init

internal/audit/tail.go

@@ -0,0 +1,50 @@
+package audit
+
+import (
+	"bufio"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"time"
+)
+
+func now() time.Time { return time.Now() }
+
+var (
+	reAccepted   = regexp.MustCompile(`Accepted publickey for (\S+) from (\S+) port \d+`)
+	reDisconnect = regexp.MustCompile(`Disconnected from user (\S+) (\S+) port \d+`)
+	reSessClosed = regexp.MustCompile(`session closed for user (\S+)`)
+)
+
+// TailJournal runs indefinitely (intended to be run under systemd — see
+// scripts/ssh-access-tui-audit.service), following sshd's journal output and
+// appending normalized connect/disconnect events to the audit log at
+// logPath. This is what makes "who logged in/out" survive independently of
+// journald's own retention/rotation policy.
+func TailJournal(logPath string) error {
+	cmd := exec.Command("journalctl", "-u", "ssh", "-u", "sshd", "-f", "-n", "0", "-o", "cat")
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("journalctl pipe: %w", err)
+	}
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("start journalctl: %w", err)
+	}
+
+	sc := bufio.NewScanner(stdout)
+	for sc.Scan() {
+		line := sc.Text()
+		switch {
+		case reAccepted.MatchString(line):
+			m := reAccepted.FindStringSubmatch(line)
+			_ = Append(logPath, Event{Time: now(), User: m[1], Action: "connect", SrcIP: m[2]})
+		case reDisconnect.MatchString(line):
+			m := reDisconnect.FindStringSubmatch(line)
+			_ = Append(logPath, Event{Time: now(), User: m[1], Action: "disconnect", SrcIP: m[2]})
+		case reSessClosed.MatchString(line):
+			m := reSessClosed.FindStringSubmatch(line)
+			_ = Append(logPath, Event{Time: now(), User: m[1], Action: "disconnect"})
+		}
+	}
+	return cmd.Wait()
+}