Subversion Repositories ALCASAR

Rev

Rev 2841 | Details | Compare with Previous | Last modification | View Log

Rev Author Line No. Line
2189 tom.houday 1
#!/bin/bash
2
# $Id: alcasar-activity_report.sh 3099 2022-12-28 11:30:30Z rexy $
3
#
2138 richard 4
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
5
# We read configuration files and logs to create cool charts.
2190 tom.houday 6
# Written by Raphaël PION, Rexy & Tom HOUDAYER
2009 raphael.pi 7
 
2474 tom.houday 8
CONF_FILE='/usr/local/etc/alcasar.conf'
2138 richard 9
# files
10
DIR_TMP="/var/tmp"
11
TMP_AV="$DIR_TMP/av_count.txt"
12
TMP_BL="$DIR_TMP/bl_count.txt"
13
TMP_BL_WEEK="$DIR_TMP/bl_count_week.txt"
14
TMP_BL_WEEK_CAT="$DIR_TMP/bl_count_week_cat.txt"
2009 raphael.pi 15
 
2138 richard 16
# Model loaded to create charts
17
DIR_BUILD="/var/www/html/acc/manager/activity_report/"
18
MODEL_CHARTJS="$DIR_BUILD/models/Chart.report.js"
19
MODEL_TABINFO="$DIR_BUILD/models/tabinfo.html"
2009 raphael.pi 20
 
2138 richard 21
# Where the report will be created.
22
HTML_REPORT="$DIR_BUILD/alcasar-report-$(date +%F).html"
2009 raphael.pi 23
 
2138 richard 24
# TIME VALUE
2009 raphael.pi 25
C_TS=$(date +"%s") #current timestamp
26
MAX_DAY_AGO=7
27
SECS_AGO=$(date --date="$MAX_DAY_AGO days ago" +"%s") #timestamp ago
28
STEP_TS=$((C_TS-$SECS_AGO)) #timestamp between current timestamp and SECS_AGO
29
 
2138 richard 30
# PRIVATE IP OF ALCASAR
2474 tom.houday 31
PRIVATE_IP=$(grep ^PRIVATE_IP= $CONF_FILE | cut -d'=' -f2 | cut -d'/' -f1)
2009 raphael.pi 32
 
2138 richard 33
# COLOR for charts
2009 raphael.pi 34
COLOR="'#ff0000','#3333cc','#009933','#993300','#1720EE','#D30229','#8D726D','#41C4E4','#8574F4','#A0BC1A','#BFDC1F','#5ADDC3','#B05744','#CD9319','#8CA39B','#D4AA1C','#A76752','#B03088','#445E87','#70424D','#D118C3','#46ABEF','#E9F197','#AEC0D4','#755C79','#94BBD7','#E2E9DC','#8B68D0','#F7EC7C','#1F16B8','#F4DA0A','#2EC17A','#E06483','#48B342','#F510CD','#9B2662','#180E98','#988FC1','#209E4E','#034240','#FDB142','#36B445','#CDD5C9','#6FA0DE','#EE2206','#204E19','#15FC93','#161ECE','#83D33B','#11A44A','#B7BF6C','#87274C','#B52C4F','#AD2805','#427E6C','#91341A','#191315','#FCB290','#13D3CD','#90F0E6','#C870C9','#AD2C14','#201D2A','#E4DB79','#90A919','#FE17FE','#09B35C','#88D950','#3440FC','#A9D42F','#E2DFAC','#DA69EC','#67430A','#43E94E','#5F7349','#22CF16','#CF038F','#0F6427','#F7AD0F','#C5E382','#DB49B6','#F760BF','#0BE701','#EF88D8','#79E6D7','#8A2D3D','#435A30','#A3C8AC','#99B118','#A929FF','#08A36D','#0A1654','#6F8283','#E1CA3E','#3E8577','#580FB6','#DB0E16','#386CBE','#FA0C43','#B713C9'"
35
 
2138 richard 36
# Values to create new htdigest user to consult statistique of ACC
2009 raphael.pi 37
DIR_KEY="/usr/local/etc/digest"
2644 lucas.echa 38
tmp_account="tmp_activityreport"
2009 raphael.pi 39
realm="ALCASAR Control Center (ACC)"
40
password=$(openssl rand -base64 32) #random password (length : 32)
41
SED="/usr/bin/sed -i "
2138 richard 42
TMP_STATS="$DIR_TMP/stats.html"
43
TMP_STATS_2="$DIR_TMP/stats2.html"
2009 raphael.pi 44
 
2138 richard 45
# if empty logs, replace charts by text.
2009 raphael.pi 46
ENABLE_BL=0
47
ENABLE_BL_WEEK=0
48
ENABLE_AV=0
49
 
50
if [ -e $TMP_AV ]
51
then
52
	rm $TMP_AV
53
fi
54
 
55
if [ -e $TMP_BL ]
56
then
2189 tom.houday 57
	rm $TMP_BL
2009 raphael.pi 58
fi
59
 
60
if [ -e $TMP_BL_WEEK ]
61
then
2189 tom.houday 62
	rm $TMP_BL_WEEK
2009 raphael.pi 63
fi
64
 
65
if [ -e $TMP_BL_WEEK_CAT ]
66
then
2189 tom.houday 67
	rm $TMP_BL_WEEK_CAT
2009 raphael.pi 68
fi
69
 
70
if [ -e $HTML_REPORT ]
71
then
2189 tom.houday 72
	rm $HTML_REPORT
2009 raphael.pi 73
fi
74
 
75
echo "<!doctype html>" >> $HTML_REPORT
76
echo "<html>" >> $HTML_REPORT
77
echo "<head>" >> $HTML_REPORT
2189 tom.houday 78
echo "<meta charset=\"utf-8\">" >> $HTML_REPORT
2009 raphael.pi 79
echo "<title>ALCASAR report</title>" >> $HTML_REPORT
2189 tom.houday 80
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/bootstrap.min.css\">" >> $HTML_REPORT
81
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/report.css\">" >> $HTML_REPORT
2317 tom.houday 82
echo "<script src=\"../../../js/Chart.bundle.min.js\"></script>" >> $HTML_REPORT
2189 tom.houday 83
echo "<script src=\"../../../js/jquery.min.js\"></script>" >> $HTML_REPORT
2009 raphael.pi 84
echo "</head>" >> $HTML_REPORT
85
echo "<body>" >> $HTML_REPORT
2474 tom.houday 86
echo "<h1><center>Rapport d'activité de l'ALCASAR-$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)</center></h1>" >> $HTML_REPORT
2189 tom.houday 87
echo "<i><p style=\"text-align: right;\">Date de création $(date +%F)</p></i>" >> $HTML_REPORT
88
echo "<font size=\"1\">" >> $HTML_REPORT
2009 raphael.pi 89
 
90
######################TABINFO######################
91
echo "Create information about system and ALCASAR"
92
#contain every information about ALCASAR configuration, system and last update
93
 
94
cat $MODEL_TABINFO | while read LINE_HTML
95
do
2688 lucas.echa 96
	if [ "$(echo $LINE_HTML | grep 'XXORGXX' | wc -l)" -eq 1 ]
97
	then
98
		VALUE=$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)
99
		echo ${LINE_HTML/XXORGXX/$VALUE} >> $HTML_REPORT
2009 raphael.pi 100
 
2688 lucas.echa 101
	elif [ "$(echo $LINE_HTML | grep 'XXINSTALLXX' | wc -l)" -eq 1 ]
2009 raphael.pi 102
	then
2688 lucas.echa 103
		VALUE=$(grep ^INSTALL_DATE= $CONF_FILE | cut -d'=' -f2)
104
		echo ${LINE_HTML/XXINSTALLXX/$VALUE} >> $HTML_REPORT
2009 raphael.pi 105
 
2688 lucas.echa 106
	elif [ "$(echo $LINE_HTML | grep 'XXAVERSIONXX' | wc -l)" -eq 1 ]
107
	then
108
		VALUE=$(grep ^VERSION= $CONF_FILE | cut -d'=' -f2)
109
		echo ${LINE_HTML/XXAVERSIONXX/$VALUE} >> $HTML_REPORT
110
 
111
	elif [ "$(echo $LINE_HTML | grep 'XXIP_PUBLICXX' | wc -l)" -eq 1 ]
112
	then
113
		VALUE=$(grep ^PUBLIC_IP= $CONF_FILE | cut -d'=' -f2)
114
		echo ${LINE_HTML/XXIP_PUBLICXX/$VALUE} >> $HTML_REPORT
115
 
116
	elif [ "$(echo $LINE_HTML | grep 'XXIP_PRIVEXX' | wc -l)" -eq 1 ]
117
	then
118
		VALUE=$(grep ^PRIVATE_IP= $CONF_FILE | cut -d'=' -f2)
119
		echo ${LINE_HTML/XXIP_PRIVEXX/$VALUE} >> $HTML_REPORT
120
 
121
	elif [ "$(echo $LINE_HTML | grep 'XXGWXX' | wc -l)" -eq 1 ]
122
	then
123
		VALUE=$(grep ^GW= $CONF_FILE | cut -d'=' -f2)
124
		echo ${LINE_HTML/XXGWXX/$VALUE} >> $HTML_REPORT
125
 
126
	elif [ "$(echo $LINE_HTML | grep 'XXDNS1XX' | wc -l)" -eq 1 ]
127
	then
128
		VALUE=$(grep ^DNS1= $CONF_FILE | cut -d'=' -f2)
129
		echo ${LINE_HTML/XXDNS1XX/$VALUE} >> $HTML_REPORT
130
 
131
	elif [ "$(echo $LINE_HTML | grep 'XXDNS2XX' | wc -l)" -eq 1 ]
132
	then
133
		VALUE=$(grep ^DNS2= $CONF_FILE | cut -d'=' -f2)
134
		echo ${LINE_HTML/XXDNS2XX/$VALUE} >> $HTML_REPORT
135
 
136
	elif [ "$(echo $LINE_HTML | grep 'XXHOSTXX' | wc -l)" -eq 1 ]
137
	then
138
		VALUE=$(hostname)
139
		echo ${LINE_HTML/XXHOSTXX/$VALUE} >> $HTML_REPORT
140
 
141
	elif [ "$(echo $LINE_HTML | grep 'XXOS_VERSIONXX' | wc -l)" -eq 1 ]
142
	then
143
		VALUE=$(echo "$(uname -r) [ $(uname -m) ]")
144
		echo ${LINE_HTML/XXOS_VERSIONXX/$VALUE} >> $HTML_REPORT
145
 
146
	elif [ "$(echo $LINE_HTML | grep 'XXREBOOTXX' | wc -l)" -eq 1 ]
147
	then
148
		VALUE=$(who -b | cut -d' ' -f12-)
149
		echo ${LINE_HTML/XXREBOOTXX/$VALUE} >> $HTML_REPORT
150
 
151
	elif [ "$(echo $LINE_HTML | grep 'XXMAJCLAMAVXX' | wc -l)" -eq 1 ]
152
	then
153
		VALUE=$(date -d "@$(rpm -qa --queryformat "%{installtime} %{name}\n" | grep -E "clamav-db" | cut -d' ' -f1 )" "+%Y-%m-%d %H:%M:%S")
154
		echo ${LINE_HTML/XXMAJCLAMAVXX/$VALUE} >> $HTML_REPORT
155
 
156
	elif [ "$(echo $LINE_HTML | grep 'XXMAJBLXX' | wc -l)" -eq 1 ]
157
	then
158
		VALUE=$(cat /etc/e2guardian/lists/blacklists/README | grep 'Last version' | cut -d' ' -f4-6)
159
		echo ${LINE_HTML/XXMAJBLXX/$VALUE} >> $HTML_REPORT
160
 
161
	elif [ "$(echo $LINE_HTML | grep 'XXRPMXX' | wc -l)" -eq 1 ]
162
	then
163
		#show every ALCASAR RPM updated since X day ago
164
		#get timestamp of X day ago. Then we get every packets chich have been updated since this date.
165
		if [ "$(rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | wc -l)" -gt 1 ]
166
		then
3099 rexy 167
			PACKAGE='php|lighttpd|iptables|unbound|radius|nfdump|e2guardian|clamav|ulogd|chilli|fail2ban|openssh|ipt-netflow|wget|mariadb|gnupg|openssl'
2688 lucas.echa 168
			rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | while read RPM_ALCASAR
169
			do
170
				RPM_TIMESTAMP=$(echo $RPM_ALCASAR | cut -d' ' -f1)
171
				RPM_DATE=$(date -d "@$(echo $RPM_TIMESTAMP)" "+%Y-%m-%d %H:%M:%S")
172
				RPM_NAME=$(echo $RPM_ALCASAR | cut -d' ' -f2)
173
				RPM_VERSION=$(echo $RPM_ALCASAR | cut -d' ' -f3)
174
 
175
				echo "<tr>" >> $HTML_REPORT
176
				echo "<td>$RPM_NAME</td>" >> $HTML_REPORT
177
				echo "<td>$RPM_DATE</td>" >> $HTML_REPORT
178
				echo "<td>$RPM_VERSION</td>" >> $HTML_REPORT
179
				echo "</tr>" >> $HTML_REPORT
180
			done
181
		else
182
			echo "<tr><td colspan=\"3\">Pas de RPM mis à jour cette semaine</td></tr>" >> $HTML_REPORT
183
		fi
2009 raphael.pi 184
	else
2688 lucas.echa 185
		echo $LINE_HTML >> $HTML_REPORT
2009 raphael.pi 186
	fi
187
done
188
 
189
######################BL WEBSITE SINCE INSTALLATION######################
190
echo "Create BL website since the installation of ALCASAR"
191
#find data
192
 
193
#decompress every logs
2688 lucas.echa 194
if [ "$(ls -1 /var/log/unbound/unbound-blacklist.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
2009 raphael.pi 195
then
2688 lucas.echa 196
	gunzip -d unbound-blacklist.log.*.gz
2009 raphael.pi 197
fi
198
 
199
#convert logs date in timestamp and find categories of blacklisted website
2688 lucas.echa 200
tmp_log=$(mktemp)
201
for FILE in /var/log/unbound/unbound-blacklist.log*
2009 raphael.pi 202
do
2688 lucas.echa 203
	grep -E "info: [^ ]+ typetransparent $PRIVATE_IP" /var/log/unbound/unbound-blacklist.log > $tmp_log
2009 raphael.pi 204
	while read LOG_BL
205
	do
2688 lucas.echa 206
		# find the current blacklisted category
207
		website_bl=$(echo $LOG_BL | cut -d' ' -f4)
208
		website_bl=${website_bl%?} # remove the last character
209
 
210
		#we convert www.test.co.uk => test.co.uk to find the category of this website
211
		if [ "$(grep -o '\.' <<< "$website_bl" | wc -l)" -ge "2" ]
2454 tom.houday 212
		then
2688 lucas.echa 213
			website_bl=$(echo $website_bl | cut -d'.' -f2-)
214
		fi
2009 raphael.pi 215
 
2688 lucas.echa 216
		#get BL category
217
		categorie_bl=$(grep -Rl "$website_bl" /usr/local/share/unbound-bl-enabled/ | cut -d'/' -f6 | head -1)
218
 
219
		CURRENT_TS=$(echo $LOG_BL | cut -d '[' -f2 | cut -d ']' -f1)
220
		echo "$CURRENT_TS:$categorie_bl:" >> $TMP_BL
221
	done < $tmp_log
2009 raphael.pi 222
done
2688 lucas.echa 223
rm $tmp_log
2009 raphael.pi 224
 
225
#if data exists, create this section in html document
226
if [ -e $TMP_BL ]
227
then
228
	ENABLE_BL=1
229
	#count every BL website consulted since installation (maximum 1 year)
230
	DATE_END=$(cat $TMP_BL | cut -d':' -f1 | sort -n | head -1 )
231
 
232
 
233
	for TS in $(seq $C_TS -$STEP_TS $DATE_END)
234
	do
235
		DATE_1=$TS
236
		DATE_2=$((TS-$STEP_TS))
2688 lucas.echa 237
		COUNT_BL_INSTALLATION=0
238
 
2009 raphael.pi 239
		for LINE in $(cat $TMP_BL)
240
		do
241
			TS_FILE=$(echo $LINE | cut -d':' -f1)
2688 lucas.echa 242
 
243
			if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2454 tom.houday 244
			then
2009 raphael.pi 245
				COUNT_BL_INSTALLATION=$((COUNT_BL_INSTALLATION+1))
246
			fi
247
		done
2688 lucas.echa 248
 
2009 raphael.pi 249
		VALUE_BL_INSTALLATION_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_BL_INSTALLATION_LABEL"
250
		VALUE_BL_INSTALLATION_DATA="$COUNT_BL_INSTALLATION, $VALUE_BL_INSTALLATION_DATA"
251
	done
252
 
253
	#create Antivirus section in html document
254
	NAME_BL_INSTALLATION='chart_bl_installation'
255
	CONF_BL_INSTALLATION='config_bl_installation'
256
	echo "<center>" >> $HTML_REPORT
257
	echo "<canvas id='$NAME_BL_INSTALLATION' width='450' height='450'></canvas>" >> $HTML_REPORT
258
	echo "</center>" >> $HTML_REPORT
259
 
260
	#create chart bar in html file with javascript (chartjs.com)
261
	echo "<script>" >> $HTML_REPORT
262
	cat $MODEL_CHARTJS | while read LINE_JS
263
	do
264
		#name of variable
2688 lucas.echa 265
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 266
		then
267
			echo ${LINE_JS/XXCONFXX/$CONF_BL_INSTALLATION} >> $HTML_REPORT
268
		#chart type
2688 lucas.echa 269
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 270
		then
271
			echo ${LINE_JS/XXTYPEXX/bar} >> $HTML_REPORT
272
		#chart title
2688 lucas.echa 273
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2454 tom.houday 274
		then
2009 raphael.pi 275
			echo ${LINE_JS/XXTITLEXX/"Sites bloqués au total"} >> $HTML_REPORT
276
		#chart data
2688 lucas.echa 277
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 278
		then
279
			echo ${LINE_JS/XXDATAXX/$VALUE_BL_INSTALLATION_DATA} >> $HTML_REPORT
280
		#color
2688 lucas.echa 281
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 282
		then
283
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
284
		#labels
2688 lucas.echa 285
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 286
		then
287
			echo ${LINE_JS/XXLABELSXX/$VALUE_BL_INSTALLATION_LABEL} >> $HTML_REPORT
2688 lucas.echa 288
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 289
		then
290
			echo ${LINE_JS/XXLEGENDXX/false} >> $HTML_REPORT
291
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 292
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 293
		then
294
			echo "" >> $HTML_REPORT
295
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 296
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 297
		then
298
			echo "" >> $HTML_REPORT
2688 lucas.echa 299
		elif [ "$(echo $LINE_JS | grep 'XXYLABELXX' | wc -l)" -eq 1 ]
2009 raphael.pi 300
		then
2013 raphael.pi 301
			echo "\"Nombre de site bloqué par la blacklist\"" >> $HTML_REPORT
2009 raphael.pi 302
		else
303
			echo $LINE_JS >> $HTML_REPORT
304
		fi
305
	done
306
	echo "</script>" >> $HTML_REPORT
307
else
2209 tom.houday 308
	echo "<h2>Aucune activité de la Blacklist depuis l'installation.</h2>" >> $HTML_REPORT
2009 raphael.pi 309
fi
310
 
311
 
312
 
2688 lucas.echa 313
######################Unbound BLACKLIST######################
2009 raphael.pi 314
echo "Create BL website since $MAX_DAY_AGO days"
315
 
316
#if data exists, create BL section in html document
317
if [ -e $TMP_BL ]
318
then
319
	ENABLE_BL_WEEK=1
320
	#find data
321
	#count every BL website consulted since DAYS_AGO
322
	DATE_1=$C_TS
323
	DATE_2=$((DATE_1-$STEP_TS))
324
 
2287 tom.houday 325
	touch $TMP_BL_WEEK
326
 
2009 raphael.pi 327
	for LINE in $(cat $TMP_BL)
328
	do
329
		TS_FILE=$(echo $LINE | cut -d':' -f1)
330
		#select only elements between DATE_1 and DATE_2
2688 lucas.echa 331
		if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2454 tom.houday 332
		then
2009 raphael.pi 333
			echo $LINE >> $TMP_BL_WEEK
334
		fi
335
	done
336
 
337
	#then we count every occurence for each category in TMP_BL_WEEK
2688 lucas.echa 338
	for CAT in $(ls /usr/local/share/unbound-bl/ -1 | cut -d'.' -f1)
2009 raphael.pi 339
	do
2189 tom.houday 340
		echo "$CAT:$(grep -o ":$CAT:" <<< "$(cat $TMP_BL_WEEK)" | wc -l):" >> $TMP_BL_WEEK_CAT
2009 raphael.pi 341
	done
342
 
343
	#we sort by number of occurence and we take the top 10 BL categories
344
	for LINE in $(sort -t':' -k2 -rn $TMP_BL_WEEK_CAT | head -n 10)
345
	do
2688 lucas.echa 346
 
2009 raphael.pi 347
		DATA=$(echo $LINE | cut -d':' -f2)
348
		LABEL=$(echo $LINE | cut -d':' -f1)
349
		if [ $DATA -ne 0 ]
350
		then
2189 tom.houday 351
			VALUE_BL_DATA="$VALUE_BL_DATA $DATA, "
352
			VALUE_BL_LABEL="$VALUE_BL_LABEL '$LABEL ($DATA)',"
2009 raphael.pi 353
		fi
354
	done
355
 
356
	#get other categories (sum them all)
2688 lucas.echa 357
	if [ "$(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc)" -gt 0 ]
2189 tom.houday 358
	then
2454 tom.houday 359
		VALUE_BL_DATA="$VALUE_BL_DATA $(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc)"
360
		VALUE_BL_LABEL="$VALUE_BL_LABEL 'autre ($(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc))'"
2189 tom.houday 361
	fi
2009 raphael.pi 362
 
363
	#create chart pie in html file with javascript (chartjs.com)
364
	NAME_BL='chart_bl'
365
	CONF_BL='config_bl'
366
	echo "<center>" >> $HTML_REPORT
367
	echo "<canvas id='$NAME_BL' width='450' height='450' ></canvas>" >> $HTML_REPORT
368
	echo "</center>" >> $HTML_REPORT
369
	echo "<script>" >> $HTML_REPORT
2189 tom.houday 370
 
2009 raphael.pi 371
	cat $MODEL_CHARTJS | while read LINE_JS
372
	do
373
		#variable name
2688 lucas.echa 374
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 375
		then
376
			echo ${LINE_JS/XXCONFXX/$CONF_BL} >> $HTML_REPORT
377
		#chart type
2688 lucas.echa 378
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 379
		then
380
			echo ${LINE_JS/XXTYPEXX/pie} >> $HTML_REPORT
381
		#graph title
2688 lucas.echa 382
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 383
		then
2189 tom.houday 384
			echo ${LINE_JS/XXTITLEXX/"Sites bloqués cette semaine"} >> $HTML_REPORT
2009 raphael.pi 385
		#chart data
2688 lucas.echa 386
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 387
		then
388
			echo ${LINE_JS/XXDATAXX/$VALUE_BL_DATA} >> $HTML_REPORT
389
		#color
2688 lucas.echa 390
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 391
		then
392
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
393
		#labels
2688 lucas.echa 394
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 395
		then
396
			echo ${LINE_JS/XXLABELSXX/$VALUE_BL_LABEL} >> $HTML_REPORT
397
		#display legend, only useful for chart pie
2688 lucas.echa 398
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 399
		then
400
			echo ${LINE_JS/XXLEGENDXX/true} >> $HTML_REPORT
401
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 402
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 403
		then
404
			echo "/*" >> $HTML_REPORT
405
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 406
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 407
		then
408
			echo "*/" >> $HTML_REPORT
409
		else
410
			echo $LINE_JS >> $HTML_REPORT
411
		fi
412
	done
413
	echo "</script>" >> $HTML_REPORT
414
else
2209 tom.houday 415
	echo "<h2>Aucune activité de la Blacklist cette semaine.</h2>" >> $HTML_REPORT
2009 raphael.pi 416
fi
417
 
418
######################VIRUS THREAT######################
419
echo "Create AV logs since the installation of ALCASAR"
420
 
421
#decompress every logs, if they exist
2841 rexy 422
if [ "$(ls -1 /var/log/clamav/clamd.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
2009 raphael.pi 423
then
2841 rexy 424
	gunzip -d clamd.log.*.gz
2009 raphael.pi 425
fi
426
 
2841 rexy 427
for FILE in /var/log/clamav/clamd.log*
2009 raphael.pi 428
do
429
	while read LINE_AV
430
	do
2841 rexy 431
		if [ "`echo $LINE_AV|grep -c FOUND`" == 1 ]
432
		then
433
			Y=$(echo $LINE_AV | cut -d' ' -f5)
434
			M=$(echo $LINE_AV | cut -d' ' -f2)
435
			D=$(echo $LINE_AV | cut -d' ' -f3)
436
			H=$(echo $LINE_AV | cut -d' ' -f4)
437
			CURRENT_TS=$(date -d "$M $D $Y $H" +"%s")
438
			echo $CURRENT_TS >> $TMP_AV
439
		fi
2688 lucas.echa 440
	done < $FILE
2009 raphael.pi 441
done
442
 
443
if [ -e $TMP_AV ]
444
then
445
	ENABLE_AV=1
446
	DATE_END=$(cat $TMP_AV | sort -n | head -1)
447
	for TS in $(seq $C_TS -$STEP_TS $DATE_END)
448
	do
449
		DATE_1=$TS
450
		DATE_2=$((TS-$STEP_TS))
2189 tom.houday 451
		COUNT_AV=0
2009 raphael.pi 452
 
453
		for TS_FILE in $(cat $TMP_AV)
454
		do
2688 lucas.echa 455
			if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2189 tom.houday 456
			then
2009 raphael.pi 457
				COUNT_AV=$((COUNT_AV+1))
458
			fi
459
		done
2189 tom.houday 460
 
2009 raphael.pi 461
		VALUE_AV_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_AV_LABEL"
462
		VALUE_AV_DATA="$COUNT_AV, $VALUE_AV_DATA"
463
	done
2688 lucas.echa 464
 
2009 raphael.pi 465
	#create Antivirus section in html document
466
	NAME_AV='chart_av'
467
	CONF_AV='config_av'
468
	echo "<center>" >> $HTML_REPORT
469
	echo "<canvas id='$NAME_AV' width='450' height='450' ></canvas>" >> $HTML_REPORT
470
	echo "</center>" >> $HTML_REPORT
471
 
472
 
473
	#create chart bar in html file with javascript (chartjs.com)
474
	echo "<script>" >> $HTML_REPORT
475
	cat $MODEL_CHARTJS | while read LINE_JS
476
	do
477
		#name of variable
2688 lucas.echa 478
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 479
		then
480
			echo ${LINE_JS/XXCONFXX/$CONF_AV} >> $HTML_REPORT
481
		#chart type
2688 lucas.echa 482
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 483
		then
484
			echo ${LINE_JS/XXTYPEXX/bar} >> $HTML_REPORT
485
		#graph title
2688 lucas.echa 486
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 487
		then
2189 tom.houday 488
			echo ${LINE_JS/XXTITLEXX/"Menaces bloqués par l\'antivirus"} >> $HTML_REPORT
2009 raphael.pi 489
		#chart data
2688 lucas.echa 490
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 491
		then
492
			echo ${LINE_JS/XXDATAXX/$VALUE_AV_DATA} >> $HTML_REPORT
493
		#color
2688 lucas.echa 494
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 495
		then
496
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
497
		#labels
2688 lucas.echa 498
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 499
		then
500
			echo ${LINE_JS/XXLABELSXX/$VALUE_AV_LABEL} >> $HTML_REPORT
2688 lucas.echa 501
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 502
		then
503
			echo ${LINE_JS/XXLEGENDXX/false} >> $HTML_REPORT
504
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 505
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 506
		then
507
			echo "" >> $HTML_REPORT
508
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 509
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 510
		then
511
			echo "" >> $HTML_REPORT
2688 lucas.echa 512
		elif [ "$(echo $LINE_JS | grep 'XXYLABELXX' | wc -l)" -eq 1 ]
2009 raphael.pi 513
		then
2013 raphael.pi 514
			echo "\"Nombre de menaces virales bloqués par l'antivirus\"" >> $HTML_REPORT
2009 raphael.pi 515
		else
516
			echo $LINE_JS >> $HTML_REPORT
517
		fi
518
	done
519
	echo "</script>" >> $HTML_REPORT
520
else
2209 tom.houday 521
	echo "<h2>Aucune menace virale.</h2>" >> $HTML_REPORT
2009 raphael.pi 522
fi
523
 
524
 
525
######################ALCASAR : DAILY USE######################
526
echo "Get daily use connection of the week"
527
#create html document
2209 tom.houday 528
echo "<h2>Statistiques volumétrie connexions</h2>" >> $HTML_REPORT
2009 raphael.pi 529
 
530
#create new htdigest user to consult statistique of ACC
531
#if user does not exist, we create him
2688 lucas.echa 532
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -lt 1 ]
2009 raphael.pi 533
then
2189 tom.houday 534
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_only_manager
535
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_manager
536
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_all
537
	chown -R root:apache $DIR_KEY
538
	chmod 640 $DIR_KEY/key_*
2009 raphael.pi 539
fi
540
 
541
#get stats.php from ACC
2138 richard 542
wget -q -nv --user $tmp_account --password $password https://alcasar/acc/manager/htdocs/stats.php -O $TMP_STATS --no-check-certificate
2009 raphael.pi 543
 
544
#clean this file to include it in html report.
545
DELIM_1="<td colspan=10 height=20><img src=\"images\/pixel.gif\"><\/td>"
546
DELIM_2="<\/td><\/tr> <\/table> <\/td><\/tr> <\/table> <\/td><\/tr> <\/table> <p>"
547
cat $TMP_STATS | sed -n "/$DELIM_1/,/$DELIM_2/p" | tail -n+3 | head -n-2 >> $TMP_STATS_2
548
cat $TMP_STATS_2 | sed -e 's:images/pixel.gif:../../manager/htdocs/images/pixel.gif:g' >> $HTML_REPORT
549
 
550
#we delete our user if he still exists
2688 lucas.echa 551
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -ge 1 ]
2009 raphael.pi 552
then
2189 tom.houday 553
	$SED "/^$tmp_account:/d" $DIR_KEY/key_only_manager
554
	$SED "/^$tmp_account:/d" $DIR_KEY/key_manager
555
	$SED "/^$tmp_account:/d" $DIR_KEY/key_all
2009 raphael.pi 556
fi
557
 
2190 tom.houday 558
 
559
###################### ALCASAR : LOG ACCESS ######################
560
echo "Get ACC log access of the week"
561
 
2209 tom.houday 562
ROWS=""
563
while read -r access ; do
2267 richard 564
	access_datas=(${access//|/ })
2190 tom.houday 565
 
2209 tom.houday 566
	accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
567
	access_date=$(date -d "$accces_date_intl" +%s)
568
	access_user=${access_datas[2]}
569
	access_ip=${access_datas[3]}
2286 tom.houday 570
	access_agent=$(echo "$access" | cut -d'|' -f4)
2209 tom.houday 571
	if [ $access_date -lt $SECS_AGO ]; then
572
		break
573
	fi
2190 tom.houday 574
 
2209 tom.houday 575
	access_date_formatted=$(date -d @$access_date +"%x %X")
576
 
2267 richard 577
	ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td><td>$access_agent</td></tr>"
578
done < <(cat /var/Save/security/acc_access.log | sort -r)
2209 tom.houday 579
# TODO: Read archives if necessary
580
 
581
if [ -z "$ROWS" ]; then
2267 richard 582
	ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucune connexion</td></tr>"
2190 tom.houday 583
fi
584
 
2209 tom.houday 585
# Create HTML document
586
echo "<h2>Connexion à l'ALCASAR Control Center (ACC)</h2>" >> $HTML_REPORT
587
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
2267 richard 588
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th><th>Agent</th></tr></thead><tbody>" >> $HTML_REPORT
2688 lucas.echa 589
echo "$ROWS" >> $HTML_REPORT
2209 tom.houday 590
echo "</tbody></table>" >> $HTML_REPORT
2190 tom.houday 591
 
2209 tom.houday 592
 
2190 tom.houday 593
###################### ALCASAR : GLOBAL TRAFFIC ######################
594
echo "Get Global traffic of the last 30 days"
595
 
596
ROWS=""
2474 tom.houday 597
EXTIF=$(grep ^EXTIF= $CONF_FILE | cut -d'=' -f2)
2190 tom.houday 598
for day in $(vnstat --exportdb -i $EXTIF | grep '^d;' | sort -t";" -k3 -r); do
599
	day_datas=(${day//;/ })
600
	day_date=${day_datas[2]}
601
	day_rxMio=${day_datas[3]}
602
	day_txMio=${day_datas[4]}
603
	day_rxKio=${day_datas[5]}
604
	day_txKio=${day_datas[6]}
605
	day_act=${day_datas[7]}
606
 
607
	if [ $day_act -ne 1 ]; then
608
		continue
609
	fi
610
 
611
	if [ $day_date -lt $SECS_AGO ]; then
612
		break
613
	fi
614
 
2209 tom.houday 615
	day_date_formatted=$(date -d @$day_date +%x)
2190 tom.houday 616
	day_rx=$(($day_rxMio * 1048576 + $day_rxKio * 1024))
617
	day_tx=$(($day_txMio * 1048576 + $day_txKio * 1024))
618
	day_total=$(($day_rx + $day_tx))
2209 tom.houday 619
	day_rx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_rx)
620
	day_tx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_tx)
621
	day_total_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_total)
2190 tom.houday 622
 
2209 tom.houday 623
	ROWS="$ROWS<tr><td>$day_date_formatted</td><td>$day_rx_formatted</td><td>$day_tx_formatted</td><td>$day_total_formatted</td></tr>"
2190 tom.houday 624
done
625
 
2209 tom.houday 626
if [ -z "$ROWS" ]; then
627
	ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
628
fi
629
 
2190 tom.houday 630
# Create html document
2209 tom.houday 631
echo "<h2>Trafic global</h2>" >> $HTML_REPORT
2190 tom.houday 632
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
633
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
2688 lucas.echa 634
echo "$ROWS" >> $HTML_REPORT
2190 tom.houday 635
echo "</tbody></table>" >> $HTML_REPORT
636
 
637
 
638
###################### ALCASAR : FAIL2BAN ######################
639
echo "Get fail2ban log of the week"
640
 
2209 tom.houday 641
ROWS=""
642
dateDaysAgo_formatted=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
643
while read -r log ; do
2190 tom.houday 644
	log_datas=($log)
645
	log_date="${log_datas[0]} ${log_datas[1]}"
646
	log_type=${log_datas[4]:1:-1}
647
	log_ip=${log_datas[6]}
2209 tom.houday 648
	log_date_formatted=$(date -d "$log_date" +"%x %X")
2190 tom.houday 649
 
2209 tom.houday 650
	ROWS="$ROWS<tr><td>$log_date_formatted</td><td>$log_ip</td><td>$log_type</td></tr>"
651
done < <(grep " Ban " /var/log/fail2ban.log | sort -r | awk -v dateDaysAgo="$dateDaysAgo_formatted" '($1 " " $2) >= dateDaysAgo')
2190 tom.houday 652
 
2209 tom.houday 653
if [ -z "$ROWS" ]; then
654
	ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
655
fi
656
 
657
# Create html document
658
echo "<h2>Adresse(s) IP bloquée(s) (Fail2Ban)</h2>" >> $HTML_REPORT
659
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
660
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
661
echo $ROWS >> $HTML_REPORT
2190 tom.houday 662
echo "</tbody></table>" >> $HTML_REPORT
663
 
664
 
2009 raphael.pi 665
######################FIN HTML######################
666
 
667
#Execute our javascript function to print charts
668
echo "<script>window.onload = function() {" >> $HTML_REPORT
669
#BL SINCE INSTALLATION
670
if [ $ENABLE_BL -eq "1" ]
671
then
672
	echo "var ctx_$NAME_BL_INSTALLATION = document.getElementById('$NAME_BL_INSTALLATION').getContext('2d');" >> $HTML_REPORT
673
	echo "var $NAME_BL_INSTALLATION = new Chart(ctx_$NAME_BL_INSTALLATION, $CONF_BL_INSTALLATION);" >> $HTML_REPORT
674
fi
675
#BL WEEK
676
if [ $ENABLE_BL_WEEK -eq "1" ]
677
then
678
	echo "var ctx_$NAME_BL = document.getElementById('$NAME_BL').getContext('2d');" >> $HTML_REPORT
679
	echo "var $NAME_BL = new Chart(ctx_$NAME_BL, $CONF_BL);" >> $HTML_REPORT
680
fi
681
#VIRUS THREAT
682
if [ $ENABLE_AV -eq "1" ]
683
then
684
	echo "var ctx_$NAME_AV = document.getElementById('$NAME_AV').getContext('2d');" >> $HTML_REPORT
685
	echo "var $NAME_AV = new Chart(ctx_$NAME_AV, $CONF_AV);" >> $HTML_REPORT
686
fi
687
echo "};</script>" >> $HTML_REPORT
688
echo "</body>" >> $HTML_REPORT
689
echo "</html>" >> $HTML_REPORT
690
 
691
#convert html document to PDF
2688 lucas.echa 692
/usr/bin/wkhtmltopdf $HTML_REPORT "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
693
chown apache:apache "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
694
chmod 644 "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
695
mv "$(echo $HTML_REPORT | cut -d'.' -f1).pdf" /var/Save/activity_report/
2009 raphael.pi 696
 
2013 raphael.pi 697
#compress every logs, if they exist
2841 rexy 698
if [ "$(ls -1 /var/log/clamav/clamd.log.* 2>/dev/null | wc -l)" -ge 1 ]
2013 raphael.pi 699
then
2841 rexy 700
	gzip /var/log/clamav/clamd.log.*
2013 raphael.pi 701
fi
702
 
703
#compress every logs
2688 lucas.echa 704
if [ "$(ls -1 /var/log/unbound/unbound-blacklist.log.* 2>/dev/null | wc -l)" -ge 1 ]
2013 raphael.pi 705
then
2688 lucas.echa 706
	gzip /var/log/unbound/unbound-blacklist.log.*
2013 raphael.pi 707
fi
708
 
709
#remove our files
2141 richard 710
rm -f $TMP_BL
711
rm -f $TMP_BL_WEEK
712
rm -f $TMP_BL_WEEK_CAT
713
rm -f $TMP_STATS
714
rm -f $TMP_STATS_2
715
rm -f $HTML_REPORT