Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 2250 → Rev 2278

/scripts/alcasar-watchdog.sh
124,7 → 124,7
fi
# Remove the user's IP from 'current_users.txt'. Every user need to insert their @IP everytime to prove their connectivity.
sed -i "/^$active_ip/d" $current_users_file
else # "/tmp/current_user.txt" does not exists. We disconnect every users.
else # "current_user.txt" does not exists. We disconnect every users.
logger "alcasar-watchdog : The file /var/tmp/havp/current_users.txt doen't' exist. We disconnects the user $active_user"
/usr/sbin/chilli_query logout $active_mac
fi
132,9 → 132,9
# IP usurpation test : process only equipment with an authenticated user
if [[ $(expr $active_session) -eq 1 ]]
then
arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
# disconnect users whose equipement is usurped. For example, if there are 2 same @MAC it will make 3 lines in output.
if [[ $(expr $arp_reply) -gt 2 ]]
arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c1 -w4 $active_ip|grep -c "Unicast reply"`
# disconnect users whose equipement is usurped. For example, if there are 2 same @MAC it will make 2 lines in output.
if [[ $(expr $arp_reply) -gt 1 ]]
then
echo "$(date "+[%x-%X] : ")alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/security/watchdog.log
logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."