Node-RED で sshd のログを監視するフローのサンプルです。
このフローは、Ubuntu の /var/log/auth.log を監視し、不正なSSHログインを検知します。検知すると Slack へ通知し、不正ログイン状況を集計してダッシュボードに表示します。
- Ubuntu 16.04 LTS
| WinJS.Utilities.markSupportedForProcessing(onItemClicked); | |
| WinJS.Namespace.define('SampleData', {onItemClicked: onItemClicked}); |
| @echo off | |
| set CURRENT_DIR=%CD% | |
| pushd %0\.. | |
| setlocal enabledelayedexpansion | |
| set RESOURCE_GROUP=%1 | |
| set ACTION=%2 |
| { | |
| "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", | |
| "contentVersion": "1.0.0.0", | |
| "parameters": { | |
| "virtualMachineSize": { | |
| "type": "string", | |
| "defaultValue": "Standard_F1", | |
| "allowedValues": [ | |
| "Standard_A0", | |
| "Standard_A1", |
| { | |
| "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", | |
| "contentVersion": "1.0.0.0", | |
| "parameters": { | |
| "adminUserName": { | |
| "type": "string", | |
| "minLength": 1 | |
| }, | |
| "adminPublicKey": { | |
| "type": "securestring" |
| # Set password for JupyterHub login | |
| sudo password $USER | |
| # Update yum pacakges | |
| sudo yum update -y | |
| # Install anaconda3 | |
| cd /tmp | |
| curl -O https://repo.continuum.io/archive/Anaconda3-5.1.0-Linux-x86_64.sh | |
| bash Anaconda3-5.1.0-Linux-x86_64.sh -b |
| { | |
| "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", | |
| "contentVersion": "1.0.0.0", | |
| "parameters":{ | |
| "databaseForMySqlAdminName": { | |
| "type": "string" | |
| }, | |
| "databaseForMySqlAdminPassword": { | |
| "type": "securestring" | |
| }, |
| { | |
| "entries": [ | |
| { | |
| "tokenType": "Bearer", | |
| "expiresIn": 3600, | |
| "expiresOn": "2019-10-21T08:57:07.417Z", | |
| "resource": "https://management.core.windows.net/", | |
| "accessToken": "<hidden>", | |
| "refreshToken": "<hidden>", | |
| "userId": "[email protected]", |
| $ sls deploy | |
| Serverless: Removing .serverless directory | |
| Serverless: Parsing Azure Functions Bindings.json... | |
| Serverless: Building binding for function: hello event: httpTrigger | |
| Serverless: Parsing Azure Functions Bindings.json... | |
| Serverless: Building binding for function: goodbye event: httpTrigger | |
| Serverless: Packaging service... | |
| Serverless: Excluding development dependencies... | |
| Serverless: Logging into Azure |
| PREFIX=try-bastion | |
| RESOURCE_GROUP_NAME=${PREFIX}-rg | |
| LOCATION=japaneast | |
| VNET_NAME=${PREFIX}-vnet | |
| SUBNET_NAME=${PREFIX}-subnet | |
| BASTION_NAME=${PREFIX}-bastion | |
| BASTION_PUBLICIP_NAME=${PREFIX}-bastion-ip |