Subversion Repositories ALCASAR

Rev

Rev 2190 | Rev 2262 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log

Rev 2190 Rev 2209
Line 1... Line 1...
1
#!/bin/bash
1
#!/bin/bash
2
# $Id: alcasar-activity_report.sh 2190 2017-04-28 21:38:49Z tom.houdayer $
2
# $Id: alcasar-activity_report.sh 2209 2017-05-06 18:25:36Z tom.houdayer $
3
#
3
#
4
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
4
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
5
# We read configuration files and logs to create cool charts.
5
# We read configuration files and logs to create cool charts.
6
# Written by Raphaël PION, Rexy & Tom HOUDAYER
6
# Written by Raphaël PION, Rexy & Tom HOUDAYER
7
 
7
 
Line 313... Line 313...
313
			echo $LINE_JS >> $HTML_REPORT
313
			echo $LINE_JS >> $HTML_REPORT
314
		fi
314
		fi
315
	done
315
	done
316
	echo "</script>" >> $HTML_REPORT
316
	echo "</script>" >> $HTML_REPORT
317
else
317
else
318
	echo "<h3>Aucune activité de la Blacklist depuis l'installation.</h3>" >> $HTML_REPORT
318
	echo "<h2>Aucune activité de la Blacklist depuis l'installation.</h2>" >> $HTML_REPORT
319
fi
319
fi
320
 
320
 
321
 
321
 
322
 
322
 
323
######################DNSMASQ BLACKLIST######################
323
######################DNSMASQ BLACKLIST######################
Line 418... Line 418...
418
			echo $LINE_JS >> $HTML_REPORT
418
			echo $LINE_JS >> $HTML_REPORT
419
		fi
419
		fi
420
	done
420
	done
421
	echo "</script>" >> $HTML_REPORT
421
	echo "</script>" >> $HTML_REPORT
422
else
422
else
423
	echo "<h3>Aucune activité de la Blacklist cette semaine.</h3>" >> $HTML_REPORT
423
	echo "<h2>Aucune activité de la Blacklist cette semaine.</h2>" >> $HTML_REPORT
424
fi
424
fi
425
 
425
 
426
######################VIRUS THREAT######################
426
######################VIRUS THREAT######################
427
echo "Create AV logs since the installation of ALCASAR"
427
echo "Create AV logs since the installation of ALCASAR"
428
 
428
 
Line 522... Line 522...
522
			echo $LINE_JS >> $HTML_REPORT
522
			echo $LINE_JS >> $HTML_REPORT
523
		fi
523
		fi
524
	done
524
	done
525
	echo "</script>" >> $HTML_REPORT
525
	echo "</script>" >> $HTML_REPORT
526
else
526
else
527
	echo "<h3>Aucune menace virale.</h3>" >> $HTML_REPORT
527
	echo "<h2>Aucune menace virale.</h2>" >> $HTML_REPORT
528
fi
528
fi
529
 
529
 
530
 
530
 
531
######################ALCASAR : DAILY USE######################
531
######################ALCASAR : DAILY USE######################
532
echo "Get daily use connection of the week"
532
echo "Get daily use connection of the week"
533
#create html document
533
#create html document
534
echo "<h3>Statistiques volumétrie connexions</h3>" >> $HTML_REPORT
534
echo "<h2>Statistiques volumétrie connexions</h2>" >> $HTML_REPORT
535
 
535
 
536
#create new htdigest user to consult statistique of ACC
536
#create new htdigest user to consult statistique of ACC
537
#if user does not exist, we create him
537
#if user does not exist, we create him
538
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -lt 1 ]
538
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -lt 1 ]
539
then
539
then
Line 562... Line 562...
562
fi
562
fi
563
 
563
 
564
 
564
 
565
###################### ALCASAR : LOG ACCESS ######################
565
###################### ALCASAR : LOG ACCESS ######################
566
echo "Get ACC log access of the week"
566
echo "Get ACC log access of the week"
567
#create html document
-
 
568
echo "<h3>Connexion à l'ALCASAR Control Center (ACC)</h3>" >> $HTML_REPORT
-
 
569
 
567
 
-
 
568
ROWS=""
570
#create new htdigest user to consult statistique of ACC
569
while read -r access ; do
571
#if user does not exist, we create him
570
	access_datas=(${access//|||/ })
572
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -lt 1 ]
-
 
573
then
571
 
574
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_only_manager
572
	accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
575
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_manager
573
	access_date=$(date -d "$accces_date_intl" +%s)
576
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_all
574
	access_user=${access_datas[2]}
577
	chown -R root:apache $DIR_KEY
575
	access_ip=${access_datas[3]}
-
 
576
 
578
	chmod 640 $DIR_KEY/key_*
577
	if [ $access_date -lt $SECS_AGO ]; then
-
 
578
		break
579
fi
579
	fi
580
 
580
 
581
#get admin_log.php from ACC
581
	access_date_formatted=$(date -d @$access_date +"%x %X")
582
wget -q -nv --user $tmp_account --password $password "https://alcasar/acc/admin_log.php?startTime=$SECS_AGO" -O $TMP_STATS --no-check-certificate
-
 
583
 
582
 
584
#clean this file to include it in html report.
583
	ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td></tr>"
585
DELIM_1="<table class=\"table table-striped\">"
584
done < <(cat /var/www/html/acc/admin_log.txt | sort -r)
586
DELIM_2="<\/table>"
585
# TODO: Read archives if necessary
587
cat $TMP_STATS | sed -n "/$DELIM_1/,/$DELIM_2/p" > $TMP_STATS_2
-
 
588
cat $TMP_STATS_2 | sed -e 's:images/pixel.gif:../../manager/htdocs/images/pixel.gif:g' >> $HTML_REPORT
-
 
589
 
586
 
590
#we delete our user if he still exists
587
if [ -z "$ROWS" ]; then
591
if [ $(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l) -ge 1 ]
588
	ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune connexion</td></tr>"
592
then
-
 
593
	$SED "/^$tmp_account:/d" $DIR_KEY/key_only_manager
-
 
594
	$SED "/^$tmp_account:/d" $DIR_KEY/key_manager
-
 
595
	$SED "/^$tmp_account:/d" $DIR_KEY/key_all
-
 
596
fi
589
fi
597
 
590
 
-
 
591
# Create HTML document
-
 
592
echo "<h2>Connexion à l'ALCASAR Control Center (ACC)</h2>" >> $HTML_REPORT
-
 
593
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
-
 
594
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th></tr></thead><tbody>" >> $HTML_REPORT
-
 
595
echo $ROWS >> $HTML_REPORT
-
 
596
echo "</tbody></table>" >> $HTML_REPORT
-
 
597
 
598
 
598
 
599
###################### ALCASAR : GLOBAL TRAFFIC ######################
599
###################### ALCASAR : GLOBAL TRAFFIC ######################
600
echo "Get Global traffic of the last 30 days"
600
echo "Get Global traffic of the last 30 days"
601
 
601
 
602
ROWS=""
602
ROWS=""
603
EXTIF=$(cat /usr/local/etc/alcasar.conf | grep EXTIF | cut -d'=' -f2)
603
EXTIF=$(cat /usr/local/etc/alcasar.conf | grep '^EXTIF=' | cut -d'=' -f2)
604
for day in $(vnstat --exportdb -i $EXTIF | grep '^d;' | sort -t";" -k3 -r); do
604
for day in $(vnstat --exportdb -i $EXTIF | grep '^d;' | sort -t";" -k3 -r); do
605
	day_datas=(${day//;/ })
605
	day_datas=(${day//;/ })
606
	day_date=${day_datas[2]}
606
	day_date=${day_datas[2]}
607
	day_rxMio=${day_datas[3]}
607
	day_rxMio=${day_datas[3]}
608
	day_txMio=${day_datas[4]}
608
	day_txMio=${day_datas[4]}
Line 616... Line 616...
616
 
616
 
617
	if [ $day_date -lt $SECS_AGO ]; then
617
	if [ $day_date -lt $SECS_AGO ]; then
618
		break
618
		break
619
	fi
619
	fi
620
 
620
 
621
	day_dateFormated=$(date -d @$day_date +%x)
621
	day_date_formatted=$(date -d @$day_date +%x)
622
	day_rx=$(($day_rxMio * 1048576 + $day_rxKio * 1024))
622
	day_rx=$(($day_rxMio * 1048576 + $day_rxKio * 1024))
623
	day_tx=$(($day_txMio * 1048576 + $day_txKio * 1024))
623
	day_tx=$(($day_txMio * 1048576 + $day_txKio * 1024))
624
	day_total=$(($day_rx + $day_tx))
624
	day_total=$(($day_rx + $day_tx))
625
	day_rxFormated=$(numfmt --from=iec --to=iec --suffix=B $day_rx)
625
	day_rx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_rx)
626
	day_txFormated=$(numfmt --from=iec --to=iec --suffix=B $day_tx)
626
	day_tx_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_tx)
627
	day_totalFormated=$(numfmt --from=iec --to=iec --suffix=B $day_total)
627
	day_total_formatted=$(numfmt --from=iec --to=iec --suffix=B $day_total)
628
 
628
 
629
	ROWS="$ROWS<tr><td>$day_dateFormated</td><td>$day_rxFormated</td><td>$day_txFormated</td><td>$day_totalFormated</td></tr>"
629
	ROWS="$ROWS<tr><td>$day_date_formatted</td><td>$day_rx_formatted</td><td>$day_tx_formatted</td><td>$day_total_formatted</td></tr>"
630
done
630
done
631
 
631
 
-
 
632
if [ -z "$ROWS" ]; then
-
 
633
	ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
-
 
634
fi
-
 
635
 
632
# Create html document
636
# Create html document
633
echo "<h3>Trafic global</h3>" >> $HTML_REPORT
637
echo "<h2>Trafic global</h2>" >> $HTML_REPORT
634
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
638
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
635
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
639
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
636
echo $ROWS >> $HTML_REPORT
640
echo $ROWS >> $HTML_REPORT
637
echo "</tbody></table>" >> $HTML_REPORT
641
echo "</tbody></table>" >> $HTML_REPORT
638
 
642
 
639
 
643
 
640
###################### ALCASAR : FAIL2BAN ######################
644
###################### ALCASAR : FAIL2BAN ######################
641
echo "Get fail2ban log of the week"
645
echo "Get fail2ban log of the week"
642
 
646
 
643
# Create html document
-
 
644
echo "<h3>Adresse(s) IP bloquée(s) (Fail2Ban)</h3>" >> $HTML_REPORT
-
 
645
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
-
 
646
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
-
 
647
 
647
ROWS=""
648
DATE_1_WEEK_AGO=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
648
dateDaysAgo_formatted=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
649
# TODO: awk compare date [$1] AND hour [$2] (currently only date is compared)
-
 
650
grep " Ban " /var/log/fail2ban.log | sort -r | awk '$1 >= "$DATE_1_WEEK_AGO"' | while read -r log ; do
649
while read -r log ; do
651
	log_datas=($log)
650
	log_datas=($log)
652
	log_date="${log_datas[0]} ${log_datas[1]}"
651
	log_date="${log_datas[0]} ${log_datas[1]}"
653
	log_type=${log_datas[4]:1:-1}
652
	log_type=${log_datas[4]:1:-1}
654
	log_ip=${log_datas[6]}
653
	log_ip=${log_datas[6]}
655
	log_dateFormated=$(date -d "$log_date" +"%x %X")
654
	log_date_formatted=$(date -d "$log_date" +"%x %X")
656
 
655
 
657
	echo "<tr><td>$log_dateFormated</td><td>$log_ip</td><td>$log_type</td></tr>" >> $HTML_REPORT
656
	ROWS="$ROWS<tr><td>$log_date_formatted</td><td>$log_ip</td><td>$log_type</td></tr>"
-
 
657
done < <(grep " Ban " /var/log/fail2ban.log | sort -r | awk -v dateDaysAgo="$dateDaysAgo_formatted" '($1 " " $2) >= dateDaysAgo')
-
 
658
 
-
 
659
if [ -z "$ROWS" ]; then
-
 
660
	ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
658
done
661
fi
659
 
662
 
-
 
663
# Create html document
-
 
664
echo "<h2>Adresse(s) IP bloquée(s) (Fail2Ban)</h2>" >> $HTML_REPORT
-
 
665
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
-
 
666
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
-
 
667
echo $ROWS >> $HTML_REPORT
660
echo "</tbody></table>" >> $HTML_REPORT
668
echo "</tbody></table>" >> $HTML_REPORT
661
 
669
 
662
 
670
 
663
######################FIN HTML######################
671
######################FIN HTML######################
664
 
672