[已解决]SSH 登录统计 开启fingerprint

可可火山

update:20111213 15:42 一个awk脚本就搞定了，nice。
{ if( $0 ~ /Found matching/ ) { fingerprint[$5]=$13 } else if ( $0 ~ /Accepted publickey/ && $12 != "root" ) { print fingerprint[$5],$12,$14;delete fingerprint[$5] } }



服务器都是用公钥验证的，最近要做个统计，需要把用户从哪里登录，使用那个公钥统计出来。
开启LogLevel从INFO到VERBOSE后在log里就有足够的信息的。

也写了个脚本用来分析log，一般一次登录会有一条 Found matching的ssh key fingerprint记录，随后就有一条Accepted publickey记录提示某个帐号从哪个IP登录，我需要把这两条记录找出来并生成一条记录。

这是我目前的脚本伪代码思路,根据 sshd[xxxxxx]来判断一次登录的，跑了几次发现有问题，检查log文件发现 sshd[xxxxx]的记录是有重复的，我以为至少一天的登录记录里这个id是唯一的。
1） grep Found matching 并得到文件 file1_fingerprint
sshd[23207]: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9
2） grep "Accepted publickey"并得到文件 file1_user_ip
sshd[23207]: user1  10.140.1.107
3) join 一下 file1_fingerprint 和file1_user_ip
55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9 user1  10.140.1.107
正常情况下到了第三步我就已经把ssh用公钥的一次登录提取出来了，用户，登录IP，和使用的公钥。


但是如果那个sshd[xxxxx] id重复的话就会排列组合下导致错误记录

sshd log片段，其中 sshd[23207] 重复，其实是两次登录。但我的代码会有4个结果。

1. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.notice] Failed none for user1 from 10.140.1.107 port 37702 ssh2
   
2. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Found matching DSA key: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9
   
3. Dec 12 03:38:19 server last message repeated 1 time
   
4. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Accepted publickey for user1 from 10.140.1.107 port 37702 ssh2
   
5. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Connection closed by 10.140.1.107
   
6. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Closing connection to 10.140.1.107
   
7. 
   
8. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.notice] Failed none for user2 from 10.228.1.95 port 62189 ssh2
   
9. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Found matching DSA key: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4
   
10. Dec 12 10:29:03 server last message repeated 1 time
    
11. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Accepted publickey for user2 from 10.228.1.95 port 62189 ssh2
    
12. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Connection closed by 10.228.1.95
    
13. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Closing connection to 10.228.1.95
    
14. 
    
15. //step1和step2根据上面log产生的文件
    
16. user@server:~/workspace/sshkey$ cat file1_fingerprint
    
17. sshd[23207]: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9
    
18. sshd[23207]: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4
    
19. You have new mail in /opt/apps/mail/user/mailbox
    
20. user@server:~/workspace/sshkey$ cat file2_user_ip
    
21. sshd[23207]: user1  10.140.1.107
    
22. sshd[23207]: user2  10.228.1.95
    
23. user@server:~/workspace/sshkey$ join file1_fingerprint  file2_user_ip
    
24. sshd[23207]: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9 user1 10.140.1.107
    
25. sshd[23207]: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9 user2 10.228.1.95
    
26. sshd[23207]: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4 user1 10.140.1.107
    
27. sshd[23207]: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4 user2 10.228.1.95
    

复制代码

我期望的结果应该是就两条
sshd[23207]: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9 user1 10.140.1.107
sshd[23207]: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4 user2 10.228.1.95

很明显我在step1和step2 提取的信息不足，或者说处理的方法不对。
昨晚忙了一天头晕脑花，最后查到问题但还没想到方法，今天醒来清醒些。想到个2L提供的方案类似，也是用awk来做。不过逻辑有点不同，但是awk功力不够，还请论坛同志们帮忙，谢先。

代码逻辑
1）awk一行行读入，当碰到“ Found matching”时，保存 Log时间，sshd[id](或者直接存ID)，和fingerprint。
2）awk读到“Accepted publickey”时，稍微做个判断，上次同样sshd[id]的记录的Log时间是否和这次相近，然后把 fingerprint，user，ip打印到文件
3）最后做一次sort 和uniq，这样就得到sshd登录log的 user，fingerprint和IP了

yinyuemi

回复 1# 可可火山

1. awk -v id='23207'  '$0~"sshd\\["id"\\]:"{if(/Found matching/)printf ("sshd["id"]:" FS $NF FS);if(/Accepted publickey/)print $(NF-5) FS $(NF-3)}' LOG
   

复制代码

r2007

写了一大堆没看懂。

楼主把想要的结果贴出来。
zooyo 发表于 2011-12-13 09:20

    shell版白混了呀，猜是本版必备滴基本功。

可可火山

谢谢大家都热情 :wink:

目前觉得用awk来时间比较方便些，不过要加些逻辑，已经把问题又整理了下，

代码逻辑
1）awk一行行读入，当碰到“ Found matching”时，保存 Log时间，sshd[id](或者直接存ID)，和fingerprint。
2）awk读到“Accepted publickey”时，稍微做个判断，上次同样sshd[id]的记录的Log时间是否和这次相近（时间差距大可能是个重复sshd[xxx]记录），然后把 fingerprint，user，ip打印到文件
3）最后做一次sort 和uniq，这样就得到sshd登录log的 user，fingerprint和IP了

可可火山

看了会《sed与awk》，初步确定逻辑，把判断时间部分去掉了，觉得没什么他用处。
root的登录不判断，所以就忽略掉了。
我原来3个step现在只要一步就可以了， script编程真是好玩。 谢谢大家关注

{ if( $0 ~ /Found matching/ ) { fingerprint[$5]=$13 } else if ( $0 ~ /Accepted publickey/ && $12 != "root" ) { print fingerprint[$5],$12,$14;delete fingerprint[$5] } }

1. [user@fingerprint (0)]$cat messages
   
2. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.notice] Failed none for user1 from 10.140.1.107 port 37702 ssh2
   
3. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Found matching DSA key: 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9
   
4. Dec 12 03:38:19 server last message repeated 1 time
   
5. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Accepted publickey for user1 from 10.140.1.107 port 37702 ssh2
   
6. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Connection closed by 10.140.1.107
   
7. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Closing connection to 10.140.1.107
   
8. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.notice] Failed none for root from 10.140.1.107 port 37702 ssh2
   
9. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Found matching DSA key: rr:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9
   
10. Dec 12 03:38:19 server last message repeated 1 time
    
11. Dec 12 03:38:19 server sshd[23207]: [ID 800047 auth.info] Accepted publickey for root from rr.140.1.107 port 37702 ssh2
    
12. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Connection closed by 10.140.1.107
    
13. Dec 12 03:39:46 server sshd[23207]: [ID 800047 auth.info] Closing connection to 10.140.1.107
    
14. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.notice] Failed none for user2 from 10.228.1.95 port 62189 ssh2
    
15. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Found matching DSA key: e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4
    
16. Dec 12 10:29:03 server last message repeated 1 time
    
17. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Accepted publickey for user2 from 10.228.1.95 port 62189 ssh2
    
18. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Connection closed by 10.228.1.95
    
19. Dec 12 10:29:03 server sshd[23207]: [ID 800047 auth.info] Closing connection to 10.228.1.95
    
20. [user@fingerprint (0)]$cat extractlogon.awk
    
21. { if( $0 ~ /Found matching/ ) { fingerprint[$5]=$13 } else if ( $0 ~ /Accepted publickey/ && $12 != "root" ) { print fingerprint[$5],$12,$14;delete fingerprint[$5] } }
    
22. [user@fingerprint (0)]$awk -f extractlogon.awk  messages
    
23. 55:f9:98:93:ff:ff:ff:ff:00:63:bf:7c:19:88:f4:a9 user1 10.140.1.107
    
24. e3:b1:14:e4:b5:ff:ff:ff:ac:68:65:fa:cc:9e:d6:a4 user2 10.228.1.95

复制代码