Admin MPCZ
16315ab3b5
- SSH key et user lus depuis app_secrets (ssh_key_file, ssh_user) - Ajout .mpcz.fr dans DNS_SUFFIXES - Auto-detect Ed25519/RSA/ECDSA - Fallback password depuis secrets
268 lines
12 KiB
Python
268 lines
12 KiB
Python
"""Service audit temps reel — lance des checks SSH et retourne les resultats"""
|
|
import socket
|
|
import json
|
|
import re
|
|
from datetime import datetime
|
|
from sqlalchemy import text
|
|
|
|
try:
|
|
import paramiko
|
|
PARAMIKO_OK = True
|
|
except ImportError:
|
|
PARAMIKO_OK = False
|
|
|
|
SSH_KEY_DEFAULT = "/opt/patchcenter/keys/id_ed25519"
|
|
SSH_USER_DEFAULT = "root"
|
|
SSH_TIMEOUT = 12
|
|
DNS_SUFFIXES = ["", ".mpcz.fr", ".sanef.groupe", ".sanef-rec.fr", ".sanef.fr"]
|
|
|
|
|
|
def _get_ssh_settings():
|
|
"""Lit les settings SSH depuis app_secrets dans la DB."""
|
|
try:
|
|
from .secrets_service import get_secret
|
|
from ..database import SessionLocal
|
|
db = SessionLocal()
|
|
key_path = get_secret(db, "ssh_key_file") or SSH_KEY_DEFAULT
|
|
user = get_secret(db, "ssh_user") or SSH_USER_DEFAULT
|
|
db.close()
|
|
return key_path, user
|
|
except Exception:
|
|
return SSH_KEY_DEFAULT, SSH_USER_DEFAULT
|
|
|
|
# Commandes d'audit (simplifiees pour le temps reel)
|
|
AUDIT_CMDS = {
|
|
"os_release": "cat /etc/redhat-release 2>/dev/null || head -1 /etc/os-release 2>/dev/null",
|
|
"kernel": "uname -r",
|
|
"uptime": "uptime -p 2>/dev/null || uptime",
|
|
"selinux": "getenforce 2>/dev/null || echo N/A",
|
|
"disk_space": "df -h --output=target,size,avail,pcent 2>/dev/null | grep -vE '^(tmpfs|devtmpfs|Filesystem)' | sort",
|
|
"apps_installed": "rpm -qa --qf '%{NAME} %{VERSION}\\n' 2>/dev/null | grep -iE 'tomcat|java|jdk|nginx|httpd|haproxy|docker|podman|postgresql|postgres|mysql|mariadb|mongodb|oracle|redis|elasticsearch|splunk|centreon|qualys' | sort -u",
|
|
"services_running": "systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | grep -vE '(auditd|chronyd|crond|dbus|firewalld|getty|irqbalance|kdump|lvm2|NetworkManager|polkit|postfix|rsyslog|sshd|sssd|systemd|tuned|user@)' | awk '{print $1}' | sed 's/.service//' | sort",
|
|
"running_not_enabled": "comm -23 <(systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | grep -vE '(auditd|chronyd|crond|dbus|firewalld|getty|irqbalance|kdump|lvm2|NetworkManager|polkit|postfix|rsyslog|sshd|sssd|systemd|tuned|user@)' | awk '{print $1}' | sed 's/.service//' | sort) <(systemctl list-unit-files --type=service --state=enabled --no-pager --no-legend 2>/dev/null | awk '{print $1}' | sed 's/.service//' | sort) 2>/dev/null || echo none",
|
|
"listening_ports": "ss -tlnp 2>/dev/null | grep LISTEN | grep -vE ':22 |:111 |:323 ' | awk '{print $4, $6}' | sort",
|
|
"db_detect": "for svc in postgresql mariadbd mysqld mongod redis-server; do state=$(systemctl is-active $svc 2>/dev/null); [ \"$state\" = \"active\" ] && echo \"$svc:active\"; done; pgrep -x ora_pmon >/dev/null 2>&1 && echo 'oracle:active' || true",
|
|
"cluster_detect": "(which pcs 2>/dev/null && pcs status 2>/dev/null | head -3) || (test -f /etc/corosync/corosync.conf && echo 'corosync:present') || echo 'no_cluster'",
|
|
"containers": "if which podman >/dev/null 2>&1; then USERS=$(ps aux 2>/dev/null | grep -E 'conmon|podman' | grep -v grep | awk '{print $1}' | sort -u); for U in $USERS; do echo \"=== podman@$U ===\"; su - $U -c 'podman ps -a --format \"table {{.Names}} {{.Status}}\"' 2>/dev/null; done; fi; if which docker >/dev/null 2>&1; then docker ps -a --format 'table {{.Names}} {{.Status}}' 2>/dev/null; fi",
|
|
"agents": "for svc in qualys-cloud-agent sentinelone zabbix-agent; do state=$(systemctl is-active $svc 2>/dev/null); [ \"$state\" = \"active\" ] && echo \"$svc:$state\"; done",
|
|
"failed_services": "systemctl list-units --type=service --state=failed --no-pager --no-legend 2>/dev/null | awk '{print $2}' | head -10 || echo none",
|
|
"satellite": "subscription-manager identity 2>/dev/null | grep -i 'org\\|server' || echo 'not_registered'",
|
|
}
|
|
|
|
BANNER_FILTERS = [
|
|
"GROUPE SANEF", "propriété du Groupe", "accèderait", "emprisonnement",
|
|
"Article 323", "code pénal", "Authorized uses only", "CyberArk",
|
|
"This session", "session is being",
|
|
]
|
|
|
|
|
|
def _resolve(hostname):
|
|
for suffix in DNS_SUFFIXES:
|
|
target = hostname + suffix
|
|
try:
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.settimeout(5)
|
|
r = sock.connect_ex((target, 22))
|
|
sock.close()
|
|
if r == 0:
|
|
return target
|
|
except Exception:
|
|
continue
|
|
return None
|
|
|
|
|
|
def _connect(target):
|
|
if not PARAMIKO_OK:
|
|
return None
|
|
import os
|
|
|
|
ssh_key, ssh_user = _get_ssh_settings()
|
|
|
|
# 1. Essai clé SSH depuis settings
|
|
if os.path.exists(ssh_key):
|
|
for loader in [paramiko.Ed25519Key.from_private_key_file, paramiko.RSAKey.from_private_key_file, paramiko.ECDSAKey.from_private_key_file]:
|
|
try:
|
|
key = loader(ssh_key)
|
|
client = paramiko.SSHClient()
|
|
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
client.connect(target, port=22, username=ssh_user, pkey=key,
|
|
timeout=SSH_TIMEOUT, look_for_keys=False, allow_agent=False)
|
|
return client
|
|
except Exception:
|
|
continue
|
|
|
|
# 2. Fallback mot de passe depuis les settings
|
|
try:
|
|
from .secrets_service import get_secret
|
|
from ..database import SessionLocal
|
|
db = SessionLocal()
|
|
pwd_user = get_secret(db, "ssh_pwd_default_user") or ssh_user
|
|
pwd_pass = get_secret(db, "ssh_pwd_default_pass") or ""
|
|
db.close()
|
|
if pwd_pass:
|
|
client = paramiko.SSHClient()
|
|
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
client.connect(target, port=22, username=pwd_user, password=pwd_pass,
|
|
timeout=SSH_TIMEOUT, look_for_keys=False, allow_agent=False)
|
|
return client
|
|
except Exception:
|
|
pass
|
|
|
|
return None
|
|
|
|
|
|
def _run(client, cmd):
|
|
try:
|
|
# Tester si on est déjà root ou si on a besoin de sudo
|
|
_, stdout, _ = client.exec_command("id -u", timeout=5)
|
|
uid = stdout.read().decode().strip()
|
|
if uid == "0":
|
|
full = cmd # Déjà root, pas besoin de sudo
|
|
else:
|
|
escaped = cmd.replace("'", "'\"'\"'")
|
|
full = f"sudo bash -c '{escaped}'"
|
|
_, stdout, stderr = client.exec_command(full, timeout=15)
|
|
out = stdout.read().decode("utf-8", errors="replace").strip()
|
|
err = stderr.read().decode("utf-8", errors="replace").strip()
|
|
result = out if out else err
|
|
lines = [l for l in result.splitlines() if not any(b in l for b in BANNER_FILTERS) and l.strip()]
|
|
return "\n".join(lines).strip()
|
|
except Exception as e:
|
|
return f"ERROR: {e}"
|
|
|
|
|
|
def audit_single_server(hostname):
|
|
"""Audite un serveur et retourne un dict de resultats"""
|
|
result = {
|
|
"hostname": hostname,
|
|
"audit_date": datetime.now().strftime("%Y-%m-%d %H:%M"),
|
|
"status": "PENDING",
|
|
}
|
|
|
|
target = _resolve(hostname)
|
|
if not target:
|
|
result["status"] = "CONNECTION_FAILED"
|
|
result["connection_method"] = f"DNS: aucun suffixe résolu ({hostname})"
|
|
result["resolved_fqdn"] = None
|
|
return result
|
|
|
|
result["resolved_fqdn"] = target
|
|
client = _connect(target)
|
|
if not client:
|
|
result["status"] = "CONNECTION_FAILED"
|
|
result["connection_method"] = f"SSH: connexion refusée ({target})"
|
|
return result
|
|
|
|
result["status"] = "OK"
|
|
ssh_key, ssh_user = _get_ssh_settings()
|
|
result["connection_method"] = f"ssh_key ({ssh_user}@{target})"
|
|
|
|
for key, cmd in AUDIT_CMDS.items():
|
|
result[key] = _run(client, cmd)
|
|
|
|
try:
|
|
client.close()
|
|
except Exception:
|
|
pass
|
|
|
|
# Post-traitement
|
|
agents = result.get("agents", "")
|
|
result["qualys_active"] = "qualys" in agents and "active" in agents
|
|
result["sentinelone_active"] = "sentinelone" in agents and "active" in agents
|
|
result["disk_alert"] = False
|
|
for line in (result.get("disk_space") or "").split("\n"):
|
|
parts = line.split()
|
|
pcts = [p for p in parts if "%" in p]
|
|
if pcts:
|
|
try:
|
|
pct = int(pcts[0].replace("%", ""))
|
|
if pct >= 90:
|
|
result["disk_alert"] = True
|
|
except ValueError:
|
|
pass
|
|
|
|
return result
|
|
|
|
|
|
def audit_servers_list(hostnames):
|
|
"""Audite une liste de serveurs"""
|
|
results = []
|
|
for hn in hostnames:
|
|
r = audit_single_server(hn.strip())
|
|
results.append(r)
|
|
return results
|
|
|
|
|
|
def save_audit_to_db(db, results):
|
|
"""Sauvegarde/met a jour les resultats d'audit en base"""
|
|
updated = 0
|
|
inserted = 0
|
|
for r in results:
|
|
hostname = r.get("hostname", "")
|
|
if not hostname:
|
|
continue
|
|
|
|
# Trouver server_id
|
|
srv = db.execute(text("SELECT id FROM servers WHERE LOWER(hostname) = LOWER(:h)"),
|
|
{"h": hostname.split(".")[0]}).fetchone()
|
|
server_id = srv.id if srv else None
|
|
|
|
audit_date = datetime.now()
|
|
agents = r.get("agents", "")
|
|
|
|
# Upsert
|
|
existing = db.execute(text(
|
|
"SELECT id FROM server_audit WHERE server_id = :sid AND server_id IS NOT NULL"
|
|
), {"sid": server_id}).fetchone() if server_id else None
|
|
|
|
if existing:
|
|
db.execute(text("""
|
|
UPDATE server_audit SET
|
|
status = :st, connection_method = :cm, resolved_fqdn = :rf,
|
|
os_release = :os, kernel = :k, uptime = :up, selinux = :se,
|
|
disk_detail = :dd, disk_alert = :da,
|
|
apps_installed = :ai, services_running = :sr,
|
|
running_not_enabled = :rne, listening_ports = :lp,
|
|
db_detected = :db, cluster_detected = :cl, containers = :co,
|
|
agents = :ag, qualys_active = :qa, sentinelone_active = :s1,
|
|
failed_services = :fs, audit_date = :ad
|
|
WHERE id = :id
|
|
"""), {
|
|
"id": existing.id, "st": r.get("status"), "cm": r.get("connection_method"),
|
|
"rf": r.get("resolved_fqdn"), "os": r.get("os_release"), "k": r.get("kernel"),
|
|
"up": r.get("uptime"), "se": r.get("selinux"), "dd": r.get("disk_space"),
|
|
"da": r.get("disk_alert", False), "ai": r.get("apps_installed"),
|
|
"sr": r.get("services_running"), "rne": r.get("running_not_enabled"),
|
|
"lp": r.get("listening_ports"), "db": r.get("db_detect"),
|
|
"cl": r.get("cluster_detect"), "co": r.get("containers"),
|
|
"ag": agents, "qa": r.get("qualys_active", False),
|
|
"s1": r.get("sentinelone_active", False), "fs": r.get("failed_services"),
|
|
"ad": audit_date,
|
|
})
|
|
updated += 1
|
|
else:
|
|
db.execute(text("""
|
|
INSERT INTO server_audit (server_id, hostname, audit_date, status, connection_method,
|
|
resolved_fqdn, os_release, kernel, uptime, selinux, disk_detail, disk_alert,
|
|
apps_installed, services_running, running_not_enabled, listening_ports,
|
|
db_detected, cluster_detected, containers, agents, qualys_active,
|
|
sentinelone_active, failed_services)
|
|
VALUES (:sid, :hn, :ad, :st, :cm, :rf, :os, :k, :up, :se, :dd, :da,
|
|
:ai, :sr, :rne, :lp, :db, :cl, :co, :ag, :qa, :s1, :fs)
|
|
"""), {
|
|
"sid": server_id, "hn": hostname, "ad": audit_date,
|
|
"st": r.get("status"), "cm": r.get("connection_method"),
|
|
"rf": r.get("resolved_fqdn"), "os": r.get("os_release"), "k": r.get("kernel"),
|
|
"up": r.get("uptime"), "se": r.get("selinux"), "dd": r.get("disk_space"),
|
|
"da": r.get("disk_alert", False), "ai": r.get("apps_installed"),
|
|
"sr": r.get("services_running"), "rne": r.get("running_not_enabled"),
|
|
"lp": r.get("listening_ports"), "db": r.get("db_detect"),
|
|
"cl": r.get("cluster_detect"), "co": r.get("containers"),
|
|
"ag": agents, "qa": r.get("qualys_active", False),
|
|
"s1": r.get("sentinelone_active", False), "fs": r.get("failed_services"),
|
|
})
|
|
inserted += 1
|
|
|
|
db.commit()
|
|
return updated, inserted
|