From 7817e020f9564a1b19760e643760fdb6ed85692f Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 09:59:49 +0100 Subject: [PATCH 01/11] Release automate --- .github/workflows/docker-release.yml | 56 ++++++++++++++++++++++++++++ Dockerfile | 8 +++- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/docker-release.yml diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml new file mode 100644 index 0000000..cb032ff --- /dev/null +++ b/.github/workflows/docker-release.yml @@ -0,0 +1,56 @@ +name: Build and Push Docker Image on Tag + +on: + push: + tags: + - "v*.*.*" # triggers on tags like v1.0.0 + branches: ["master"] + +jobs: + build-and-push: + runs-on: ubuntu-latest + # runs-on: docker:cli + + permissions: + contents: read + packages: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Extract tag name + id: tag + run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT + + - name: Set metadata + id: meta + run: | + echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT + echo "VCS_REF=${GITHUB_SHA}" >> $GITHUB_OUTPUT + echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Build and push Docker image + uses: docker/build-push-action@v5 + with: + context: . + push: true + platforms: linux/amd64,linux/arm64 + build-args: | + VERSION=${{ steps.tag.outputs.TAG }} + VCS_REF=${{ steps.meta.outputs.SHA }} + BUILD_DATE=${{ steps.meta.outputs.DATE }} + tags: | +# justinazoff/ssh-auth-logger:${{ steps.tag.outputs.TAG }} +# justinazoff/ssh-auth-logger:latest + gas85/ssh-auth-logger:${{ steps.tag.outputs.TAG }} + gas85/ssh-auth-logger:latest diff --git a/Dockerfile b/Dockerfile index ed3ef64..fbbd485 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,18 @@ FROM golang:latest +ARG VERSION=dev +ARG VCS_REF=dev +ARG BUILD_DATE=unknown + LABEL maintainer="Justin Azoff " \ org.opencontainers.image.title="ssh-auth-logger" \ org.opencontainers.image.description="A low/zero interaction ssh authentication logging honeypot" \ org.opencontainers.image.source="https://github.com/JustinAzoff/ssh-auth-logger" \ org.opencontainers.image.url="https://hub.docker.com/r/justinazoff/ssh-auth-logger" \ org.opencontainers.image.documentation="https://github.com/JustinAzoff/ssh-auth-logger#" \ - org.opencontainers.image.version="0.1.0" + org.opencontainers.image.version=$VERSION \ + org.opencontainers.image.revision=$VCS_REF \ + org.opencontainers.image.version=$VERSION ENV USER=nobody ENV SSHD_BIND=:2222 From 2dc4f2a1993bdff6b698d7ea015a79bc06294f98 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 10:01:31 +0100 Subject: [PATCH 02/11] Update build arguments in docker-release workflow --- .github/workflows/docker-release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index cb032ff..a42cde3 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -46,9 +46,9 @@ jobs: push: true platforms: linux/amd64,linux/arm64 build-args: | - VERSION=${{ steps.tag.outputs.TAG }} - VCS_REF=${{ steps.meta.outputs.SHA }} - BUILD_DATE=${{ steps.meta.outputs.DATE }} + VERSION=${{ steps.meta.outputs.VERSION }} + VCS_REF=${{ steps.meta.outputs.VCS_REF }} + BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} tags: | # justinazoff/ssh-auth-logger:${{ steps.tag.outputs.TAG }} # justinazoff/ssh-auth-logger:latest From d1c8e368af0771092d58c9f22870faebb0159cd0 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 10:03:25 +0100 Subject: [PATCH 03/11] Minor update --- .github/workflows/docker-release.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index a42cde3..7cc888d 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -19,10 +19,6 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 - - name: Extract tag name - id: tag - run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT - - name: Set metadata id: meta run: | @@ -52,5 +48,5 @@ jobs: tags: | # justinazoff/ssh-auth-logger:${{ steps.tag.outputs.TAG }} # justinazoff/ssh-auth-logger:latest - gas85/ssh-auth-logger:${{ steps.tag.outputs.TAG }} + gas85/ssh-auth-logger:${{ steps.meta.outputs.VERSION }} gas85/ssh-auth-logger:latest From 43b2c3390cc92d6144f915a62dfb4e4b71f2d612 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 10:04:12 +0100 Subject: [PATCH 04/11] Clean up Docker tags in docker-release.yml Removed commented-out Docker tags for justinazoff/ssh-auth-logger. --- .github/workflows/docker-release.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 7cc888d..cc53fb4 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -46,7 +46,5 @@ jobs: VCS_REF=${{ steps.meta.outputs.VCS_REF }} BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} tags: | -# justinazoff/ssh-auth-logger:${{ steps.tag.outputs.TAG }} -# justinazoff/ssh-auth-logger:latest gas85/ssh-auth-logger:${{ steps.meta.outputs.VERSION }} gas85/ssh-auth-logger:latest From 9130aa506f185b3d1679c080aebd42db1d65b7af Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 10:06:01 +0100 Subject: [PATCH 05/11] Temporary disable master --- .github/workflows/docker-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index cc53fb4..9015c01 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -4,7 +4,7 @@ on: push: tags: - "v*.*.*" # triggers on tags like v1.0.0 - branches: ["master"] +# branches: ["master"] jobs: build-and-push: From ff58be827a3f5e88f0c60e4679279df02bdf38df Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 12 Feb 2026 11:08:50 +0100 Subject: [PATCH 06/11] add original repository --- .github/workflows/docker-release.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 9015c01..89a81c0 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -4,7 +4,6 @@ on: push: tags: - "v*.*.*" # triggers on tags like v1.0.0 -# branches: ["master"] jobs: build-and-push: @@ -46,5 +45,5 @@ jobs: VCS_REF=${{ steps.meta.outputs.VCS_REF }} BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} tags: | - gas85/ssh-auth-logger:${{ steps.meta.outputs.VERSION }} - gas85/ssh-auth-logger:latest + justinazoff/ssh-auth-logger:${{ steps.meta.outputs.VERSION }} + justinazoff/ssh-auth-logger:latest From d0808c308b873388f97bbd7cb5e6a6abad44c6cc Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 5 Mar 2026 10:24:02 +0100 Subject: [PATCH 07/11] Add Dynamic Repo to the tags --- .github/workflows/docker-release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 89a81c0..95defe4 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -45,5 +45,5 @@ jobs: VCS_REF=${{ steps.meta.outputs.VCS_REF }} BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} tags: | - justinazoff/ssh-auth-logger:${{ steps.meta.outputs.VERSION }} - justinazoff/ssh-auth-logger:latest + ${{ github.repository }}:${{ steps.meta.outputs.VERSION }} + ${{ github.repository }}:latest From 87639bbab428f5f635f2b28a9b3932a4b03411c5 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 5 Mar 2026 11:07:06 +0100 Subject: [PATCH 08/11] Repo Name lower Case correction --- .github/workflows/docker-release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 95defe4..e2356f4 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -34,6 +34,10 @@ jobs: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Prepare image name + id: repo + run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT + - name: Build and push Docker image uses: docker/build-push-action@v5 with: @@ -45,5 +49,5 @@ jobs: VCS_REF=${{ steps.meta.outputs.VCS_REF }} BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} tags: | - ${{ github.repository }}:${{ steps.meta.outputs.VERSION }} - ${{ github.repository }}:latest + docker.io/${{ steps.repo.outputs.REPO }}:${{ steps.meta.outputs.VERSION }} + docker.io/${{ steps.repo.outputs.REPO }}:latest From 769b443f6c5775d06b0a9f1c72d6d3778e91b52e Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 5 Mar 2026 11:54:21 +0100 Subject: [PATCH 09/11] Reduce Image size from 300+ MB to 10 MB --- .dockerignore | 6 ++++++ Dockerfile | 17 +++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..df41766 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,6 @@ +.git +README.md +Dockerfile +Makefile +.github +.gitignore \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index fbbd485..1963fd3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,12 @@ -FROM golang:latest +FROM golang:alpine AS builder + +WORKDIR /app + +COPY . . + +RUN go install . + +FROM alpine:latest ARG VERSION=dev ARG VCS_REF=dev @@ -17,12 +25,9 @@ LABEL maintainer="Justin Azoff " \ ENV USER=nobody ENV SSHD_BIND=:2222 -WORKDIR /app - -COPY . . +COPY --from=builder /go/bin/ssh-auth-logger /go/bin/ssh-auth-logger -RUN go install . && \ - touch /var/log/ssh-auth-logger.log && \ +RUN touch /var/log/ssh-auth-logger.log && \ chown $USER /var/log/ssh-auth-logger.log && \ chmod 644 /var/log/ssh-auth-logger.log From 1651df7627caa64b635051ca84f51b933ffb7f01 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 5 Mar 2026 13:22:27 +0100 Subject: [PATCH 10/11] As we moved to Alpine, wget will not work as before --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7b4c765..790a7f9 100644 --- a/README.md +++ b/README.md @@ -99,7 +99,7 @@ services: memory: 100M healthcheck: # Will test if port is still open AND log file was not vanished by host machine log rotate - test: wget -v localhost$$SSHD_BIND --no-verbose --tries=1 --spider && test -s /var/log/ssh-auth-logger.log || exit 1 + test: pgrep ssh-auth-logger && test -s /var/log/ssh-auth-logger.log || exit 1 interval: 5m00s timeout: 5s retries: 2 From 8b0cd0796a1792a5d558509addc5ca9b68e56cea Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 21 May 2026 15:52:52 +0200 Subject: [PATCH 11/11] Enhance Docker workflows with Trivy security scan and update Dockerfile labels. Makefile is not needed any more. --- .github/workflows/docker-release.yml | 61 +++++++++++++++++++++++----- .github/workflows/trivy.yml | 51 +++++++++++++++++++++++ Dockerfile | 15 ++++--- Makefile | 15 ------- 4 files changed, 111 insertions(+), 31 deletions(-) create mode 100644 .github/workflows/trivy.yml delete mode 100644 Makefile diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index e2356f4..ae98e2a 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -6,9 +6,9 @@ on: - "v*.*.*" # triggers on tags like v1.0.0 jobs: + build-and-push: runs-on: ubuntu-latest - # runs-on: docker:cli permissions: contents: read @@ -16,7 +16,8 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + # https://github.com/actions/checkout/releases/tag/v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Set metadata id: meta @@ -24,22 +25,24 @@ jobs: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT echo "VCS_REF=${GITHUB_SHA}" >> $GITHUB_OUTPUT echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT + echo "LABEL_MAINTAINER=${{ github.repository_owner }}" >> $GITHUB_OUTPUT + echo "LABEL_IMAGE_SOURCE=${{ github.repository }}" >> $GITHUB_OUTPUT + echo "LABEL_IMAGE_URL=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + # https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd - name: Login to Docker Hub - uses: docker/login-action@v3 + # https://github.com/docker/login-action/releases/tag/v4.1.0 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Prepare image name - id: repo - run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT - - name: Build and push Docker image - uses: docker/build-push-action@v5 + # https://github.com/docker/build-push-action/releases/tag/v7.1.0 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f with: context: . push: true @@ -48,6 +51,42 @@ jobs: VERSION=${{ steps.meta.outputs.VERSION }} VCS_REF=${{ steps.meta.outputs.VCS_REF }} BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }} + LABEL_MAINTAINER=${{ steps.meta.outputs.LABEL_MAINTAINER }} + LABEL_IMAGE_SOURCE=${{ steps.meta.outputs.LABEL_IMAGE_SOURCE }} + LABEL_IMAGE_URL=${{ steps.meta.outputs.LABEL_IMAGE_URL }} tags: | - docker.io/${{ steps.repo.outputs.REPO }}:${{ steps.meta.outputs.VERSION }} - docker.io/${{ steps.repo.outputs.REPO }}:latest + docker.io/${{ steps.meta.outputs.LABEL_IMAGE_URL }}:${{ steps.meta.outputs.VERSION }} + docker.io/${{ steps.meta.outputs.LABEL_IMAGE_URL }}:latest + + security-scan-release: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + name: Scan latest image after build + runs-on: ubuntu-latest + needs: build-and-push + steps: + - name: Checkout code + # https://github.com/actions/checkout/releases/tag/v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + + - name: Prepare image name + id: repo + run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT + + - name: Run Trivy vulnerability scanner + # https://github.com/aquasecurity/trivy-action/releases/tag/v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 + with: + image-ref: "docker.io/${{ steps.repo.outputs.REPO }}:latest" + format: "template" + template: "@/contrib/sarif.tpl" + output: "trivy-results.sarif" + severity: "CRITICAL,HIGH" + + - name: Upload Trivy scan results to GitHub Security tab + # https://github.com/github/codeql-action/releases/tag/v4.35.5 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba + with: + sarif_file: "trivy-results.sarif" \ No newline at end of file diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 0000000..0c6d338 --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,51 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: trivy + +on: + push: + branches: ["master"] + pull_request: + # The branches below must be a subset of the branches above + branches: ["master"] + schedule: + - cron: "38 2 * * 3" + +permissions: + contents: read + +jobs: + security-scan-master: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + name: Security scan master + runs-on: ubuntu-latest + steps: + - name: Checkout code + # https://github.com/actions/checkout/releases/tag/v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + + - name: Prepare image name + id: repo + run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT + + - name: Run Trivy vulnerability scanner + # https://github.com/aquasecurity/trivy-action/releases/tag/v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 + with: + image-ref: "docker.io/${{ steps.repo.outputs.REPO }}:latest" + format: "template" + template: "@/contrib/sarif.tpl" + output: "trivy-results.sarif" + severity: "CRITICAL,HIGH" + + - name: Upload Trivy scan results to GitHub Security tab + # https://github.com/github/codeql-action/releases/tag/v4.35.5 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba + with: + sarif_file: "trivy-results.sarif" \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 1963fd3..d8450b7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,19 +11,24 @@ FROM alpine:latest ARG VERSION=dev ARG VCS_REF=dev ARG BUILD_DATE=unknown +ARG LABEL_MAINTAINER="Justin Azoff " +ARG LABEL_IMAGE_SOURCE="JustinAzoff/ssh-auth-logger" +ARG LABEL_IMAGE_URL="justinazoff/ssh-auth-logger" -LABEL maintainer="Justin Azoff " \ +LABEL maintainer="$LABEL_MAINTAINER" \ org.opencontainers.image.title="ssh-auth-logger" \ org.opencontainers.image.description="A low/zero interaction ssh authentication logging honeypot" \ - org.opencontainers.image.source="https://github.com/JustinAzoff/ssh-auth-logger" \ - org.opencontainers.image.url="https://hub.docker.com/r/justinazoff/ssh-auth-logger" \ - org.opencontainers.image.documentation="https://github.com/JustinAzoff/ssh-auth-logger#" \ + org.opencontainers.image.source="https://github.com/$LABEL_IMAGE_SOURCE" \ + org.opencontainers.image.url="https://hub.docker.com/r/$LABEL_IMAGE_URL" \ + org.opencontainers.image.documentation="https://github.com/$LABEL_IMAGE_SOURCE#" \ org.opencontainers.image.version=$VERSION \ org.opencontainers.image.revision=$VCS_REF \ org.opencontainers.image.version=$VERSION +ENV VERSION=$VERSION ENV USER=nobody ENV SSHD_BIND=:2222 +ENV TELNET_BIND=:2323 COPY --from=builder /go/bin/ssh-auth-logger /go/bin/ssh-auth-logger @@ -33,6 +38,6 @@ RUN touch /var/log/ssh-auth-logger.log && \ USER $USER -EXPOSE 2222 +EXPOSE 2222 2323 CMD test -f /var/log/ssh-auth-logger.log || { echo 'Creating log file...' && touch /var/log/ssh-auth-logger.log ; }; /go/bin/ssh-auth-logger 2>&1 | tee -a /var/log/ssh-auth-logger.log \ No newline at end of file diff --git a/Makefile b/Makefile deleted file mode 100644 index c1f732f..0000000 --- a/Makefile +++ /dev/null @@ -1,15 +0,0 @@ -all: build -build: - go build - -build_linux: - gox --osarch linux/amd64 - -check_docker: - @docker ps > /dev/null - -image: check_docker build_linux - docker build -t justinazoff/ssh-auth-logger . - -push_image: image - docker push justinazoff/ssh-auth-logger