Improved SSH/FTP/RDP event logs, #3679
Ylian Saint-Hilaire committed
Feb 22, 2022 at 10:56 UTC
4b4419f581ab02ef9c55c5090318868e22efad03
2 files changed
+54
-12
apprelays.js
+46
-8
@@ -61,11 +61,12 @@ module.exports.CreateMstscRelay = function (parent, db, ws, req, args, domain) {
61
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
62
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
63
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
64
- var user = parent.users[obj.cookie.userid];
65
- var username = (user != null) ? user.name : null;
66
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, msgid: 125, msgArgs: [sessionSeconds], msg: "Left Web-RDP session after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBRDP, bytesin: inTraffc, bytesout: outTraffc };
64
+ const user = parent.users[obj.cookie.userid];
65
+ const username = (user != null) ? user.name : null;e
66
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, sessionid: obj.sessionid, msgid: 125, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-RDP session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBRDP, bytesin: inTraffc, bytesout: outTraffc };
67
parent.parent.DispatchEvent(['*', obj.nodeid, obj.cookie.userid, obj.meshid], obj, event);
68
delete obj.startTime;
69
+ delete obj.sessionid;
70
}
71
72
if (obj.wsClient) { obj.wsClient.close(); delete obj.wsClient; }
@@ -140,7 +141,16 @@ module.exports.CreateMstscRelay = function (parent, db, ws, req, args, domain) {
141
}).on('connect', function () {
142
send(['rdp-connect']);
143
if ((typeof obj.infos.options == 'object') && (obj.infos.options.savepass == true)) { saveRdpCredentials(); } // Save the credentials if needed
144
+ obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
145
obj.startTime = Date.now();
146
+
147
+ // Event session start
148
+ try {
149
+ const user = parent.users[obj.cookie.userid];
150
+ const username = (user != null) ? user.name : null;
151
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, sessionid: obj.sessionid, msgid: 150, msgArgs: [obj.sessionid], msg: "Started Web-RDP session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBRDP };
152
+ parent.parent.DispatchEvent(['*', obj.nodeid, obj.cookie.userid, obj.meshid], obj, event);
153
+ } catch (ex) { console.log(ex); }
154
}).on('bitmap', function (bitmap) {
155
try { ws.send(bitmap.data); } catch (ex) { } // Send the bitmap data as binary
156
delete bitmap.data;
@@ -287,11 +297,12 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
297
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
298
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
299
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
290
- var user = parent.users[obj.cookie.userid];
291
- var username = (user != null) ? user.name : null;
292
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, msgid: 123, msgArgs: [sessionSeconds], msg: "Left Web-SSH session after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
300
+ const user = parent.users[obj.cookie.userid];
301
+ const username = (user != null) ? user.name : null;
302
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: obj.cookie.userid, username: username, sessionid: obj.sessionid, msgid: 123, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SSH session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
303
parent.parent.DispatchEvent(['*', obj.nodeid, obj.cookie.userid, obj.meshid], obj, event);
304
delete obj.startTime;
305
+ delete obj.sessionid;
306
}
307
308
if (obj.sshShell) {
@@ -384,8 +395,17 @@ module.exports.CreateSshRelay = function (parent, db, ws, req, args, domain) {
395
obj.sshClient.on('ready', function () { // Authentication was successful.
396
// If requested, save the credentials
397
if (obj.keep === true) saveSshCredentials();
398
+ obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
399
obj.startTime = Date.now();
400
401
+ // Event start of session
402
+ try {
403
+ const user = parent.users[obj.cookie.userid];
404
+ const username = (user != null) ? user.name : null;
405
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 148, msgArgs: [obj.sessionid], msg: "Started Web-SSH session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSSH };
406
+ parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
407
+ } catch (ex) { console.log(ex); }
408
+
409
obj.sshClient.shell(function (err, stream) { // Start a remote shell
410
if (err) { obj.close(); return; }
411
obj.sshShell = stream;
@@ -550,9 +570,10 @@ module.exports.CreateSshTerminalRelay = function (parent, db, ws, req, domain, u
570
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
571
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
572
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
553
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 123, msgArgs: [sessionSeconds], msg: "Left Web-SSH session after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
573
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 123, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SSH session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSSH, bytesin: inTraffc, bytesout: outTraffc };
574
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
575
delete obj.startTime;
576
+ delete obj.sessionid;
577
}
578
579
if (obj.sshShell) {
@@ -641,8 +662,17 @@ module.exports.CreateSshTerminalRelay = function (parent, db, ws, req, domain, u
662
obj.sshClient.on('ready', function () { // Authentication was successful.
663
// If requested, save the credentials
664
if (obj.keep === true) saveSshCredentials();
665
+ obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
666
obj.startTime = Date.now();
667
668
+ try {
669
+ // Event start of session
670
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 148, msgArgs: [obj.sessionid], msg: "Started Web-SSH session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSSH };
671
+ parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
672
+ } catch (ex) {
673
+ console.log(ex);
674
+ }
675
+
676
obj.sshClient.shell(function (err, stream) { // Start a remote shell
677
if (err) { obj.close(); return; }
678
obj.sshShell = stream;
@@ -839,9 +869,10 @@ module.exports.CreateSshFilesRelay = function (parent, db, ws, req, domain, user
869
var inTraffc = obj.ws._socket.bytesRead, outTraffc = obj.ws._socket.bytesWritten;
870
if (obj.wsClient != null) { inTraffc += obj.wsClient._socket.bytesRead; outTraffc += obj.wsClient._socket.bytesWritten; }
871
const sessionSeconds = Math.round((Date.now() - obj.startTime) / 1000);
842
- var event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 124, msgArgs: [sessionSeconds], msg: "Left Web-SFTP session after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSFTP, bytesin: inTraffc, bytesout: outTraffc };
872
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, sessionid: obj.sessionid, msgid: 124, msgArgs: [sessionSeconds, obj.sessionid], msg: "Left Web-SFTP session \"" + obj.sessionid + "\" after " + sessionSeconds + " second(s).", protocol: PROTOCOL_WEBSFTP, bytesin: inTraffc, bytesout: outTraffc };
873
parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
874
delete obj.startTime;
875
+ delete obj.sessionid;
876
}
877
878
if (obj.sshClient) {
@@ -923,8 +954,15 @@ module.exports.CreateSshFilesRelay = function (parent, db, ws, req, domain, user
954
obj.sshClient.on('ready', function () { // Authentication was successful.
955
// If requested, save the credentials
956
if (obj.keep === true) saveSshCredentials();
957
+ obj.sessionid = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64');
958
obj.startTime = Date.now();
959
960
+ // Event start of session
961
+ try {
962
+ const event = { etype: 'relay', action: 'relaylog', domain: domain.id, nodeid: obj.nodeid, userid: user._id, username: user.name, msgid: 149, msgArgs: [obj.sessionid], msg: "Started Web-SFTP session \"" + obj.sessionid + "\".", protocol: PROTOCOL_WEBSFTP };
963
+ parent.parent.DispatchEvent(['*', obj.nodeid, user._id, obj.meshid], obj, event);
964
+ } catch (ex) { console.log(ex); }
965
+
966
obj.sshClient.sftp(function(err, sftp) {
967
if (err) { obj.close(); return; }
968
obj.connected = true;
views/default.handlebars
+8
-4
@@ -13465,9 +13465,9 @@
13465
120: "Started local relay session \"{0}\", protocol {1} to {2}",
13466
121: "Ended local relay session \"{0}\", protocol {1} to {2}, {3} second(s)",
13467
122: "Left the desktop multiplex session after {0} second(s).", // No longer in use, replaced with 144
13468
- 123: "Left Web-SSH session after {0} second(s).",
13469
- 124: "Left Web-SFTP session after {0} second(s).",
13470
- 125: "Left Web-RDP session after {0} second(s).",
13468
+ 123: "Left Web-SSH session \"{1}\" after {0} second(s).",
13469
+ 124: "Left Web-SFTP session \"{1}\" after {0} second(s).",
13470
+ 125: "Left Web-RDP session \"{1}\" after {0} second(s).",
13471
126: "Left Web-VNC session after {0} second(s).",
13472
127: "Changed account display name to {0}.",
13473
128: "Account created, name is {0}.",
@@ -13489,7 +13489,11 @@
13489
144: "Left the desktop multiplex session \"{0}\" after {1} second(s).",
13490
145: "Started desktop multiplex session \"{0}\"",
13491
146: "Finished recording session \"{0}\", {1} second(s)",
13492
- 147: "Closed desktop multiplex session \"{0}\", {1} second(s)"
13492
+ 147: "Closed desktop multiplex session \"{0}\", {1} second(s)",
13493
+ 148: "Started Web-SSH session \"{0}\".",
13494
+ 149: "Started Web-SFTP session \"{0}\".",
13495
+ 150: "Started Web-RDP session \"{0}\".",
13496
+ 151: "Started Web-VNC session \"{0}\"." // Not in use yet
13497
};
13498
13499
var eventsShortMessageId = {