Skip to content
Snippets Groups Projects
Verified Commit e1d1ee42 authored by Michal 'vorner' Vaner's avatar Michal 'vorner' Vaner
Browse files

Archivist: Store ssh remote port

parent 1892b116
1 merge request!12Store honeypot remote port into the archive
......@@ -471,7 +471,7 @@ if (fork == 0) {
my $source = connect_db 'source';
my $destination = connect_db 'destination';
my %sessions;
my $get_commands = $source->prepare('SELECT ssh_commands.id, start_time, end_time, login, password, remote, ts, success, command FROM ssh_commands JOIN ssh_sessions ON ssh_commands.session_id = ssh_sessions.id WHERE NOT archived');
my $get_commands = $source->prepare('SELECT ssh_commands.id, start_time, end_time, login, password, remote, remote_port, ts, success, command FROM ssh_commands JOIN ssh_sessions ON ssh_commands.session_id = ssh_sessions.id WHERE NOT archived');
my $mark_command = $source->prepare('UPDATE ssh_commands SET archived = TRUE WHERE id = ?');
my $store_command = $destination->prepare('INSERT INTO ssh_commands (session, timestamp, success, command) VALUES (?, ?, ?, ?)');
# Make sure the params are considered the correct type.
......@@ -483,13 +483,13 @@ if (fork == 0) {
$get_session->bind_param(2, undef, { pg_type => DBD::Pg::PG_BYTEA });
$get_session->bind_param(3, undef, { pg_type => DBD::Pg::PG_BYTEA });
my $update_session = $destination->prepare('UPDATE ssh_sessions SET end_time = ? WHERE id = ?');
my $store_session = $destination->prepare('INSERT INTO ssh_sessions (start_time, end_time, login, password, remote) VALUES (?, ?, ?, ?, ?) RETURNING id');
my $store_session = $destination->prepare('INSERT INTO ssh_sessions (start_time, end_time, login, password, remote, remote_port) VALUES (?, ?, ?, ?, ?, ?) RETURNING id');
$store_session->bind_param(3, undef, { pg_type => DBD::Pg::PG_BYTEA });
$store_session->bind_param(4, undef, { pg_type => DBD::Pg::PG_BYTEA });
$get_commands->execute;
my $count_commands = 0;
my $count_sessions = 0;
while (my ($id, $start, $end, $login, $password, $remote, $time, $success, $command) = $get_commands->fetchrow_array) {
while (my ($id, $start, $end, $login, $password, $remote, $remote_port, $time, $success, $command) = $get_commands->fetchrow_array) {
my $sid = $sessions{$start}->{$login}->{$password};
if (not defined $sid) {
$get_session->execute($start, $login, $password);
......@@ -497,7 +497,7 @@ if (fork == 0) {
$sid = $id;
$update_session->execute($end, $sid) if ($send ne $end);
} else {
$store_session->execute($start, $end, $login, $password, $remote);
$store_session->execute($start, $end, $login, $password, $remote, $remote_port);
($sid) = $store_session->fetchrow_array;
$count_sessions ++;
}
......
......@@ -364,7 +364,10 @@ CREATE TABLE ssh_sessions (
login BYTEA NOT NULL,
password BYTEA NOT NULL,
remote INET,
UNIQUE(start_time, login, password)
remote_port INT,
UNIQUE(start_time, login, password),
CHECK(remote_port > 0),
CHECK(remote_port <= 65535)
);
CREATE SEQUENCE ssh_session_ids OWNED BY ssh_sessions.id;
ALTER TABLE ssh_sessions ALTER COLUMN id SET DEFAULT NEXTVAL('ssh_session_ids');
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment