From 118d4bf7f26e3bcb0e42167dd40b8f1de22560ce Mon Sep 17 00:00:00 2001
From: benya <benya@daemonlord.ru>
Date: Sun, 8 Feb 2026 01:52:53 +0300
Subject: [PATCH] Add SSH login log viewer

---
 handlers/system.py | 36 ++++++++++++++++++++++++++++++++++++
 keyboards.py       |  2 +-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/handlers/system.py b/handlers/system.py
index a919681..b56c8da 100644
--- a/handlers/system.py
+++ b/handlers/system.py
@@ -61,6 +61,42 @@ async def urls(msg: Message):
     asyncio.create_task(worker())
 
 
+@dp.message(F.text == "🔑 SSH log")
+async def ssh_log(msg: Message):
+    if not is_admin_msg(msg):
+        return
+
+    await msg.answer("⏳ Loading SSH logins…", reply_markup=system_logs_kb)
+
+    async def worker():
+        lines: list[str] = []
+        rc, out = await run_cmd(
+            ["journalctl", "-u", "ssh", "-u", "sshd", "--since", "today", "--no-pager"],
+            timeout=20,
+        )
+        if rc == 0 and out.strip():
+            for line in out.splitlines():
+                if "Accepted" in line:
+                    lines.append(line)
+
+        if not lines:
+            rc2, out2 = await run_cmd(["tail", "-n", "200", "/var/log/auth.log"], timeout=10)
+            if rc2 == 0 and out2.strip():
+                for line in out2.splitlines():
+                    if "Accepted" in line:
+                        lines.append(line)
+
+        if not lines:
+            await msg.answer("🔑 SSH log\n\n(no logins today)", reply_markup=system_logs_kb)
+            return
+
+        recent = lines[-30:]
+        text = "🔑 SSH logins (today)\n```\n" + "\n".join(recent) + "\n```"
+        await msg.answer(text, reply_markup=system_logs_kb, parse_mode="Markdown")
+
+    asyncio.create_task(worker())
+
+
 @dp.message(F.text == "📈 Metrics")
 async def metrics(msg: Message):
     if not is_admin_msg(msg):
diff --git a/keyboards.py b/keyboards.py
index ef35f3c..4bdb9a7 100644
--- a/keyboards.py
+++ b/keyboards.py
@@ -83,7 +83,7 @@ system_logs_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="🧾 Audit"), KeyboardButton(text="📣 Incidents")],
         [KeyboardButton(text="🧰 Processes"), KeyboardButton(text="🔒 SSL")],
-        [KeyboardButton(text="🌐 URLs")],
+        [KeyboardButton(text="🌐 URLs"), KeyboardButton(text="🔑 SSH log")],
         [KeyboardButton(text="⬅️ System")],
     ],
     resize_keyboard=True,