Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 2208 → Rev 2209

/scripts/alcasar-activity_report.sh
315,7 → 315,7
done
echo "</script>" >> $HTML_REPORT
else
echo "<h3>Aucune activité de la Blacklist depuis l'installation.</h3>" >> $HTML_REPORT
echo "<h2>Aucune activité de la Blacklist depuis l'installation.</h2>" >> $HTML_REPORT
fi
 
 
420,7 → 420,7
done
echo "</script>" >> $HTML_REPORT
else
echo "<h3>Aucune activité de la Blacklist cette semaine.</h3>" >> $HTML_REPORT
echo "<h2>Aucune activité de la Blacklist cette semaine.</h2>" >> $HTML_REPORT
fi
 
######################VIRUS THREAT######################
524,7 → 524,7
done
echo "</script>" >> $HTML_REPORT
else
echo "<h3>Aucune menace virale.</h3>" >> $HTML_REPORT
echo "<h2>Aucune menace virale.</h2>" >> $HTML_REPORT
fi
 
 
531,7 → 531,7
######################ALCASAR : DAILY USE######################
echo "Get daily use connection of the week"
#create html document
echo "<h3>Statistiques volumétrie connexions</h3>" >> $HTML_REPORT
echo "<h2>Statistiques volumétrie connexions</h2>" >> $HTML_REPORT
 
#create new htdigest user to consult statistique of ACC
#if user does not exist, we create him
564,43 → 564,43
 
###################### ALCASAR : LOG ACCESS ######################
echo "Get ACC log access of the week"
#create html document
echo "<h3>Connexion à l'ALCASAR Control Center (ACC)</h3>" >> $HTML_REPORT
 
#create new htdigest user to consult statistique of ACC
#if user does not exist, we create him
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -lt 1 ]
then
(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_only_manager
(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_manager
(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_all
chown -R root:apache $DIR_KEY
chmod 640 $DIR_KEY/key_*
fi
ROWS=""
while read -r access ; do
access_datas=(${access//|||/ })
 
#get admin_log.php from ACC
wget -q -nv --user $tmp_account --password $password "https://alcasar/acc/admin_log.php?startTime=$SECS_AGO" -O $TMP_STATS --no-check-certificate
accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
access_date=$(date -d "$accces_date_intl" +%s)
access_user=${access_datas[2]}
access_ip=${access_datas[3]}
 
#clean this file to include it in html report.
DELIM_1="<table class=\"table table-striped\">"
DELIM_2="<\/table>"
cat $TMP_STATS | sed -n "/$DELIM_1/,/$DELIM_2/p" > $TMP_STATS_2
cat $TMP_STATS_2 | sed -e 's:images/pixel.gif:../../manager/htdocs/images/pixel.gif:g' >> $HTML_REPORT
if [ $access_date -lt $SECS_AGO ]; then
break
fi
 
#we delete our user if he still exists
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -ge 1 ]
then
$SED "/^$tmp_account:/d" $DIR_KEY/key_only_manager
$SED "/^$tmp_account:/d" $DIR_KEY/key_manager
$SED "/^$tmp_account:/d" $DIR_KEY/key_all
access_date_formatted=$(date -d @$access_date +"%x %X")
 
ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td></tr>"
done < <(cat /var/www/html/acc/admin_log.txt | sort -r)
# TODO: Read archives if necessary
 
if [ -z "$ROWS" ]; then
ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune connexion</td></tr>"
fi
 
# Create HTML document
echo "<h2>Connexion à l'ALCASAR Control Center (ACC)</h2>" >> $HTML_REPORT
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th></tr></thead><tbody>" >> $HTML_REPORT
echo $ROWS >> $HTML_REPORT
echo "</tbody></table>" >> $HTML_REPORT
 
 
###################### ALCASAR : GLOBAL TRAFFIC ######################
echo "Get Global traffic of the last 30 days"
 
ROWS=""
EXTIF=$(cat /usr/local/etc/alcasar.conf | grep EXTIF | cut -d'=' -f2)
EXTIF=$(cat /usr/local/etc/alcasar.conf | grep '^EXTIF=' | cut -d'=' -f2)
for day in $(vnstat --exportdb -i $EXTIF | grep '^d;' | sort -t";" -k3 -r); do
day_datas=(${day//;/ })
day_date=${day_datas[2]}
618,19 → 618,23
break
fi
 
day_dateFormated=$(date -d @$day_date +%x)
day_date_formatted=$(date -d @$day_date +%x)
day_rx=$(($day_rxMio * 1048576 + $day_rxKio * 1024))
day_tx=$(($day_txMio * 1048576 + $day_txKio * 1024))
day_total=$(($day_rx + $day_tx))
day_rxFormated=$(numfmt --from=iec --to=iec --suffix=B $day_rx)
day_txFormated=$(numfmt --from=iec --to=iec --suffix=B $day_tx)
day_totalFormated=$(numfmt --from=iec --to=iec --suffix=B $day_total)
day_rx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_rx)
day_tx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_tx)
day_total_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_total)
 
ROWS="$ROWS<tr><td>$day_dateFormated</td><td>$day_rxFormated</td><td>$day_txFormated</td><td>$day_totalFormated</td></tr>"
ROWS="$ROWS<tr><td>$day_date_formatted</td><td>$day_rx_formatted</td><td>$day_tx_formatted</td><td>$day_total_formatted</td></tr>"
done
 
if [ -z "$ROWS" ]; then
ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
fi
 
# Create html document
echo "<h3>Trafic global</h3>" >> $HTML_REPORT
echo "<h2>Trafic global</h2>" >> $HTML_REPORT
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
echo $ROWS >> $HTML_REPORT
640,23 → 644,27
###################### ALCASAR : FAIL2BAN ######################
echo "Get fail2ban log of the week"
 
# Create html document
echo "<h3>Adresse(s) IP bloquée(s) (Fail2Ban)</h3>" >> $HTML_REPORT
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
 
DATE_1_WEEK_AGO=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
# TODO: awk compare date [$1] AND hour [$2] (currently only date is compared)
grep " Ban " /var/log/fail2ban.log | sort -r | awk '$1 >= "$DATE_1_WEEK_AGO"' | while read -r log ; do
ROWS=""
dateDaysAgo_formatted=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
while read -r log ; do
log_datas=($log)
log_date="${log_datas[0]} ${log_datas[1]}"
log_type=${log_datas[4]:1:-1}
log_ip=${log_datas[6]}
log_dateFormated=$(date -d "$log_date" +"%x %X")
log_date_formatted=$(date -d "$log_date" +"%x %X")
 
echo "<tr><td>$log_dateFormated</td><td>$log_ip</td><td>$log_type</td></tr>" >> $HTML_REPORT
done
ROWS="$ROWS<tr><td>$log_date_formatted</td><td>$log_ip</td><td>$log_type</td></tr>"
done < <(grep " Ban " /var/log/fail2ban.log | sort -r | awk -v dateDaysAgo="$dateDaysAgo_formatted" '($1 " " $2) >= dateDaysAgo')
 
if [ -z "$ROWS" ]; then
ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
fi
 
# Create html document
echo "<h2>Adresse(s) IP bloquée(s) (Fail2Ban)</h2>" >> $HTML_REPORT
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
echo $ROWS >> $HTML_REPORT
echo "</tbody></table>" >> $HTML_REPORT