controlling host must fully consider the operating system information of the remote host when generating control commands.

[0140] Specifically, the controlling host first obtains the operating system information of the remote host. This information can be obtained through the remote host's login authentication process or through other channels (such as pre-configured configuration files). After obtaining the remote host's operating system information, the controlling host determines the corresponding control command format based on this information. This format is the foundation for communication between the control commands and the remote host's operating system; it specifies key elements such as the command encoding method, syntax rules, and execution flow. Next, based on the determined control command format, the controlling host encodes the operation object and operation content. This encoding process aims to convert abstract operation commands into concrete commands that the remote host can understand and execute. During the encoding process, the controlling host fully considers the characteristics and limitations of the remote host to ensure that the generated control commands not only meet the operating system's requirements but also efficiently execute the required operations. Finally, the controlling host sends the encoded control commands to the remote host.

[0141] In one feasible implementation, sending the control command to the remote host includes: obtaining an encryption key and an initialization vector; encrypting the control command based on the encryption key to obtain encrypted ciphertext; merging and encoding the encrypted ciphertext and the initialization vector to obtain an encrypted control command; and sending the encrypted control command to the remote host.

[0142] It should be noted that the control commands are encrypted before being sent to ensure their security and integrity during transmission.

[0143] Specifically, after generating control commands adapted to the remote host, the control host randomly generates an encryption key and an initialization vector. The encryption key is used to encrypt the control commands to generate encrypted ciphertext, while the initialization vector introduces a random, unpredictable factor into the encryption process to enhance its complexity and security. After obtaining the ciphertext and initialization vector, the control host merges and encodes them to generate an encrypted control command. Even if this command is intercepted during transmission, attackers will find it difficult to decipher its content, thus ensuring the command's security and confidentiality. Finally, the control host sends this encrypted control command to the remote host. Upon receiving the command, the remote host uses the same encryption key and initialization vector to decrypt it, thus restoring the original control command and executing the corresponding operation. This method not only improves the security of control commands during transmission but also effectively prevents unauthorized users from tampering with or forging the commands, further enhancing the overall security of the intranet system.

[0144] Step S302: If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result and perform remote login control on the remote host based on the whitelist verification result.

[0145] It should be noted that login interception is not necessary for users in all scenarios. Therefore, this embodiment provides a flexible processing mechanism to handle situations where the login link source reported by the remote host is not a bastion host. When this happens, the control host will not immediately reject or block the login request, but will first obtain a whitelist verification result. This whitelist is a pre-defined list containing trusted IP addresses or device identifiers, representing entities that are allowed to log in remotely even without a bastion host as the login link source.

[0146] In one feasible implementation, step S302 may include steps A10 to A11:

[0147] Step A10: If the login link source reported by the remote host is not the bastion host, perform whitelist verification on the login link source to obtain the whitelist verification result.

[0148] It should be noted that whitelist verification is used to confirm the legitimacy and trustworthiness of the login link source. The control host compares the login link source reported by the remote host with the preset whitelist to check whether the source is included in the whitelist. This comparison process is based on precise matching of IP address, device identifier, or other relevant information to ensure the accuracy and reliability of the verification.

[0149] Step A11: Perform remote login control on the remote host based on the whitelist verification result.

[0150] It should be noted that remote login control of a remote host includes response control and login interception. If the whitelist verification result indicates that login interception is not required, the controlling host will allow the remote host's login request and send normal control commands or access permissions to the remote host so that it can continue to perform the scheduled operations or tasks. The process of sending these control commands or access permissions also follows the encryption and transmission procedures described earlier to ensure security and confidentiality.

[0151] However, if the whitelist verification result indicates that login blocking is required, the control host will immediately reject the remote host's login request or terminate the established login connection to prevent potential security threats. This provides a remote login control mechanism that is both strict and flexible, ensuring security while meeting login needs in different scenarios.

[0152] In a feasible implementation, the step A10, "the login link source performs whitelist verification and obtains whitelist verification results," specifically includes: obtaining the first identifier information of the login link source, the second identifier information of the remote host, and the third identifier information of the user; performing whitelist verification based on the first identifier information, the second identifier information, and the third identifier information to obtain whitelist verification results.

[0153] It should be noted that the whitelist verification process fully considers the identification information of the login link source, the remote host, and the user. The control host first obtains the first identification information of the login link source, which is an IP address, device serial number, or other information that can uniquely identify the source. This embodiment uses an IP address as an example. Simultaneously, the control host obtains the second identification information of the remote host, which is also an IP address, device serial number, or other information that can uniquely identify the source. This embodiment uses an IP address as an example. The user's third identification information includes, for example, a username, password, digital certificate, or other authentication credentials. This embodiment uses a username as an example.

[0154] It's worth noting that joint verification using the IP address of the login link origin, the IP address of the remote host, and the username can significantly improve the accuracy and reliability of the verification. The control host compares this identification information with a preset whitelist to check if they are all included. Only when all three pass verification, i.e., are all included in the whitelist, is the login link origin considered legitimate and trustworthy. At this point, the control host will allow the remote host's login request and send it the corresponding control commands or access permissions.

[0155] In one feasible implementation, the step of performing whitelist verification based on the first identifier information, the second identifier information, and the third identifier information to obtain a whitelist verification result includes: querying a preset whitelist based on the first identifier information, the second identifier information, and the third identifier information, wherein the preset whitelist includes multiple identifier information combinations; if the preset whitelist contains an identifier information combination corresponding to the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that login blocking is not required; if the preset whitelist does not contain an identifier information combination corresponding to the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that login blocking is required.

[0156] It should be noted that the preset whitelist is a database or list containing multiple combinations of identification information. These combinations represent the identification information of trusted login link sources, remote hosts, and users. All internal network hosts in the intranet system can share a single whitelist, or each internal network host in the intranet system can set its own independent whitelist. This embodiment does not impose specific restrictions on this.

[0157] Understandably, during whitelist verification, the control host compares the obtained first, second, and third identifier information with various identifier combinations in the preset whitelist. If a perfect match is found—that is, the first, second, and third identifier information all exactly match a combination in the whitelist—the control host considers the login request legitimate and trustworthy. Therefore, it will not block the login and will process the request according to the normal procedure, including sending control commands or access permissions to the remote host.

[0158] However, if no exact match is found in the preset whitelist (i.e., any one or more of the first, second, and third identifiers do not match a combination in the whitelist), the controlling host will consider the login request a security risk. Therefore, it will block the login, rejecting the remote host's login request or terminating any established login connection to prevent potential security threats. This method significantly improves the security of the internal network system, preventing unauthorized remote access and operations.

[0159] Continuing with the example from the previous business scenario, when a user logs into host b via host a, host a sends environment variables to host b. Host b retrieves the IP addresses of host a, host b, and user account 1 from these environment variables. Then, host b searches a whitelist for a matching combination of identifiers, which includes the IP addresses of host a, host b, and user account 1. If the matching combination exists, host b can directly respond to the environment variables without blocking. If it doesn't exist, host b can either block the login or perform other verification steps.

[0160] In one feasible implementation, step A11 includes: if the whitelist verification result indicates that login interception is not required, sending a control command to the remote host to enable the remote host to perform a corresponding operation based on the control command; and if the whitelist verification result indicates that login interception is required, terminating the remote login connection with the remote host.

[0161] Specifically, after confirming the whitelist verification result, the control host will execute the corresponding remote login control operation based on this result. If the whitelist verification result shows that the login link source is legitimate and trustworthy, meaning that login interception is not required, the control host will continue to execute the remote login process and send control commands to the remote host. These control commands can be operation commands for performing specific tasks or authorization credentials for accessing specific resources on the remote host. After receiving these control commands, the remote host will perform corresponding operations based on the content of the commands, or allow users to access specified resources. Throughout this process, the sending and receiving of control commands follow the encryption and transmission procedures described earlier to ensure security and confidentiality.

[0162] However, if the whitelist verification results indicate a security risk at the source of the login link, requiring login interception, the control host will immediately terminate the remote login connection with the remote host. This operation can be achieved by sending an interrupt command to the remote host. Upon receiving the interrupt command, the remote host will immediately terminate the current login session and disconnect from the control host. In this way, potential security threats can be effectively prevented, and unauthorized remote access and operations can be prevented from damaging the internal network system.

[0163] In one feasible implementation, interrupting the remote login connection with the remote host when the whitelist verification result indicates that login interception is required includes sending an exit command to the remote host to cause the remote host to perform an exit operation and interrupt the remote login connection with the remote host.

[0164] It should be noted that, in this embodiment, interrupting the remote login connection using the `exit` command is a direct and effective method. When the controlling host determines that there is a security risk at the source of the login link and needs to intercept the login, it sends an `exit` command to the remote host. Upon receiving this command, the remote host immediately performs an exit operation, disconnecting from the controlling host and thus terminating the current login session. This method can quickly respond to security threats and prevent potential security risks from spreading further.

[0165] In this embodiment, different strategies are implemented for remote login control of the remote host based on whether the login link source reported by the remote host is a bastion host. When the login link source reported by the remote host is a bastion host, a whitelist verification mechanism is further introduced. Then, based on the whitelist verification result, the remote host is responded to or blocked from remote login, which effectively improves the flexibility and security of SSH remote login.

[0166] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the remote login control method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0167] This application also provides a remote login control device, please refer to... Figure 5 The remote login control device includes:

[0168] The receiving module 10 is used to receive environment variables sent by the bastion host after confirming that a remote login connection with the bastion host has been successfully established.

[0169] The sending module 20 is used to establish a remote login connection with a remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source, and provide feedback.

[0170] The control module 30 is used to remotely log in to the remote host based on the login link source fed back by the remote host.

[0171] The remote login control device provided in this application, employing the remote login control method described in the above embodiments, can solve the technical problem that attackers use compromised internal network hosts to remotely log in via SSH and intrude into other hosts, thus compromising the security of SSH login. Compared with the prior art, the beneficial effects of the remote login control device provided in this application are the same as those of the remote login control method provided in the above embodiments, and other technical features in the remote login control device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0172] Optionally, the control module 30 is further configured to send a control command to the remote host when the login link source reported by the remote host is the bastion host, so that the remote host performs a corresponding operation based on the control command; and to obtain a whitelist verification result when the login link source reported by the remote host is not the bastion host, and to perform remote login control on the remote host based on the whitelist verification result.

[0173] Optionally, the control module 30 is further configured to, when the login link source reported by the remote host is the bastion host, receive remote control information sent by the bastion host; determine the operation object and operation content based on the remote control information; generate control instructions based on the operation object and operation content; and send the control instructions to the remote host.

[0174] Optionally, the control module 30 is further configured to acquire operating system information of the remote host; determine the corresponding control instruction format based on the operating system information; encode the operation object and the operation content based on the control instruction format to generate control instructions adapted to the remote host; and send the control instructions to the remote host.

[0175] Optionally, the control module 30 is further configured to: acquire an encryption key and an initialization vector; encrypt the control command based on the encryption key to obtain encrypted ciphertext; merge and encode the encrypted ciphertext and the initialization vector to obtain an encrypted control command; and send the encrypted control command to the remote host.

[0176] Optionally, the control module 30 is further configured to, when the login link source reported by the remote host is not the bastion host, perform whitelist verification on the login link source to obtain a whitelist verification result; and perform remote login control on the remote host based on the whitelist verification result.

[0177] Optionally, the control module 30 is further configured to obtain the first identification information of the login link source, the second identification information of the remote host, and the third identification information of the user; and to perform whitelist verification based on the first identification information, the second identification information, and the third identification information to obtain the whitelist verification result.

[0178] Optionally, the control module 30 is further configured to query a preset whitelist based on the first identifier information, the second identifier information, and the third identifier information, wherein the preset whitelist includes multiple combinations of identifier information; if the preset whitelist contains an identifier information combination corresponding to the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that login blocking is not required; if the preset whitelist does not contain an identifier information combination corresponding to the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that login blocking is required.

[0179] Optionally, the control module 30 is further configured to send a control command to the remote host when the whitelist verification result indicates that login interception is not required, so that the remote host performs corresponding operations based on the control command; and to interrupt the remote login connection with the remote host when the whitelist verification result indicates that login interception is required.

[0180] Optionally, the control module 30 is further configured to send an exit command to the remote host when the whitelist verification result indicates that login interception is required, so that the remote host performs an exit operation and interrupts the remote login connection with the remote host.

[0181] This application provides a remote login control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the remote login control method in Embodiment 1 above.

[0182] The following is for reference. Figure 6 The diagram illustrates a structural schematic of a remote login control device suitable for implementing embodiments of this application. The remote login control device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 6 The remote login control device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0183] like Figure 6As shown, the remote login control device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the remote login control device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the remote login control device to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show remote login control devices with various systems, it should be understood that implementing or having all of the systems shown is not required. More or fewer systems may be implemented alternatively.

[0184] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0185] The remote login control device provided in this application, employing the remote login control method described in the above embodiments, can solve the technical problem that attackers use compromised internal network hosts to perform SSH remote login to intrude into other hosts, thus compromising the security of SSH login. Compared with the prior art, the beneficial effects of the remote login control device provided in this application are the same as those of the remote login control method provided in the above embodiments, and other technical features of this remote login control device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0186] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0187] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0188] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the remote login control method in the above embodiments.

[0189] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0190] The aforementioned computer-readable storage medium may be included in the remote login control device; or it may exist independently and not be assembled into the remote login control device.

[0191] The aforementioned computer-readable storage medium carries one or more programs that, when executed by a remote login control device, cause the remote login control device to: after determining that a successful remote login connection with the bastion host has been established, receive environment variables sent by the bastion host; establish a remote login connection with a remote host and send the environment variables to the remote host, so that the remote host performs login authentication based on the environment variables, obtains the login link source, and provides feedback; and perform remote login control on the remote host based on the login link source feedback from the remote host.

[0192] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0193] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0194] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0195] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned remote login control method. This solves the technical problem that attackers use compromised internal network hosts to perform SSH remote logins to intrude into other hosts, thus compromising the security of SSH logins. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the remote login control method provided in the above embodiments, and will not be elaborated upon here.

[0196] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the remote login control method described above.

[0197] The computer program product provided in this application can solve the technical problem that attackers use compromised internal network hosts to remotely log in via SSH and intrude into other hosts, thus compromising the security of SSH login. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the remote login control method provided in the above embodiments, and will not be repeated here.

[0198] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

[0199] This invention discloses A1. A remote login control method, applied to a control host, the method comprising:

[0200] After confirming a successful remote login connection with the bastion host, receive environment variables sent by the bastion host;

[0201] Establish a remote login connection with the remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source and provide feedback;

[0202] Remote login control is performed on the remote host based on the login link source fed back by the remote host.

[0203] A2. The method as described in 1, wherein the remote login control of the remote host based on the login link source fed back by the remote host includes:

[0204] If the login link source reported by the remote host is the bastion host, a control command is sent to the remote host so that the remote host performs corresponding operations based on the control command;

[0205] If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result, and perform remote login control on the remote host based on the whitelist verification result.

[0206] A3. As described in 2, when the login link source reported by the remote host is the bastion host, sending control commands to the remote host includes:

[0207] If the login link source reported by the remote host is the bastion host, then receive the remote control information sent by the bastion host;

[0208] The operation object and operation content are determined based on the remote control information;

[0209] Control commands are generated based on the operation object and operation content, and then sent to the remote host.

[0210] A4. The method as described in 3, wherein generating control instructions based on the operation object and operation content, and sending the control instructions to the remote host, includes:

[0211] Obtain operating system information from a remote host;

[0212] The corresponding control instruction format is determined based on the operating system information;

[0213] The operation object and the operation content are encoded based on the control instruction format to generate control instructions adapted to the remote host.

[0214] Send the control command to the remote host.

[0215] A5. As described in 4, sending the control command to the remote host includes:

[0216] Obtain the encryption key and initialization vector;

[0217] The control command is encrypted using the encryption key to obtain encrypted ciphertext.

[0218] The encrypted ciphertext and the initialization vector are merged and encoded to obtain the encrypted control command;

[0219] Send the encrypted control command to the remote host.

[0220] A6. The method as described in 2, wherein when the login link source reported by the remote host is not the bastion host, obtaining the whitelist verification result and performing remote login control on the remote host based on the whitelist verification result includes:

[0221] If the login link source reported by the remote host is not the bastion host, the login link source is verified by a whitelist to obtain the whitelist verification result.

[0222] Remote login control is performed on the remote host based on the whitelist verification results.

[0223] A7. As described in 6, the step of performing whitelist verification on the login link source to obtain the whitelist verification result includes:

[0224] Obtain the first identifier information of the login link source, the second identifier information of the remote host, and the third identifier information of the user;

[0225] The whitelist verification is performed based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result.

[0226] A8. The method as described in 7, wherein the whitelist verification based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result includes:

[0227] A preset whitelist is queried based on the first identifier information, the second identifier information, and the third identifier information. The preset whitelist includes multiple combinations of identifier information.

[0228] If the preset whitelist contains a combination of the first identifier information, the second identifier information, and the identifier information corresponding to the third identifier information, the whitelist verification result is determined to be that no login interception is required.

[0229] If the combination of the first identifier information, the second identifier information, and the third identifier information does not exist in the preset whitelist, the whitelist verification result is determined to be that login interception is required.

[0230] A9. The method described in 6, wherein the remote login control of the remote host based on the whitelist verification result includes:

[0231] If the whitelist verification result indicates that login interception is not required, a control command is sent to the remote host so that the remote host performs the corresponding operation based on the control command.

[0232] If the whitelist verification result indicates that login interception is required, the remote login connection with the remote host is interrupted.

[0233] A10. As described in 9, wherein if the whitelist verification result indicates that login interception is required, the remote login connection with the remote host is interrupted, including...

[0234] If the whitelist verification result indicates that login interception is required, an exit command is sent to the remote host to cause the remote host to perform an exit operation and terminate the remote login connection with the remote host.

[0235] The present invention also discloses B11. A remote login control device, the remote login control device comprising:

[0236] The receiving module is used to receive environment variables sent by the bastion host after confirming that a successful remote login connection with the bastion host has been established;

[0237] The sending module is used to establish a remote login connection with a remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source, and provide feedback.

[0238] The control module is used to remotely control login to the remote host based on the login link source fed back by the remote host.

[0239] B12. The apparatus as described in 11, wherein the control module is further configured to send a control command to the remote host when the login link source reported by the remote host is the bastion host, so that the remote host performs a corresponding operation based on the control command;

[0240] If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result, and perform remote login control on the remote host based on the whitelist verification result.

[0241] B13. The apparatus as described in 12, wherein the control module is further configured to receive remote control information sent by the bastion host when the login link source reported by the remote host is the bastion host;

[0242] The operation object and operation content are determined based on the remote control information;

[0243] Control commands are generated based on the operation object and operation content, and then sent to the remote host.

[0244] B14. The apparatus as described in 13, wherein the control module is further configured to acquire operating system information of a remote host;

[0245] The corresponding control instruction format is determined based on the operating system information;

[0246] The operation object and the operation content are encoded based on the control instruction format to generate control instructions adapted to the remote host.

[0247] Send the control command to the remote host.

[0248] B15. The apparatus as described in 14, wherein the control module is further configured to acquire an encryption key and an initialization vector;

[0249] The control command is encrypted using the encryption key to obtain encrypted ciphertext.

[0250] The encrypted ciphertext and the initialization vector are merged and encoded to obtain the encrypted control command;

[0251] Send the encrypted control command to the remote host.

[0252] B16. The apparatus as described in 12, wherein the control module is further configured to perform whitelist verification on the login link source when the login link source reported by the remote host is not the bastion host, and obtain a whitelist verification result;

[0253] Remote login control is performed on the remote host based on the whitelist verification results.

[0254] B17. The apparatus as described in 16, wherein the control module is further configured to acquire the first identification information of the login link source, the second identification information of the remote host, and the third identification information of the user;

[0255] The whitelist verification is performed based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result.

[0256] B18. The apparatus as described in 17, wherein the control module is further configured to query a preset whitelist based on the first identification information, the second identification information and the third identification information, wherein the preset whitelist includes multiple combinations of identification information;

[0257] If the preset whitelist contains a combination of the first identifier information, the second identifier information, and the third identifier information, the whitelist verification result is determined to be that no login interception is required.

[0258] If the combination of the first identifier information, the second identifier information, and the third identifier information does not exist in the preset whitelist, the whitelist verification result is determined to be that login interception is required.

[0259] The present invention also discloses C19. A remote login control device, the remote login control device comprising: a memory, a processor, and a remote login control program stored in the memory and executable on the processor, the remote login control program being configured to implement the remote login control method as described above.

[0260] The present invention also discloses D20. A storage medium storing a remote login control program, wherein the remote login control program, when executed by a processor, implements the remote login control method as described above.

Claims

1. A remote login control method, characterized in that, Applied to a control host, the method includes: After confirming a successful remote login connection with the bastion host, receive environment variables sent by the bastion host; Establish a remote login connection with the remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source and provide feedback; Remote login control is performed on the remote host based on the login link source fed back by the remote host.

2. The method as described in claim 1, characterized in that, The remote login control of the remote host based on the login link source fed back by the remote host includes: If the login link source reported by the remote host is the bastion host, a control command is sent to the remote host so that the remote host performs corresponding operations based on the control command. If the login link source reported by the remote host is not the bastion host, obtain the whitelist verification result, and perform remote login control on the remote host based on the whitelist verification result.

3. The method as described in claim 2, characterized in that, When the login link origin reported by the remote host is the bastion host, the control command sent to the remote host includes: If the login link source reported by the remote host is the bastion host, then receive the remote control information sent by the bastion host; The operation object and operation content are determined based on the remote control information; Control commands are generated based on the operation object and operation content, and then sent to the remote host.

4. The method as described in claim 3, characterized in that, The step of generating control commands based on the operation object and operation content, and sending the control commands to the remote host, includes: Obtain operating system information from a remote host; The corresponding control instruction format is determined based on the operating system information; The operation object and the operation content are encoded based on the control instruction format to generate control instructions adapted to the remote host. Send the control command to the remote host.

5. The method as described in claim 4, characterized in that, Sending the control command to the remote host includes: Obtain the encryption key and initialization vector; The control command is encrypted using the encryption key to obtain encrypted ciphertext. The encrypted ciphertext and the initialization vector are merged and encoded to obtain the encrypted control command; Send the encrypted control command to the remote host.

6. The method as described in claim 2, characterized in that, When the login link source reported by the remote host is not the bastion host, obtaining the whitelist verification result and performing remote login control on the remote host based on the whitelist verification result includes: If the login link source reported by the remote host is not the bastion host, the login link source is verified by a whitelist to obtain the whitelist verification result. Remote login control is performed on the remote host based on the whitelist verification results.

7. The method as described in claim 6, characterized in that, The step of performing whitelist verification on the login link source to obtain the whitelist verification result includes: Obtain the first identifier information of the login link source, the second identifier information of the remote host, and the third identifier information of the user; The whitelist verification is performed based on the first identifier information, the second identifier information, and the third identifier information to obtain the whitelist verification result.

8. A remote login control device, characterized in that, The remote login control device includes: The receiving module is used to receive environment variables sent by the bastion host after confirming that a successful remote login connection with the bastion host has been established; The sending module is used to establish a remote login connection with a remote host and send the environment variables to the remote host so that the remote host can perform login authentication based on the environment variables, obtain the login link source, and provide feedback. The control module is used to remotely control login to the remote host based on the login link source fed back by the remote host.

9. A remote login control device, characterized in that, The remote login control device includes: a memory, a processor, and a remote login control program stored in the memory and executable on the processor, the remote login control program being configured to implement the remote login control method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a remote login control program, which, when executed by a processor, implements the remote login control method as described in any one of claims 1 to 7.

Images