init

scripts/install.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Installs ssh-access-tui on a Linux jump host from a prebuilt binary
+# (no Go toolchain on the production host, deliberately — build once in
+# CI/dev, ship the binary): checks its two external dependencies
+# (ssh-keygen, 7z), installs the journal-tailer and backup systemd units,
+# and runs the tool's own "install" step (sshd Match block + directories).
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "Run as root (sudo $0)." >&2
+  exit 1
+fi
+
+SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BIN_PATH="/usr/local/bin/ssh-access-tui"
+BACKUP_SCRIPT_PATH="/usr/local/bin/ssh-access-tui-backup.sh"
+
+if ! command -v ssh-keygen >/dev/null 2>&1; then
+  echo "ssh-keygen not found — install openssh-client." >&2
+  exit 1
+fi
+if ! command -v 7z >/dev/null 2>&1; then
+  echo "7z not found — install p7zip-full (apt) or p7zip (rpm)." >&2
+  exit 1
+fi
+if ! command -v git >/dev/null 2>&1; then
+  echo "git not found — required for state versioning/backup." >&2
+  exit 1
+fi
+
+if [ ! -x "$SRC_DIR/ssh-access-tui" ]; then
+  echo "Prebuilt binary not found at $SRC_DIR/ssh-access-tui." >&2
+  echo "Build it elsewhere (dev machine/CI): CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ssh-access-tui ./cmd/ssh-access-tui" >&2
+  echo "then copy it next to this script and re-run. This script never builds on the production host." >&2
+  exit 1
+fi
+install -m 0750 "$SRC_DIR/ssh-access-tui" "$BIN_PATH"
+
+install -m 0750 "$SRC_DIR/scripts/ssh-access-tui-backup.sh" "$BACKUP_SCRIPT_PATH"
+
+install -m 0644 "$SRC_DIR/scripts/ssh-access-tui-audit.service" /etc/systemd/system/ssh-access-tui-audit.service
+install -m 0644 "$SRC_DIR/scripts/ssh-access-tui-backup.service" /etc/systemd/system/ssh-access-tui-backup.service
+install -m 0644 "$SRC_DIR/scripts/ssh-access-tui-backup.timer" /etc/systemd/system/ssh-access-tui-backup.timer
+systemctl daemon-reload
+
+"$BIN_PATH" install
+
+systemctl enable --now ssh-access-tui-audit.service
+systemctl enable --now ssh-access-tui-backup.timer
+
+echo
+echo "Установка завершена."
+echo "Запуск TUI:            sudo ssh-access-tui"
+echo "Настройте git-бэкап:   git -C /var/lib/ssh-access-tui/state remote add origin <url>"
+echo "Инструкция для админа: $SRC_DIR/docs/ADMIN_GUIDE.md"

scripts/ssh-access-tui-audit.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=ssh-access-tui audit journal tailer (connect/disconnect log)
+After=network.target sshd.service ssh.service
+Wants=ssh.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/ssh-access-tui audit-tail
+Restart=always
+RestartSec=5
+User=root
+# Read-only access to system state is enough; this process only appends to
+# the audit log and reads the systemd journal.
+ProtectSystem=strict
+ReadWritePaths=/var/lib/ssh-access-tui/audit
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

scripts/ssh-access-tui-backup.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=ssh-access-tui state backup (git push)
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/ssh-access-tui-backup.sh
+User=root

scripts/ssh-access-tui-backup.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Pushes the git-backed state repo (groups, users, host permissions, audit
+# metadata) to a remote so a dead/lost jump host does not mean re-creating
+# every user and permission by hand. Deliberately does NOT touch the export
+# archive directory: those .7z files contain (encrypted) private keys and
+# should be deleted from the jump host once delivered, not retained/backed up.
+set -euo pipefail
+
+STATE_DIR="${1:-/var/lib/ssh-access-tui/state}"
+
+if [ ! -d "$STATE_DIR/.git" ]; then
+  echo "ssh-access-tui-backup: $STATE_DIR is not a git repo yet — run the tool at least once first." >&2
+  exit 1
+fi
+
+cd "$STATE_DIR"
+
+if ! git remote get-url origin >/dev/null 2>&1; then
+  cat >&2 <<EOF
+No git remote 'origin' is configured for $STATE_DIR.
+This is local-only right now: a disk failure on this host would lose it.
+Configure a remote (a private repo, or a git server on separate storage) with:
+  git -C $STATE_DIR remote add origin <url>
+EOF
+  exit 1
+fi
+
+git push origin HEAD:refs/heads/main
+echo "ssh-access-tui-backup: pushed $STATE_DIR to origin at $(date -Is)"

scripts/ssh-access-tui-backup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Run ssh-access-tui state backup hourly
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+
+[Install]
+WantedBy=timers.target