Go 企业级堡垒机：把 SSH 关进审计笼子

package main

import (
    "fmt"
    "golang.org/x/crypto/ssh"
    "log"
    "net"
    "os/exec"
)

func main() {
    config := &ssh.ServerConfig{
        PasswordCallback: func(c ssh.ConnMetadata, p []byte) (*ssh.Permissions, error) {
            if c.User() == "admin" && string(p) == "secret" {
                return nil, nil
            }
            return nil, fmt.Errorf("denied")
        },
    }
    key, _ := ssh.ParsePrivateKey([]byte(hostKey))
    config.AddHostKey(key)

    ln, _ := net.Listen("tcp", ":2222")
    for {
        conn, _ := ln.Accept()
        go handle(conn, config)
    }
}

func handle(nConn net.Conn, config *ssh.ServerConfig) {
    sshConn, chans, reqs, _ := ssh.NewServerConn(nConn, config)
    defer sshConn.Close()
    go ssh.DiscardRequests(reqs)

    for ch := range chans {
        if ch.ChannelType() != "session" {
            ch.Reject(ssh.UnknownChannelType, "unknown")
            continue
        }
        ch, reqs, _ := ch.Accept()
        go func() {
            for req := range reqs {
                if req.Type == "exec" {
                    cmd := string(req.Payload[4:])
                    log.Printf("AUDIT user=%s cmd=%s", sshConn.User(), cmd)
                    out, _ := exec.Command("sh", "-c", cmd).CombinedOutput()
                    ch.Write(out)
                    ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Status uint32 }{0}))
                    ch.Close()
                }
            }
        }()
    }
}