From 69510fb8809aab924fae143f7941fece39c54db1 Mon Sep 17 00:00:00 2001
From: anti <samuel@securejump.cl>
Date: Fri, 17 Apr 2026 22:51:34 -0400
Subject: [PATCH] fix(ssh-capture): cloak syslog relay pipe and cat process
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the rsyslog→stdout pipe from /var/run/decnet-logs (dead giveaway)
to /run/systemd/journal/syslog-relay, and launch the relay via
exec -a "systemd-journal-fwd" so ps shows a plausible systemd forwarder
instead of a bare cat. Casual ps/ls inspection now shows nothing
with "decnet" in the name.
---
 templates/ssh/Dockerfile    |  4 ++--
 templates/ssh/entrypoint.sh | 10 ++++++----
 tests/test_ssh.py           | 20 ++++++++++++++++++++
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/templates/ssh/Dockerfile b/templates/ssh/Dockerfile
index 5d2ef8e..0775100 100644
--- a/templates/ssh/Dockerfile
+++ b/templates/ssh/Dockerfile
@@ -36,8 +36,8 @@ RUN sed -i \
 RUN printf '%s\n' \
     '# DECNET log bridge — auth + user events → named pipe as RFC 5424' \
     '$template RFC5424fmt,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"' \
-    'auth,authpriv.*  |/var/run/decnet-logs;RFC5424fmt' \
-    'user.*           |/var/run/decnet-logs;RFC5424fmt' \
+    'auth,authpriv.*  |/run/systemd/journal/syslog-relay;RFC5424fmt' \
+    'user.*           |/run/systemd/journal/syslog-relay;RFC5424fmt' \
     > /etc/rsyslog.d/99-decnet.conf
 
 # Silence default catch-all rules so we own auth/user routing exclusively
diff --git a/templates/ssh/entrypoint.sh b/templates/ssh/entrypoint.sh
index 6d1c6ac..f495600 100644
--- a/templates/ssh/entrypoint.sh
+++ b/templates/ssh/entrypoint.sh
@@ -31,11 +31,13 @@ ls /var/www/html
 HIST
 fi
 
-# Logging pipeline: named pipe → rsyslogd (RFC 5424) → stdout → Docker log capture
-mkfifo /var/run/decnet-logs
+# Logging pipeline: named pipe → rsyslogd (RFC 5424) → stdout → Docker log capture.
+# Pipe lives under /run/systemd/journal/ and the relay process is cloaked via
+# exec -a so `ps aux` shows "systemd-journal-fwd" instead of a raw `cat`.
+mkdir -p /run/systemd/journal
+mkfifo /run/systemd/journal/syslog-relay
 
-# Relay pipe to stdout so Docker captures all syslog events
-cat /var/run/decnet-logs &
+bash -c 'exec -a "systemd-journal-fwd" cat /run/systemd/journal/syslog-relay' &
 
 # Start rsyslog (reads /etc/rsyslog.d/99-decnet.conf, writes to the pipe above)
 rsyslogd
diff --git a/tests/test_ssh.py b/tests/test_ssh.py
index 942ef9f..6317f8e 100644
--- a/tests/test_ssh.py
+++ b/tests/test_ssh.py
@@ -148,6 +148,26 @@ def test_entrypoint_creates_named_pipe():
     assert "mkfifo" in _entrypoint_text()
 
 
+def test_entrypoint_relay_pipe_path_is_disguised():
+    ep = _entrypoint_text()
+    # Pipe lives under /run/systemd/journal/, not the obvious /var/run/decnet-logs.
+    assert "/run/systemd/journal/syslog-relay" in ep
+    assert "decnet-logs" not in ep
+
+
+def test_entrypoint_cat_relay_is_cloaked():
+    ep = _entrypoint_text()
+    # `cat` is invoked via exec -a so ps shows systemd-journal-fwd.
+    assert "systemd-journal-fwd" in ep
+    assert "exec -a" in ep
+
+
+def test_dockerfile_rsyslog_uses_disguised_pipe():
+    df = _dockerfile_text()
+    assert "/run/systemd/journal/syslog-relay" in df
+    assert "decnet-logs" not in df
+
+
 def test_entrypoint_starts_rsyslogd():
     assert "rsyslogd" in _entrypoint_text()