jaksi/sshesame

Feature request: add support for logging to a database

Chaz6 opened this issue · 4 comments

Chaz6 commented

It would be nice to log events such as log ins, and payloads, to a database, for analysis.

For example,

Table logins:
Source address, source port, time, username, password

Table payloads:
Source address, source port, time, payload

Chaz6 commented

I am working on this now and so far I have got logins stored in a sqlite database working.

mrjfox commented

+1 but i would like to log events to Elasticsearch instead.

Can you please great a future feature list were we can see whats going to be added in the future and supports up votes?

jaksi commented

My plan is to use logrus, which makes sending logs to various services (like Elasticsearch) quite easy.

As for a feature list, there's still some basic stuff missing:

  • parsing request payloads (I'm working on this now)
  • reply to exec requests by sending an exit-status request
  • only spawn a terminal when the client requests it

I will try to keep the development consistent, but it's obviously not a full time project and my free time is limited.

jaksi commented

Since JSON logging is available now, database logging can be easily done by processing the logs (there is a Logstash output which could be used).

I don't think log target specific code (such as handling a DB connection) belongs to the application itself, so I'm closing this.

@Chaz6 Of course it'd be still awesome if you did this, and I would be happy to include for example a link to it in the README.

@mrjfox The JSON output can be fed to Logstash, which can store the data in Elasticsearch.