Function FindRecentSuccessLoginNotInWhitelist

agent/utils/alert/alert.go:453–490

(minutes int, whitelist []string)

}

func FindRecentSuccessLoginNotInWhitelist(minutes int, whitelist []string) ([]string, error) {
	lines, err := grepSSHLog([]string{"Accepted password", "Accepted publickey"})
	if err != nil {
		return nil, err
	}

	thresholdTime := time.Now().Add(-time.Duration(minutes) * time.Minute)
	var abnormalLogins []string

	whitelistMap := make(map[string]struct{}, len(whitelist))
	for _, ip := range whitelist {
		whitelistMap[ip] = struct{}{}
	}

	ipRegex := re.GetRegex(re.AlertIPPattern)

	for _, line := range lines {
		line = strings.TrimSpace(line)
		if line == "" {
			continue
		}

		t, err := parseLogTime(line)
		if err != nil || t.Before(thresholdTime) {
			continue
		}

		match := ipRegex.FindStringSubmatch(line)
		if len(match) >= 2 {
			ip := match[1]
			if _, ok := whitelistMap[ip]; !ok {
				abnormalLogins = append(abnormalLogins, fmt.Sprintf("%s-%s", ip, t.Format("2006-01-02 15:04:05")))
			}
		}
	}

	return abnormalLogins, nil
}

func findGrepPath() (string, error) {
	path, err := exec.LookPath("grep")