From 865e923faabb0d9edb307f6ec1830dc521df4c60 Mon Sep 17 00:00:00 2001
From: lan-yonghui <yonghui.lan@fit2cloud.com>
Date: Thu, 24 Sep 2026 17:19:55 +0800
Subject: [PATCH] fix: enhance SSH login alert by adding local IP addresses to
 success login whitelist

---
 agent/app/service/alert_helper.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/agent/app/service/alert_helper.go b/agent/app/service/alert_helper.go
index d51c65317c0e..f9ca2e791111 100644
--- a/agent/app/service/alert_helper.go
+++ b/agent/app/service/alert_helper.go
@@ -530,11 +530,15 @@ func loadSSHLogin(alert dto.AlertDTO) {
 	if err != nil {
 		global.LOG.Errorf("Failed to load ssh login logs: %v", err)
 	}
+	interfaceAddrs, err := net.InterfaceAddrs()
+	if err != nil {
+		global.LOG.Warnf("Failed to load local IP addresses for ssh login alert: %v", err)
+	}
 	count, records := summarizeSSHLoginHistories(
 		histories,
 		now,
 		failedWindow,
-		strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n"),
+		sshSuccessLoginWhitelist(alert.AdvancedParams, interfaceAddrs),
 	)
 	isAlert := count >= int(alert.Count)
 	if isAlert {
@@ -570,6 +574,19 @@ func loadSSHLogin(alert dto.AlertDTO) {
 	}
 }
 
+func sshSuccessLoginWhitelist(configured string, interfaceAddrs []net.Addr) []string {
+	whitelist := strings.Split(strings.TrimSpace(configured), "\n")
+	whitelist = append(whitelist, "127.0.0.0/8", "::1")
+	for _, addr := range interfaceAddrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok || ipNet.IP == nil || ipNet.IP.IsUnspecified() {
+			continue
+		}
+		whitelist = append(whitelist, ipNet.IP.String())
+	}
+	return whitelist
+}
+
 func filterLoginLogsNotInWhitelist(records []model.LoginLog, whitelist []string) []model.LoginLog {
 	filtered := make([]model.LoginLog, 0, len(records))
 	for _, record := range records {