脚本实现SSH登录邮件报警

登录保护是一个非常重要的环节，下面通过图文并茂的方式给大家详细讲解下：

前两天@cyy 给我发了一个图

然后我就想到ushq的ssh登录app通知功能，然后就像如果把这个部署到自用的服务器就好了。至少多一层安全系数。

首先要感谢@legion 帮忙搞定了几个错误以及搞定了geo2ip的json转换。 (p.s.此人为自动化运维大神级人物，现任职于德国一数据统计企业。)

当然，我和他相比我就是战五渣了...大家一定要多向 @legion 学习啊~~

说下需要做的准备：

sendmail或者postfix
php
bash
centos/debian/ubuntu
若你的生产环境中没有php sendmail postfix等组件，请移步:

@legion: linux之使用shell脚本实现ssh登录报警

参考文件

首先是报警脚本文件

shell

#!/bin/sh
#########################################################################
# file name: login-alert.sh
# author: jason
# email: master#deamwork.com
# created time: tue jul 21 2015 21:23:16 pm cst 
#########################################################################

#require jq
#wget http://stedolan.github.io/jq/download/linux64/jq -o /usr/local/bin/jq
#chmod +x /usr/local/bin/jq

#if error, please # following one
#path=/usr/local/nginx/sbin:/usr/local/php/bin:/usr/local/mysql/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin

#geo2ip by legion(http://www.dwhd.org/)
eval `curl -s "http://ip.taobao.com/service/getipinfo.php?ip=${ssh_client%% *}" | jq . | awk -f':|[ ]+|"' '{if($3~/^(country|area|region|city|isp)$/){print $3"="$7}}'`

#html mail content
cat >> mail-no-base64.html <<eof
#请自行准备邮件模板，以下为可能用到的变量
#输出主机名 `hostname`
#输出登录端口 ${ssh_client##* }
#输出登录来源ip ${ssh_client%% *}
#输出ip地址归属地 {country}_${area}_${region}_${city}_${isp}
#输出登录时间 `date`
eof

#base64 encoding
base64 mail-no-base64.html > mail-base64.html

#使用sendmail
#sendmail -t >/dev/null 2>&1 <<eof
#to:[e-mail]
#from:example<[e-mail]>
#subject:[`hostname`]服务器登录告警

#`cat mail-no-base64.html`

#eof

#使用postfix
#cat >> mail.php <<eof
#<?php
#\$to = "[e-mail]";
#\$subject = "[`hostname`]服务器登录告警";
#\$message = "`cat mail-base64.html`";
#\$headers = "mime-version: 1.0" . "\r\n";
#\$headers .= "content-type: text/html; charset=\"utf-8\"" . "\r\n";
#\$headers .= "content-transfer-encoding: base64" . "\r\n";
#\$headers .= 'from: example<[e-mail]>' . "\r\n";
#\$send = mail(\$to,\$subject,\$message,\$headers);
#if(\$send){echo 'mail send successful.';}else{echo 'failed.';}
#?>
#eof

#使用 smtp (require smtp-class.php)
cat >> mail.php <<eof
<?php
require("smtp-class.php"); 
\$smtpserver = "smtp.example.com";
\$smtpserverport = 25;
\$smtpusermail = "[e-mail]";
\$smtpemailto = "[e-mail]";
\$smtpuser = "example";
\$smtppass = "password";
\$mailsubject = "[`hostname`]服务器登录告警";
\$mailbody = "`cat mail-base64.html`";
\$mailtype = "html";
\$smtp = new smtp(\$smtpserver,\$smtpserverport,true,\$smtpuser,\$smtppass);
\$smtp->debug = true;
\$smtp->sendmail(\$smtpemailto, \$smtpusermail, \$mailsubject, \$mailbody, \$mailtype); 
?>
eof
php mail.php
yes y | rm mail-no-base64.html mail-base64.html mail.php

然后是如何触发这个脚本：

shell

echo "screen -fa -d -m -s wl /etc/login-alert.sh" >> /etc/profile

用这种方法， 新开终端或者复制终端都会触发报警

如果使用smtp方式，请保存以下文件为smtp-class.php

php

<?php
class smtp
{
  /* public variables */
  var $smtp_port;
  var $time_out;
  var $host_name;
  var $log_file;
  var $relay_host;
  var $debug;
  var $auth;
  var $user;
  var $pass;

  /* private variables */ 
  var $sock;

  /* constractor */
  function smtp($relay_host = "", $smtp_port = 25,$auth = false,$user,$pass)
  {
    $this->debug = false;
    $this->smtp_port = $smtp_port;
    $this->relay_host = $relay_host;
    $this->time_out = 30; //is used in fsockopen() 
    $this->auth = $auth;//auth
    $this->user = $user;
    $this->pass = $pass;
    $this->host_name = "localhost"; //is used in helo command 
    $this->log_file = "";
    $this->sock = false;
}

  /* main function */
  function sendmail($to, $from, $subject = "", $body = "", $mailtype, $cc = "", $bcc = "", $additional_headers = "")
  {
    $mail_from = $this->get_address($this->strip_comment($from));
    $body = ereg_replace("(^|(\r\n))(\.)", "\1.\3", $body);
    $header .= "mime-version:1.0\r\n";
    if($mailtype=="html")
    {
      $header .= "content-type: text/html; charset=\"utf-8\"" . "\r\n";
      $header .= "content-transfer-encoding: base64" . "\r\n";
    }
    $header .= "to: ".$to."\r\n";
    if ($cc != "") 
    {
      $header .= "cc: ".$cc."\r\n";
    }
    $header .= "from: $from<".$from.">\r\n";
    $header .= "subject: ".$subject."\r\n";
    $header .= $additional_headers;
    $header .= "date: ".date("r")."\r\n";
    $header .= "x-mailer:by tianhaitech (php/".phpversion().")\r\n";
    list($msec, $sec) = explode(" ", microtime());
    $header .= "message-id: <".date("ymdhis", $sec).".".($msec*1000000).".".$mail_from.">\r\n";
    $to = explode(",", $this->strip_comment($to));

    if ($cc != "") 
    {
      $to = array_merge($to, explode(",", $this->strip_comment($cc)));
      }
    if ($bcc != "") 
    {
      $to = array_merge($to, explode(",", $this->strip_comment($bcc)));
    }
    $sent = true;
    foreach ($to as $rcpt_to) 
    {
      $rcpt_to = $this->get_address($rcpt_to);
      if (!$this->smtp_sockopen($rcpt_to)) 
      {
        $this->log_write("error: cannot send email to ".$rcpt_to."\n");
        $sent = false;
        continue;
      }
      if ($this->smtp_send($this->host_name, $mail_from, $rcpt_to, $header, $body)) 
      {
        $this->log_write("e-mail has been sent to <".$rcpt_to.">\n");
      } 
      else 
      {
        $this->log_write("error: cannot send email to <".$rcpt_to.">\n");
        $sent = false;
      }
      fclose($this->sock);
      $this->log_write("disconnected from remote host\n");
    }
    return $sent;
  }

  /* private functions */
  function smtp_send($helo, $from, $to, $header, $body = "")
  {
    if (!$this->smtp_putcmd("helo", $helo)) 
    {
      return $this->smtp_error("sending helo command");
    }

    #auth
    if($this->auth)
    {
      if (!$this->smtp_putcmd("auth login", base64_encode($this->user))) 
      {
        return $this->smtp_error("sending helo command");
      }
      if (!$this->smtp_putcmd("", base64_encode($this->pass))) 
      {
        return $this->smtp_error("sending helo command");
      }
    }
    if (!$this->smtp_putcmd("mail", "from:<".$from.">")) 
    {
      return $this->smtp_error("sending mail from command");
    }
    if (!$this->smtp_putcmd("rcpt", "to:<".$to.">")) 
    {
      return $this->smtp_error("sending rcpt to command");
    }
    if (!$this->smtp_putcmd("data"))
    {
      return $this->smtp_error("sending data command");
    }
    if (!$this->smtp_message($header, $body)) 
    {
      return $this->smtp_error("sending message");
    }
    if (!$this->smtp_eom())
    {
      return $this->smtp_error("sending <cr><lf>.<cr><lf> [eom]");
    }
    if (!$this->smtp_putcmd("quit")) 
    {
      return $this->smtp_error("sending quit command");
    }
    return true;
  }

  function smtp_sockopen($address)
  {
    if ($this->relay_host == "") 
    {
      return $this->smtp_sockopen_mx($address);
    } 
    else
    {
      return $this->smtp_sockopen_relay();
    }
  }

  function smtp_sockopen_relay()
  {
    $this->log_write("trying to ".$this->relay_host.":".$this->smtp_port."\n");
    $this->sock = @fsockopen($this->relay_host, $this->smtp_port, $errno, $errstr, $this->time_out);
    if (!($this->sock && $this->smtp_ok())) 
    {
      $this->log_write("error: cannot connenct to relay host ".$this->relay_host."\n");
      $this->log_write("error: ".$errstr." (".$errno.")\n");
      return false;
    }
    $this->log_write("connected to relay host ".$this->relay_host."\n");
    return true;;
  }

  function smtp_sockopen_mx($address)
  {
    $domain = ereg_replace("^.+@([^@]+)$", "\1", $address);
    if (!@getmxrr($domain, $mxhosts)) 
    {
      $this->log_write("error: cannot resolve mx \"".$domain."\"\n");
      return false;
    }
    foreach ($mxhosts as $host) 
    {
      $this->log_write("trying to ".$host.":".$this->smtp_port."\n");
      $this->sock = @fsockopen($host, $this->smtp_port, $errno, $errstr, $this->time_out);
      if (!($this->sock && $this->smtp_ok())) 
      {
        $this->log_write("warning: cannot connect to mx host ".$host."\n");
        $this->log_write("error: ".$errstr." (".$errno.")\n");
        continue;
      }
      $this->log_write("connected to mx host ".$host."\n");
      return true;
    }
    $this->log_write("error: cannot connect to any mx hosts (".implode(", ", $mxhosts).")\n");
    return false;
  }

  function smtp_message($header, $body)
  {
    fputs($this->sock, $header."\r\n".$body);
    $this->smtp_debug("> ".str_replace("\r\n", "\n"."> ", $header."\n> ".$body."\n> "));
    return true;
  }

  function smtp_eom()
  {
    fputs($this->sock, "\r\n.\r\n");
    $this->smtp_debug(". [eom]\n");
    return $this->smtp_ok();
  }

  function smtp_ok()
  {
    $response = str_replace("\r\n", "", fgets($this->sock, 512));
    $this->smtp_debug($response."\n");
    if (!ereg("^[23]", $response)) 
    {
      fputs($this->sock, "quit\r\n");
      fgets($this->sock, 512);
      $this->log_write("error: remote host returned \"".$response."\"\n");
      return false;
    }
    return true;
  }

  function smtp_putcmd($cmd, $arg = "")
  {
    if ($arg != "") 
    {
      if($cmd=="") 
      {
        $cmd = $arg;
      }
      else
      {
        $cmd = $cmd." ".$arg;
      }
    }
    fputs($this->sock, $cmd."\r\n");
    $this->smtp_debug("> ".$cmd."\n");
    return $this->smtp_ok();
  }

  function smtp_error($string)
  {
    $this->log_write("error: error occurred while ".$string.".\n");
    return false;
  }

  function log_write($message)
  {
    $this->smtp_debug($message);
    if ($this->log_file == "")
    {
      return true;
    }
    $message = date("m d h:i:s ").get_current_user()."[".getmypid()."]: ".$message;
    if (!@file_exists($this->log_file) || !($fp = @fopen($this->log_file, "a"))) 
    {
      $this->smtp_debug("warning: cannot open log file \"".$this->log_file."\"\n");
      return false;;
    }
    flock($fp, lock_ex);
    fputs($fp, $message);
    fclose($fp);
    return true;
  }

  function strip_comment($address)
  {
    $comment = "\([^()]*\)";
    while (ereg($comment, $address)) 
    {
      $address = ereg_replace($comment, "", $address);
    }
    return $address;
  }

  function get_address($address)
  {
    $address = ereg_replace("([ \t\r\n])+", "", $address);
    $address = ereg_replace("^.*<(.+)>.*$", "\1", $address);
    return $address;
  }

  function smtp_debug($message)
  {
    if ($this->debug) 
    {
      echo $message;
    }
  }

}

?>
实现效果：

有需要的朋友可以参考下，希望大家能够喜欢。