@daemonitor/plugins 1.1.23 → 1.1.26

package/dist/plugins/monitoring/DockerPlugin.js

@@ -4,6 +4,39 @@ import { promisify } from "util";
 import { hostname } from "os";
 const execAsync = promisify(exec);
 const EXEC_OPTS = { maxBuffer: 32 * 1024 * 1024 }; // containers.length can be large
+/**
+ * Reduce a healthcheck's captured output to the part that says what went wrong.
+ *
+ * Healthchecks are overwhelmingly `curl`, and curl writes its transfer meter to
+ * the same buffer as the response — so the raw text is mostly columns of rates
+ * and `--:--:--` padding, with the answer somewhere inside. Taking the first 300
+ * characters, as this used to, returns the meter header every single time.
+ *
+ * curl also rewrites the meter line in place with \r while the body streams in,
+ * so the response can land INSIDE a rate row rather than on its own line. That
+ * rules out dropping noisy lines wholesale; the meter tokens have to come out
+ * and whatever is left is the message.
+ */
+export function cleanHealthOutput(raw) {
+    const s = String(raw || "");
+    // When curl itself failed it says so in one line, and that line is the entire
+    // answer: exit 7 is connection refused, 28 is timeout, 22 is an HTTP error.
+    const curlErr = s.match(/curl:\s*\(\d+\)[^\r\n]*/);
+    if (curlErr)
+        return curlErr[0].trim().slice(0, 300);
+    const stripped = s
+        .replace(/%\s*Total[\s\S]*?Dload\s+Upload\s+Total\s+Spent\s+Left\s+Speed/g, " ")
+        .replace(/%\s*Total[^\r\n]*/g, " ")
+        .replace(/Dload[^\r\n]*Speed/g, " ")
+        .replace(/(?:--:--:--|\d+:\d{2}:\d{2})/g, " ")
+        .replace(/\s+/g, " ")
+        // what remains of the meter is runs of bare counters
+        .replace(/(?:\s\d+(?:\.\d+)?[kKMG]?){3,}(?=\s|$)/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    // A failing command puts its error last, after whatever it managed to print.
+    return stripped.length > 300 ? "…" + stripped.slice(-300) : stripped;
+}
 const HEALTH_RE = /\((healthy|unhealthy|health: starting|starting)\)/i;
 // Previous cumulative NetIO/BlockIO totals per container id, to derive a
 // per-second rate across polls. Module-level (one collect per host per cycle).
@@ -148,11 +181,19 @@ async function collectContainers(bin) {
             if (!h)
                 continue;
             c.healthFailingStreak = Number(h.FailingStreak) || 0;
-            const last = Array.isArray(h.Log) && h.Log.length ? h.Log[h.Log.length - 1] : null;
-            if (last?.Output) {
-                // Healthcheck output is often multi-line and ends in a newline; collapse
-                // it so it fits an alert line, and keep the head where the error is.
-                c.healthOutput = String(last.Output).replace(/\s+/g, " ").trim().slice(0, 300);
+            const log = Array.isArray(h.Log) ? h.Log : [];
+            // Docker keeps the last five probes, and the newest one can be a PASS while
+            // the container is still marked unhealthy — the status lags a recovery, and
+            // a flapping check alternates. Quoting that pass is how an alert ends up
+            // giving {"status":"ok"} as the reason something is broken. Report the most
+            // recent probe that actually failed.
+            const entry = [...log].reverse().find((e) => e && e.ExitCode !== 0) || log[log.length - 1] || null;
+            if (entry && typeof entry.ExitCode === "number")
+                c.healthExitCode = entry.ExitCode;
+            if (entry?.Output) {
+                const cleaned = cleanHealthOutput(entry.Output);
+                if (cleaned)
+                    c.healthOutput = cleaned;
             }
         }
         catch (err) {

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -24,16 +24,27 @@ function parseLine(line) {
         return null;
     const br = line.indexOf("[");
     const pre = br > 0 ? line.slice(0, br) : line;
-    const tokens = pre.split(/\s+/);
+    const tokens = pre.split(/\s+/).filter(Boolean);
     const ips = tokens.filter((t) => IP_TOKEN.test(t));
-    const ip = ips.length ? ips[ips.length - 1] : (tokens.find(Boolean) || "");
-    return { ip, method: rq[1], path: rq[2], status: Number(rq[3]), ua: "" };
+    const ip = ips.length ? ips[ips.length - 1] : (tokens[0] || "");
+    // A host in the leading field is what lets a SHARED access log (one file for
+    // every vhost, as on the misc box) still say WHICH site was hit. A plain
+    // combined line leads with the client IP instead, so only a non-IP first
+    // token counts. When $host is itself an IP — a request made straight to the
+    // origin address — there is no site name to report and "" is correct.
+    const first = tokens[0] || "";
+    const host = first !== "-" && !IP_TOKEN.test(first) ? first : "";
+    return { host, ip, method: rq[1], path: rq[2], status: Number(rq[3]), ua: "" };
 }
 const SUSPICIOUS_QUERY = /(?:^|[?&])(c|k|cmd|exec|e|q|f|file|dir|download|0|1|a)=/i;
 const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
 const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
 const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
 const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
+// wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
+// nothing about being logged in. Everything else under /wp-admin/ redirects a
+// logged-out visitor to the login form.
+const ANON_ADMIN = /^\/wp-admin\/(?:admin-ajax|admin-post|load-styles|load-scripts|install|setup-config)\.php$|^\/wp-admin\/(?:css|js|images|fonts)\//i;
 // Read new bytes since last offset, advancing state. Handles rotation (file
 // shrank → restart at 0) and partial trailing lines (buffered in remainder).
 async function readNew(source, st) {
@@ -74,10 +85,34 @@ async function readNew(source, st) {
     st.remainder = lines.pop() ?? ""; // last element is a partial line (no newline)
     return lines;
 }
-function analyze(lines, cfg, windowSec) {
+export function analyze(lines, cfg, windowSec, st) {
     const burstThreshold = cfg.xmlrpcBurstThreshold ?? 20;
     const batchIps = new Map(); // ip → count of batch/v1 → 207
-    const loginOkIps = new Set(); // ip with POST wp-login → 302
+    // key (ip, or path for webshells) → the vhosts it was seen against. Only
+    // populated when the log format carries $host; findings degrade to the old
+    // wording when it doesn't.
+    const hostsByKey = new Map();
+    const noteHost = (key, host) => {
+        if (!host)
+            return;
+        const set = hostsByKey.get(key) || new Set();
+        set.add(host);
+        hostsByKey.set(key, set);
+    };
+    // " on a.com, b.com" — capped so a scanner sweeping 30 vhosts can't blow past
+    // the 200-char detail limit the ingest applies.
+    const onSites = (key) => {
+        const set = hostsByKey.get(key);
+        if (!set?.size)
+            return "";
+        const list = [...set];
+        const shown = list.slice(0, 3).join(", ");
+        return ` on ${shown}${list.length > 3 ? ` +${list.length - 3} more` : ""}`;
+    };
+    let batchAttempts = 0; // every batch/v1 request, whatever the status
+    let batchBlocked = 0; // ...of which nginx/WAF rejected outright
+    const loginOkIps = new Set(); // ip with POST wp-login → 302 (WEAK on its own)
+    const adminOkIps = new Set(); // ip that then loaded an authed wp-admin page (2xx)
     const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
     const webshell = new Map(); // pathNoQuery → sample
     let total = 0;
@@ -89,14 +124,40 @@ function analyze(lines, cfg, windowSec) {
         const qIdx = e.path.indexOf("?");
         const pathNoQuery = qIdx === -1 ? e.path : e.path.slice(0, qIdx);
         const query = qIdx === -1 ? "" : e.path.slice(qIdx + 1);
-        if ((BATCH_PATH.test(e.path) || pathNoQuery === "/wp-json/batch/v1") && e.status === 207) {
-            batchIps.set(e.ip, (batchIps.get(e.ip) || 0) + 1);
+        // Counting every batch/v1 attempt (not just the 207s) keeps attack pressure
+        // visible on the dashboard once an origin rule starts answering 403 — the
+        // ALERT still fires only on 207, which is the status that means WordPress
+        // actually executed the batch.
+        if (BATCH_PATH.test(e.path) || pathNoQuery === "/wp-json/batch/v1") {
+            batchAttempts++;
+            if (e.status === 207) {
+                batchIps.set(e.ip, (batchIps.get(e.ip) || 0) + 1);
+                noteHost(e.ip, e.host);
+            }
+            else if (e.status === 403 || e.status === 406 || e.status === 429) {
+                batchBlocked++;
+            }
+        }
+        // A 302 on POST /wp-login.php is the classic "login succeeded" tell, but it
+        // is only meaningful where a FAILED login looks different. On a site that
+        // hides or blocks wp-login.php every response is a 302 — right password,
+        // wrong password, no password, plain GET. Calibrate against that first.
+        if (pathNoQuery === "/wp-login.php" && e.method === "GET" && e.status >= 300 && e.status < 400) {
+            if (st)
+                st.hideLogin = true;
         }
         if (pathNoQuery === "/wp-login.php" && e.method === "POST" && e.status === 302) {
             loginOkIps.add(e.ip);
         }
+        // Corroboration: a session that actually authenticated goes on to load a
+        // wp-admin screen and gets a 2xx. An unauthenticated caller is bounced with
+        // a 3xx. Skip the wp-admin paths that answer 2xx to anonymous callers.
+        if (pathNoQuery.startsWith("/wp-admin/") && !ANON_ADMIN.test(pathNoQuery) && e.status >= 200 && e.status < 300) {
+            adminOkIps.add(e.ip);
+        }
         if (pathNoQuery === "/xmlrpc.php" && e.method === "POST") {
             xmlrpcByIp.set(e.ip, (xmlrpcByIp.get(e.ip) || 0) + 1);
+            noteHost(e.ip, e.host);
         }
         // A .php under uploads is never legitimate; under a plugin dir it's only
         // suspicious with a command-style or base64 query (webshell invocation).
@@ -111,18 +172,23 @@ function analyze(lines, cfg, windowSec) {
             const cur = webshell.get(pathNoQuery) || { ip: e.ip, count: 0 };
             cur.count++;
             webshell.set(pathNoQuery, cur);
+            noteHost(pathNoQuery, e.host);
         }
     }
     const findings = [];
     // Correlation is the highest-signal event — flag it before the standalone
     // batch/v1 finding so it leads.
+    // Only call it a takeover when the login status is trustworthy for this site
+    // AND the IP went on to load an admin screen successfully. Either half alone
+    // produced a false "account takeover" page on archpaper.com, 2026-08-23.
+    const authed = (ip) => !st?.hideLogin && loginOkIps.has(ip) && adminOkIps.has(ip);
     for (const [ip, count] of batchIps) {
-        if (loginOkIps.has(ip)) {
+        if (authed(ip)) {
             findings.push({
                 rule: "batch-then-login", key: `batch-login:${ip}`, severity: "error", ip,
                 path: "/wp-json/batch/v1",
                 title: "WP2Shell: exploit + admin login",
-                detail: `${ip}: batch/v1 exploit (${count}×) followed by a successful wp-login (HTTP 302) — likely account takeover`,
+                detail: `${ip}: batch/v1 exploit (${count}×)${onSites(ip)}, then a wp-login 302 AND an authenticated wp-admin page (2xx) — likely account takeover`,
             });
         }
         else {
@@ -130,7 +196,7 @@ function analyze(lines, cfg, windowSec) {
                 rule: "wp-batch-207", key: `batchv1:${ip}`, severity: "error", ip,
                 path: "/wp-json/batch/v1",
                 title: "WP2Shell batch/v1 exploit",
-                detail: `${ip}: POST /wp-json/batch/v1 → 207 (${count}×) — near-zero false positives`,
+                detail: `${ip}: POST /wp-json/batch/v1 → 207 (${count}×)${onSites(ip)} — near-zero false positives`,
             });
         }
     }
@@ -138,7 +204,7 @@ function analyze(lines, cfg, windowSec) {
         findings.push({
             rule: "webshell-exec", key: `webshell:${p}`, severity: "error", ip: v.ip, path: p,
             title: "Webshell execution",
-            detail: `${v.ip} invoked ${p} (${v.count}×) — executable PHP in an upload/plugin path`,
+            detail: `${v.ip} invoked ${p} (${v.count}×)${onSites(p)} — executable PHP in an upload/plugin path`,
         });
     }
     for (const [ip, count] of xmlrpcByIp) {
@@ -147,16 +213,19 @@ function analyze(lines, cfg, windowSec) {
                 rule: "xmlrpc-burst", key: `xmlrpc:${ip}`, severity: count >= burstThreshold * 5 ? "error" : "warning", ip,
                 path: "/xmlrpc.php",
                 title: "xmlrpc.php brute-force / amplification",
-                detail: `${ip}: ${count} POST /xmlrpc.php in ~${windowSec}s (threshold ${burstThreshold})`,
+                detail: `${ip}: ${count} POST /xmlrpc.php in ~${windowSec}s${onSites(ip)} (threshold ${burstThreshold})`,
             });
         }
     }
     const counts = {
         total,
         batchV1: [...batchIps.values()].reduce((a, b) => a + b, 0),
+        batchAttempts,
+        batchBlocked,
         xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
         webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
-        loginSuccess: loginOkIps.size,
+        loginSuccess: st?.hideLogin ? 0 : [...loginOkIps].filter((ip) => adminOkIps.has(ip)).length,
+        loginRedirectsAlways: !!st?.hideLogin,
     };
     return { findings, counts };
 }
@@ -189,7 +258,7 @@ export function createLogWatchPlugin() {
             }
             try {
                 const lines = await readNew(source, st);
-                const { findings, counts } = analyze(lines, cfg, windowSec);
+                const { findings, counts } = analyze(lines, cfg, windowSec, st);
                 await plugin.send({ name: label, source: label, path: source.path, window: windowSec, counts, findings }, uid);
             }
             catch (e) {

package/dist/plugins/monitoring/WebsitePlugin.js

@@ -1,7 +1,12 @@
 import * as http from "node:http";
 import * as https from "node:https";
+import * as net from "node:net";
 import { URL } from "node:url";
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// URL keeps IPv6 hosts bracketed ("[::1]"); net.isIP wants them bare.
+function isIpLiteral(hostname) {
+    return net.isIP(hostname.replace(/^\[|\]$/g, "")) !== 0;
+}
 // Low-level GET that can hit one host (`target`) while presenting a different
 // Host header. fetch() can't do this — Host is a forbidden header per the
 // Fetch spec and is silently dropped — so this uses Node's http/https
@@ -33,7 +38,20 @@ function rawGet(target, opts) {
             // target. Without it, Node derives SNI from headers.Host,
             // which would validate the cert against the WRONG hostname
             // (the public one, not the origin actually being dialed).
-            ...(u.protocol === "https:" ? { servername: u.hostname, rejectUnauthorized: !opts.insecure } : {}),
+            //
+            // SNI must be a DNS name: RFC 6066 forbids IP literals, and
+            // Node/bun throw ERR_INVALID_ARG_VALUE rather than ignoring
+            // one, which kills the whole agent at startup. When the origin
+            // is dialed by IP there is no name to pin, so omit servername
+            // and let validation match the IP against the cert's IP SANs —
+            // which is the right check for an IP target, and is what the
+            // Host header override is deliberately kept out of.
+            ...(u.protocol === "https:"
+                ? {
+                    ...(isIpLiteral(u.hostname) ? {} : { servername: u.hostname }),
+                    rejectUnauthorized: !opts.insecure,
+                }
+                : {}),
         }, (res) => {
             let body = "";
             res.on("data", (c) => { body += c; });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.23",
+  "version": "1.1.26",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",
@@ -49,6 +49,9 @@
     "url": "https://github.com/daemonitor/plugins/issues"
   },
   "homepage": "https://github.com/daemonitor/plugins#readme",
+  "overrides": {
+    "js-yaml": "^4.3.1"
+  },
   "scripts": {
     "build": "tsc",
     "test": "echo \"Error: no test specified\" && exit 1"