Subversion Repositories ALCASAR

Rev

Rev 3252 | Details | Compare with Previous | Last modification | View Log

Rev Author Line No. Line
2189 tom.houday 1 
#!/bin/bash
2 
# $Id: alcasar-activity_report.sh 3267 2025-04-13 22:05:45Z rexy $
3 
#
2138 richard 4 
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
5 
# We read configuration files and logs to create cool charts.
2190 tom.houday 6 
# Written by Raphaël PION, Rexy & Tom HOUDAYER
2009 raphael.pi 7 
 
2474 tom.houday 8 
CONF_FILE='/usr/local/etc/alcasar.conf'
2138 richard 9 
# files
10 
DIR_TMP="/var/tmp"
11 
TMP_AV="$DIR_TMP/av_count.txt"
12 
TMP_BL="$DIR_TMP/bl_count.txt"
13 
TMP_BL_WEEK="$DIR_TMP/bl_count_week.txt"
14 
TMP_BL_WEEK_CAT="$DIR_TMP/bl_count_week_cat.txt"
2009 raphael.pi 15 
 
2138 richard 16 
# Model loaded to create charts
17 
DIR_BUILD="/var/www/html/acc/manager/activity_report/"
18 
MODEL_CHARTJS="$DIR_BUILD/models/Chart.report.js"
19 
MODEL_TABINFO="$DIR_BUILD/models/tabinfo.html"
2009 raphael.pi 20 
 
2138 richard 21 
# Where the report will be created.
22 
HTML_REPORT="$DIR_BUILD/alcasar-report-$(date +%F).html"
2009 raphael.pi 23 
 
2138 richard 24 
# TIME VALUE
2009 raphael.pi 25 
C_TS=$(date +"%s") #current timestamp
26 
MAX_DAY_AGO=7
27 
SECS_AGO=$(date --date="$MAX_DAY_AGO days ago" +"%s") #timestamp ago
28 
STEP_TS=$((C_TS-$SECS_AGO)) #timestamp between current timestamp and SECS_AGO
29 
 
2138 richard 30 
# PRIVATE IP OF ALCASAR
2474 tom.houday 31 
PRIVATE_IP=$(grep ^PRIVATE_IP= $CONF_FILE | cut -d'=' -f2 | cut -d'/' -f1)
2009 raphael.pi 32 
 
2138 richard 33 
# COLOR for charts
2009 raphael.pi 34 
COLOR="'#ff0000','#3333cc','#009933','#993300','#1720EE','#D30229','#8D726D','#41C4E4','#8574F4','#A0BC1A','#BFDC1F','#5ADDC3','#B05744','#CD9319','#8CA39B','#D4AA1C','#A76752','#B03088','#445E87','#70424D','#D118C3','#46ABEF','#E9F197','#AEC0D4','#755C79','#94BBD7','#E2E9DC','#8B68D0','#F7EC7C','#1F16B8','#F4DA0A','#2EC17A','#E06483','#48B342','#F510CD','#9B2662','#180E98','#988FC1','#209E4E','#034240','#FDB142','#36B445','#CDD5C9','#6FA0DE','#EE2206','#204E19','#15FC93','#161ECE','#83D33B','#11A44A','#B7BF6C','#87274C','#B52C4F','#AD2805','#427E6C','#91341A','#191315','#FCB290','#13D3CD','#90F0E6','#C870C9','#AD2C14','#201D2A','#E4DB79','#90A919','#FE17FE','#09B35C','#88D950','#3440FC','#A9D42F','#E2DFAC','#DA69EC','#67430A','#43E94E','#5F7349','#22CF16','#CF038F','#0F6427','#F7AD0F','#C5E382','#DB49B6','#F760BF','#0BE701','#EF88D8','#79E6D7','#8A2D3D','#435A30','#A3C8AC','#99B118','#A929FF','#08A36D','#0A1654','#6F8283','#E1CA3E','#3E8577','#580FB6','#DB0E16','#386CBE','#FA0C43','#B713C9'"
35 
 
2138 richard 36 
# Values to create new htdigest user to consult statistique of ACC
2009 raphael.pi 37 
DIR_KEY="/usr/local/etc/digest"
2644 lucas.echa 38 
tmp_account="tmp_activityreport"
2009 raphael.pi 39 
realm="ALCASAR Control Center (ACC)"
40 
password=$(openssl rand -base64 32) #random password (length : 32)
41 
SED="/usr/bin/sed -i "
2138 richard 42 
TMP_STATS="$DIR_TMP/stats.html"
43 
TMP_STATS_2="$DIR_TMP/stats2.html"
2009 raphael.pi 44 
 
2138 richard 45 
# if empty logs, replace charts by text.
2009 raphael.pi 46 
ENABLE_BL=0
47 
ENABLE_BL_WEEK=0
48 
ENABLE_AV=0
49 
if [ -e $TMP_AV ]
50 
then
51 
	rm $TMP_AV
52 
fi
53 
if [ -e $TMP_BL ]
54 
then
2189 tom.houday 55 
	rm $TMP_BL
2009 raphael.pi 56 
fi
57 
if [ -e $TMP_BL_WEEK ]
58 
then
2189 tom.houday 59 
	rm $TMP_BL_WEEK
2009 raphael.pi 60 
fi
61 
if [ -e $TMP_BL_WEEK_CAT ]
62 
then
2189 tom.houday 63 
	rm $TMP_BL_WEEK_CAT
2009 raphael.pi 64 
fi
65 
if [ -e $HTML_REPORT ]
66 
then
2189 tom.houday 67 
	rm $HTML_REPORT
2009 raphael.pi 68 
fi
69 
echo "<!doctype html>" >> $HTML_REPORT
70 
echo "<html>" >> $HTML_REPORT
71 
echo "<head>" >> $HTML_REPORT
2189 tom.houday 72 
echo "<meta charset=\"utf-8\">" >> $HTML_REPORT
2009 raphael.pi 73 
echo "<title>ALCASAR report</title>" >> $HTML_REPORT
2189 tom.houday 74 
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/bootstrap.min.css\">" >> $HTML_REPORT
75 
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/report.css\">" >> $HTML_REPORT
2317 tom.houday 76 
echo "<script src=\"../../../js/Chart.bundle.min.js\"></script>" >> $HTML_REPORT
2189 tom.houday 77 
echo "<script src=\"../../../js/jquery.min.js\"></script>" >> $HTML_REPORT
2009 raphael.pi 78 
echo "</head>" >> $HTML_REPORT
79 
echo "<body>" >> $HTML_REPORT
3267 rexy 80 
echo "<h1><center>ALCASAR</center></h1>" >> $HTML_REPORT
81 
echo "<h2><center>Rapport d'activité hebdomadaire</center></h2>" >> $HTML_REPORT
3252 rexy 82 
echo "<h2><center>$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)</center></h2>" >> $HTML_REPORT
2189 tom.houday 83 
echo "<i><p style=\"text-align: right;\">Date de création $(date +%F)</p></i>" >> $HTML_REPORT
84 
echo "<font size=\"1\">" >> $HTML_REPORT
2009 raphael.pi 85 
 
86 
######################TABINFO######################
87 
echo "Create information about system and ALCASAR"
88 
#contain every information about ALCASAR configuration, system and last update
89 
 
90 
cat $MODEL_TABINFO | while read LINE_HTML
91 
do
2688 lucas.echa 92 
	if [ "$(echo $LINE_HTML | grep 'XXORGXX' | wc -l)" -eq 1 ]
93 
	then
94 
		VALUE=$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)
95 
		echo ${LINE_HTML/XXORGXX/$VALUE} >> $HTML_REPORT
2009 raphael.pi 96 
 
2688 lucas.echa 97 
	elif [ "$(echo $LINE_HTML | grep 'XXINSTALLXX' | wc -l)" -eq 1 ]
2009 raphael.pi 98 
	then
2688 lucas.echa 99 
		VALUE=$(grep ^INSTALL_DATE= $CONF_FILE | cut -d'=' -f2)
100 
		echo ${LINE_HTML/XXINSTALLXX/$VALUE} >> $HTML_REPORT
2009 raphael.pi 101 
 
2688 lucas.echa 102 
	elif [ "$(echo $LINE_HTML | grep 'XXAVERSIONXX' | wc -l)" -eq 1 ]
103 
	then
104 
		VALUE=$(grep ^VERSION= $CONF_FILE | cut -d'=' -f2)
105 
		echo ${LINE_HTML/XXAVERSIONXX/$VALUE} >> $HTML_REPORT
106 
 
107 
	elif [ "$(echo $LINE_HTML | grep 'XXIP_PUBLICXX' | wc -l)" -eq 1 ]
108 
	then
109 
		VALUE=$(grep ^PUBLIC_IP= $CONF_FILE | cut -d'=' -f2)
110 
		echo ${LINE_HTML/XXIP_PUBLICXX/$VALUE} >> $HTML_REPORT
111 
 
112 
	elif [ "$(echo $LINE_HTML | grep 'XXIP_PRIVEXX' | wc -l)" -eq 1 ]
113 
	then
114 
		VALUE=$(grep ^PRIVATE_IP= $CONF_FILE | cut -d'=' -f2)
115 
		echo ${LINE_HTML/XXIP_PRIVEXX/$VALUE} >> $HTML_REPORT
116 
 
117 
	elif [ "$(echo $LINE_HTML | grep 'XXGWXX' | wc -l)" -eq 1 ]
118 
	then
119 
		VALUE=$(grep ^GW= $CONF_FILE | cut -d'=' -f2)
120 
		echo ${LINE_HTML/XXGWXX/$VALUE} >> $HTML_REPORT
121 
 
122 
	elif [ "$(echo $LINE_HTML | grep 'XXDNS1XX' | wc -l)" -eq 1 ]
123 
	then
124 
		VALUE=$(grep ^DNS1= $CONF_FILE | cut -d'=' -f2)
125 
		echo ${LINE_HTML/XXDNS1XX/$VALUE} >> $HTML_REPORT
126 
 
127 
	elif [ "$(echo $LINE_HTML | grep 'XXDNS2XX' | wc -l)" -eq 1 ]
128 
	then
129 
		VALUE=$(grep ^DNS2= $CONF_FILE | cut -d'=' -f2)
130 
		echo ${LINE_HTML/XXDNS2XX/$VALUE} >> $HTML_REPORT
131 
 
132 
	elif [ "$(echo $LINE_HTML | grep 'XXHOSTXX' | wc -l)" -eq 1 ]
133 
	then
134 
		VALUE=$(hostname)
135 
		echo ${LINE_HTML/XXHOSTXX/$VALUE} >> $HTML_REPORT
136 
 
137 
	elif [ "$(echo $LINE_HTML | grep 'XXOS_VERSIONXX' | wc -l)" -eq 1 ]
138 
	then
139 
		VALUE=$(echo "$(uname -r) [ $(uname -m) ]")
140 
		echo ${LINE_HTML/XXOS_VERSIONXX/$VALUE} >> $HTML_REPORT
141 
 
142 
	elif [ "$(echo $LINE_HTML | grep 'XXREBOOTXX' | wc -l)" -eq 1 ]
143 
	then
144 
		VALUE=$(who -b | cut -d' ' -f12-)
145 
		echo ${LINE_HTML/XXREBOOTXX/$VALUE} >> $HTML_REPORT
146 
 
147 
	elif [ "$(echo $LINE_HTML | grep 'XXMAJCLAMAVXX' | wc -l)" -eq 1 ]
148 
	then
3267 rexy 149 
#		VALUE=$(date -d "$(rpm -qa --queryformat "%{installtime} %{name}\n" | grep -E "clamav-db" | cut -d' ' -f1 )" "+%Y-%m-%d %H:%M:%S")
150 
		VALUE="disabled"
2688 lucas.echa 151 
		echo ${LINE_HTML/XXMAJCLAMAVXX/$VALUE} >> $HTML_REPORT
3267 rexy 152 
 
2688 lucas.echa 153 
	elif [ "$(echo $LINE_HTML | grep 'XXMAJBLXX' | wc -l)" -eq 1 ]
154 
	then
3267 rexy 155 
		VALUE=$(stat -c %y /etc/e2guardian/lists/blacklists/README | cut -d' ' -f1)
2688 lucas.echa 156 
		echo ${LINE_HTML/XXMAJBLXX/$VALUE} >> $HTML_REPORT
157 
 
158 
	elif [ "$(echo $LINE_HTML | grep 'XXRPMXX' | wc -l)" -eq 1 ]
159 
	then
160 
		#show every ALCASAR RPM updated since X day ago
3252 rexy 161 
		#get timestamp of X day ago. Then we get every packets which have been updated since this date.
3267 rexy 162 
		if [ "$(rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | wc -l)" -gt 1 ]
2688 lucas.echa 163 
		then
3267 rexy 164 
			rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | while read RPM_ALCASAR
2688 lucas.echa 165 
			do
166 
				RPM_TIMESTAMP=$(echo $RPM_ALCASAR | cut -d' ' -f1)
167 
				RPM_DATE=$(date -d "@$(echo $RPM_TIMESTAMP)" "+%Y-%m-%d %H:%M:%S")
168 
				RPM_NAME=$(echo $RPM_ALCASAR | cut -d' ' -f2)
169 
				RPM_VERSION=$(echo $RPM_ALCASAR | cut -d' ' -f3)
170 
 
171 
				echo "<tr>" >> $HTML_REPORT
172 
				echo "<td>$RPM_NAME</td>" >> $HTML_REPORT
173 
				echo "<td>$RPM_DATE</td>" >> $HTML_REPORT
174 
				echo "<td>$RPM_VERSION</td>" >> $HTML_REPORT
175 
				echo "</tr>" >> $HTML_REPORT
176 
			done
177 
		else
178 
			echo "<tr><td colspan=\"3\">Pas de RPM mis à jour cette semaine</td></tr>" >> $HTML_REPORT
179 
		fi
2009 raphael.pi 180 
	else
2688 lucas.echa 181 
		echo $LINE_HTML >> $HTML_REPORT
2009 raphael.pi 182 
	fi
183 
done
184 
 
185 
######################BL WEBSITE SINCE INSTALLATION######################
186 
echo "Create BL website since the installation of ALCASAR"
187 
#find data
188 
 
189 
#decompress every logs
2688 lucas.echa 190 
if [ "$(ls -1 /var/log/unbound/unbound-blacklist.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
2009 raphael.pi 191 
then
2688 lucas.echa 192 
	gunzip -d unbound-blacklist.log.*.gz
2009 raphael.pi 193 
fi
194 
 
195 
#convert logs date in timestamp and find categories of blacklisted website
2688 lucas.echa 196 
tmp_log=$(mktemp)
197 
for FILE in /var/log/unbound/unbound-blacklist.log*
2009 raphael.pi 198 
do
2688 lucas.echa 199 
	grep -E "info: [^ ]+ typetransparent $PRIVATE_IP" /var/log/unbound/unbound-blacklist.log > $tmp_log
2009 raphael.pi 200 
	while read LOG_BL
201 
	do
2688 lucas.echa 202 
		# find the current blacklisted category
203 
		website_bl=$(echo $LOG_BL | cut -d' ' -f4)
204 
		website_bl=${website_bl%?} # remove the last character
205 
 
206 
		#we convert www.test.co.uk => test.co.uk to find the category of this website
207 
		if [ "$(grep -o '\.' <<< "$website_bl" | wc -l)" -ge "2" ]
2454 tom.houday 208 
		then
2688 lucas.echa 209 
			website_bl=$(echo $website_bl | cut -d'.' -f2-)
210 
		fi
211 
		#get BL category
212 
		categorie_bl=$(grep -Rl "$website_bl" /usr/local/share/unbound-bl-enabled/ | cut -d'/' -f6 | head -1)
213 
		CURRENT_TS=$(echo $LOG_BL | cut -d '[' -f2 | cut -d ']' -f1)
214 
		echo "$CURRENT_TS:$categorie_bl:" >> $TMP_BL
215 
	done < $tmp_log
2009 raphael.pi 216 
done
2688 lucas.echa 217 
rm $tmp_log
2009 raphael.pi 218 
 
219 
#if data exists, create this section in html document
220 
if [ -e $TMP_BL ]
221 
then
222 
	ENABLE_BL=1
223 
	#count every BL website consulted since installation (maximum 1 year)
224 
	DATE_END=$(cat $TMP_BL | cut -d':' -f1 | sort -n | head -1 )
225 
	for TS in $(seq $C_TS -$STEP_TS $DATE_END)
226 
	do
227 
		DATE_1=$TS
228 
		DATE_2=$((TS-$STEP_TS))
2688 lucas.echa 229 
		COUNT_BL_INSTALLATION=0
2009 raphael.pi 230 
		for LINE in $(cat $TMP_BL)
231 
		do
232 
			TS_FILE=$(echo $LINE | cut -d':' -f1)
2688 lucas.echa 233 
 
234 
			if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2454 tom.houday 235 
			then
2009 raphael.pi 236 
				COUNT_BL_INSTALLATION=$((COUNT_BL_INSTALLATION+1))
237 
			fi
238 
		done
239 
		VALUE_BL_INSTALLATION_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_BL_INSTALLATION_LABEL"
240 
		VALUE_BL_INSTALLATION_DATA="$COUNT_BL_INSTALLATION, $VALUE_BL_INSTALLATION_DATA"
241 
	done
242 
 
243 
	#create Antivirus section in html document
244 
	NAME_BL_INSTALLATION='chart_bl_installation'
245 
	CONF_BL_INSTALLATION='config_bl_installation'
246 
	echo "<center>" >> $HTML_REPORT
247 
	echo "<canvas id='$NAME_BL_INSTALLATION' width='450' height='450'></canvas>" >> $HTML_REPORT
248 
	echo "</center>" >> $HTML_REPORT
249 
 
250 
	#create chart bar in html file with javascript (chartjs.com)
251 
	echo "<script>" >> $HTML_REPORT
252 
	cat $MODEL_CHARTJS | while read LINE_JS
253 
	do
254 
		#name of variable
2688 lucas.echa 255 
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 256 
		then
257 
			echo ${LINE_JS/XXCONFXX/$CONF_BL_INSTALLATION} >> $HTML_REPORT
258 
		#chart type
2688 lucas.echa 259 
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 260 
		then
261 
			echo ${LINE_JS/XXTYPEXX/bar} >> $HTML_REPORT
262 
		#chart title
2688 lucas.echa 263 
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2454 tom.houday 264 
		then
2009 raphael.pi 265 
			echo ${LINE_JS/XXTITLEXX/"Sites bloqués au total"} >> $HTML_REPORT
266 
		#chart data
2688 lucas.echa 267 
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 268 
		then
269 
			echo ${LINE_JS/XXDATAXX/$VALUE_BL_INSTALLATION_DATA} >> $HTML_REPORT
270 
		#color
2688 lucas.echa 271 
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 272 
		then
273 
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
274 
		#labels
2688 lucas.echa 275 
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 276 
		then
277 
			echo ${LINE_JS/XXLABELSXX/$VALUE_BL_INSTALLATION_LABEL} >> $HTML_REPORT
2688 lucas.echa 278 
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 279 
		then
280 
			echo ${LINE_JS/XXLEGENDXX/false} >> $HTML_REPORT
281 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 282 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 283 
		then
284 
			echo "" >> $HTML_REPORT
285 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 286 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 287 
		then
288 
			echo "" >> $HTML_REPORT
2688 lucas.echa 289 
		elif [ "$(echo $LINE_JS | grep 'XXYLABELXX' | wc -l)" -eq 1 ]
2009 raphael.pi 290 
		then
2013 raphael.pi 291 
			echo "\"Nombre de site bloqué par la blacklist\"" >> $HTML_REPORT
2009 raphael.pi 292 
		else
293 
			echo $LINE_JS >> $HTML_REPORT
294 
		fi
295 
	done
296 
	echo "</script>" >> $HTML_REPORT
297 
else
3267 rexy 298 
	echo "<BR><h3>Aucun site bloqué par la blacklist depuis l'installation.</h3>" >> $HTML_REPORT
2009 raphael.pi 299 
fi
300 
 
301 
 
302 
 
2688 lucas.echa 303 
######################Unbound BLACKLIST######################
2009 raphael.pi 304 
echo "Create BL website since $MAX_DAY_AGO days"
305 
 
306 
#if data exists, create BL section in html document
307 
if [ -e $TMP_BL ]
308 
then
309 
	ENABLE_BL_WEEK=1
310 
	#find data
311 
	#count every BL website consulted since DAYS_AGO
312 
	DATE_1=$C_TS
313 
	DATE_2=$((DATE_1-$STEP_TS))
2287 tom.houday 314 
	touch $TMP_BL_WEEK
2009 raphael.pi 315 
	for LINE in $(cat $TMP_BL)
316 
	do
317 
		TS_FILE=$(echo $LINE | cut -d':' -f1)
318 
		#select only elements between DATE_1 and DATE_2
2688 lucas.echa 319 
		if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2454 tom.houday 320 
		then
2009 raphael.pi 321 
			echo $LINE >> $TMP_BL_WEEK
322 
		fi
323 
	done
324 
 
325 
	#then we count every occurence for each category in TMP_BL_WEEK
2688 lucas.echa 326 
	for CAT in $(ls /usr/local/share/unbound-bl/ -1 | cut -d'.' -f1)
2009 raphael.pi 327 
	do
2189 tom.houday 328 
		echo "$CAT:$(grep -o ":$CAT:" <<< "$(cat $TMP_BL_WEEK)" | wc -l):" >> $TMP_BL_WEEK_CAT
2009 raphael.pi 329 
	done
330 
 
331 
	#we sort by number of occurence and we take the top 10 BL categories
332 
	for LINE in $(sort -t':' -k2 -rn $TMP_BL_WEEK_CAT | head -n 10)
333 
	do
334 
		DATA=$(echo $LINE | cut -d':' -f2)
335 
		LABEL=$(echo $LINE | cut -d':' -f1)
336 
		if [ $DATA -ne 0 ]
337 
		then
2189 tom.houday 338 
			VALUE_BL_DATA="$VALUE_BL_DATA $DATA, "
339 
			VALUE_BL_LABEL="$VALUE_BL_LABEL '$LABEL ($DATA)',"
2009 raphael.pi 340 
		fi
341 
	done
342 
 
343 
	#get other categories (sum them all)
2688 lucas.echa 344 
	if [ "$(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc)" -gt 0 ]
2189 tom.houday 345 
	then
2454 tom.houday 346 
		VALUE_BL_DATA="$VALUE_BL_DATA $(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc)"
347 
		VALUE_BL_LABEL="$VALUE_BL_LABEL 'autre ($(cat $TMP_BL_WEEK_CAT | cut -d':' -f2 | sort -k1 -rn | tail -n+$(($(echo $VALUE_BL_DATA | wc -w)+1)) | paste -sd+ | bc))'"
2189 tom.houday 348 
	fi
2009 raphael.pi 349 
 
350 
	#create chart pie in html file with javascript (chartjs.com)
351 
	NAME_BL='chart_bl'
352 
	CONF_BL='config_bl'
353 
	echo "<center>" >> $HTML_REPORT
354 
	echo "<canvas id='$NAME_BL' width='450' height='450' ></canvas>" >> $HTML_REPORT
355 
	echo "</center>" >> $HTML_REPORT
356 
	echo "<script>" >> $HTML_REPORT
357 
	cat $MODEL_CHARTJS | while read LINE_JS
358 
	do
359 
		#variable name
2688 lucas.echa 360 
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 361 
		then
362 
			echo ${LINE_JS/XXCONFXX/$CONF_BL} >> $HTML_REPORT
363 
		#chart type
2688 lucas.echa 364 
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 365 
		then
366 
			echo ${LINE_JS/XXTYPEXX/pie} >> $HTML_REPORT
367 
		#graph title
2688 lucas.echa 368 
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 369 
		then
2189 tom.houday 370 
			echo ${LINE_JS/XXTITLEXX/"Sites bloqués cette semaine"} >> $HTML_REPORT
2009 raphael.pi 371 
		#chart data
2688 lucas.echa 372 
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 373 
		then
374 
			echo ${LINE_JS/XXDATAXX/$VALUE_BL_DATA} >> $HTML_REPORT
375 
		#color
2688 lucas.echa 376 
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 377 
		then
378 
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
379 
		#labels
2688 lucas.echa 380 
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 381 
		then
382 
			echo ${LINE_JS/XXLABELSXX/$VALUE_BL_LABEL} >> $HTML_REPORT
383 
		#display legend, only useful for chart pie
2688 lucas.echa 384 
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 385 
		then
386 
			echo ${LINE_JS/XXLEGENDXX/true} >> $HTML_REPORT
387 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 388 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 389 
		then
390 
			echo "/*" >> $HTML_REPORT
391 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 392 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 393 
		then
394 
			echo "*/" >> $HTML_REPORT
395 
		else
396 
			echo $LINE_JS >> $HTML_REPORT
397 
		fi
398 
	done
399 
	echo "</script>" >> $HTML_REPORT
400 
else
3267 rexy 401 
	echo "<BR><h3>Aucun site bloqué par la Blacklist cette semaine.</h3>" >> $HTML_REPORT
2009 raphael.pi 402 
fi
403 
 
3267 rexy 404 
###################### ALCASAR : FAIL2BAN ######################
405 
echo "Get fail2ban log of the week"
406 
 
407 
ROWS=""
408 
dateDaysAgo_formatted=$(date --date="$MAX_DAY_AGO days ago" +'%Y-%m-%d %H:%M:%S,%N' | rev | cut -c 7- | rev)
409 
while read -r log ; do
410 
	log_datas=($log)
411 
	log_date="${log_datas[0]} ${log_datas[1]}"
412 
	log_type=${log_datas[4]:1:-1}
413 
	log_ip=${log_datas[6]}
414 
	log_date_formatted=$(date -d "$log_date" +"%x %X")
415 
 
416 
	ROWS="$ROWS<tr><td>$log_date_formatted</td><td>$log_ip</td><td>$log_type</td></tr>"
417 
done < <(grep " Ban " /var/log/fail2ban.log | sort -r | awk -v dateDaysAgo="$dateDaysAgo_formatted" '($1 " " $2) >= dateDaysAgo')
418 
 
419 
if [ -z "$ROWS" ]; then
420 
	ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
421 
fi
422 
 
423 
#Create html document
424 
echo "<BR><h3>Adresse(s) IP bloquée(s) (Fail2Ban)</h3>" >> $HTML_REPORT
425 
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
426 
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
427 
echo $ROWS >> $HTML_REPORT
428 
echo "</tbody></table>" >> $HTML_REPORT
429 
 
2009 raphael.pi 430 
######################VIRUS THREAT######################
431 
echo "Create AV logs since the installation of ALCASAR"
432 
 
433 
#decompress every logs, if they exist
2841 rexy 434 
if [ "$(ls -1 /var/log/clamav/clamd.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
2009 raphael.pi 435 
then
2841 rexy 436 
	gunzip -d clamd.log.*.gz
3267 rexy 437 
	for FILE in /var/log/clamav/clamd.log*
438 
	do
439 
		while read LINE_AV
440 
		do
441 
			if [ "`echo $LINE_AV|grep -c FOUND`" == 1 ]
442 
			then
443 
				Y=$(echo $LINE_AV | cut -d' ' -f5)
444 
				M=$(echo $LINE_AV | cut -d' ' -f2)
445 
				D=$(echo $LINE_AV | cut -d' ' -f3)
446 
				H=$(echo $LINE_AV | cut -d' ' -f4)
447 
				CURRENT_TS=$(date -d "$M $D $Y $H" +"%s")
448 
				echo $CURRENT_TS >> $TMP_AV
449 
			fi
450 
		done < $FILE
451 
	done
2009 raphael.pi 452 
fi
453 
if [ -e $TMP_AV ]
454 
then
455 
	ENABLE_AV=1
456 
	DATE_END=$(cat $TMP_AV | sort -n | head -1)
457 
	for TS in $(seq $C_TS -$STEP_TS $DATE_END)
458 
	do
459 
		DATE_1=$TS
460 
		DATE_2=$((TS-$STEP_TS))
2189 tom.houday 461 
		COUNT_AV=0
2009 raphael.pi 462 
 
463 
		for TS_FILE in $(cat $TMP_AV)
464 
		do
2688 lucas.echa 465 
			if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
2189 tom.houday 466 
			then
2009 raphael.pi 467 
				COUNT_AV=$((COUNT_AV+1))
468 
			fi
469 
		done
2189 tom.houday 470 
 
2009 raphael.pi 471 
		VALUE_AV_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_AV_LABEL"
472 
		VALUE_AV_DATA="$COUNT_AV, $VALUE_AV_DATA"
473 
	done
2688 lucas.echa 474 
 
2009 raphael.pi 475 
	#create Antivirus section in html document
476 
	NAME_AV='chart_av'
477 
	CONF_AV='config_av'
478 
	echo "<center>" >> $HTML_REPORT
479 
	echo "<canvas id='$NAME_AV' width='450' height='450' ></canvas>" >> $HTML_REPORT
480 
	echo "</center>" >> $HTML_REPORT
481 
 
482 
	#create chart bar in html file with javascript (chartjs.com)
483 
	echo "<script>" >> $HTML_REPORT
484 
	cat $MODEL_CHARTJS | while read LINE_JS
485 
	do
486 
		#name of variable
2688 lucas.echa 487 
		if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
2009 raphael.pi 488 
		then
489 
			echo ${LINE_JS/XXCONFXX/$CONF_AV} >> $HTML_REPORT
490 
		#chart type
2688 lucas.echa 491 
		elif [ "$(echo $LINE_JS | grep 'XXTYPEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 492 
		then
493 
			echo ${LINE_JS/XXTYPEXX/bar} >> $HTML_REPORT
494 
		#graph title
2688 lucas.echa 495 
		elif [ "$(echo $LINE_JS | grep 'XXTITLEXX' | wc -l)" -eq 1 ]
2009 raphael.pi 496 
		then
2189 tom.houday 497 
			echo ${LINE_JS/XXTITLEXX/"Menaces bloqués par l\'antivirus"} >> $HTML_REPORT
2009 raphael.pi 498 
		#chart data
2688 lucas.echa 499 
		elif [ "$(echo $LINE_JS | grep 'XXDATAXX' | wc -l)" -eq 1 ]
2009 raphael.pi 500 
		then
501 
			echo ${LINE_JS/XXDATAXX/$VALUE_AV_DATA} >> $HTML_REPORT
502 
		#color
2688 lucas.echa 503 
		elif [ "$(echo $LINE_JS | grep 'XXCOLORXX' | wc -l)" -eq 1 ]
2009 raphael.pi 504 
		then
505 
			echo ${LINE_JS/XXCOLORXX/$COLOR} >> $HTML_REPORT
506 
		#labels
2688 lucas.echa 507 
		elif [ "$(echo $LINE_JS | grep 'XXLABELSXX' | wc -l)" -eq 1 ]
2009 raphael.pi 508 
		then
509 
			echo ${LINE_JS/XXLABELSXX/$VALUE_AV_LABEL} >> $HTML_REPORT
2688 lucas.echa 510 
		elif [ "$(echo $LINE_JS | grep 'XXLEGENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 511 
		then
512 
			echo ${LINE_JS/XXLEGENDXX/false} >> $HTML_REPORT
513 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 514 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-BEGINXX' | wc -l)" -eq 1 ]
2009 raphael.pi 515 
		then
516 
			echo "" >> $HTML_REPORT
517 
		#display value of Y axis, only useful for chart bar
2688 lucas.echa 518 
		elif [ "$(echo $LINE_JS | grep 'XXCOMMENT-ENDXX' | wc -l)" -eq 1 ]
2009 raphael.pi 519 
		then
520 
			echo "" >> $HTML_REPORT
2688 lucas.echa 521 
		elif [ "$(echo $LINE_JS | grep 'XXYLABELXX' | wc -l)" -eq 1 ]
2009 raphael.pi 522 
		then
2013 raphael.pi 523 
			echo "\"Nombre de menaces virales bloqués par l'antivirus\"" >> $HTML_REPORT
2009 raphael.pi 524 
		else
525 
			echo $LINE_JS >> $HTML_REPORT
526 
		fi
527 
	done
528 
	echo "</script>" >> $HTML_REPORT
529 
else
3267 rexy 530 
	echo "<BR><h3>Aucune détection de menace virale.</h3>" >> $HTML_REPORT
2009 raphael.pi 531 
fi
532 
 
533 
 
534 
######################ALCASAR : DAILY USE######################
535 
echo "Get daily use connection of the week"
536 
 
3267 rexy 537 
echo "<BR><h3>Statistiques des connexions</h3>" >> $HTML_REPORT
3252 rexy 538 
 
2009 raphael.pi 539 
#create new htdigest user to consult statistique of ACC
540 
#if user does not exist, we create him
2688 lucas.echa 541 
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -lt 1 ]
2009 raphael.pi 542 
then
2189 tom.houday 543 
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_only_manager
544 
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_manager
545 
	(echo -n "$tmp_account:$realm:" && echo -n "$tmp_account:$realm:$password" | md5sum | awk '{print $1}' ) >> $DIR_KEY/key_all
546 
	chown -R root:apache $DIR_KEY
547 
	chmod 640 $DIR_KEY/key_*
2009 raphael.pi 548 
fi
549 
 
550 
#get stats.php from ACC
2138 richard 551 
wget -q -nv --user $tmp_account --password $password https://alcasar/acc/manager/htdocs/stats.php -O $TMP_STATS --no-check-certificate
2009 raphael.pi 552 
#clean this file to include it in html report.
3267 rexy 553 
DELIM_1="<font color=\"darkblue\">"
554 
DELIM_2="<\/div"
555 
cat $TMP_STATS | sed -n "/$DELIM_1/,/$DELIM_2/p" | tail -n+2 | head -n-1 >> $TMP_STATS_2
2009 raphael.pi 556 
cat $TMP_STATS_2 | sed -e 's:images/pixel.gif:../../manager/htdocs/images/pixel.gif:g' >> $HTML_REPORT
557 
 
558 
#we delete our user if he still exists
2688 lucas.echa 559 
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -ge 1 ]
2009 raphael.pi 560 
then
2189 tom.houday 561 
	$SED "/^$tmp_account:/d" $DIR_KEY/key_only_manager
562 
	$SED "/^$tmp_account:/d" $DIR_KEY/key_manager
563 
	$SED "/^$tmp_account:/d" $DIR_KEY/key_all
2009 raphael.pi 564 
fi
565 
 
2190 tom.houday 566 
###################### ALCASAR : LOG ACCESS ######################
567 
echo "Get ACC log access of the week"
568 
 
2209 tom.houday 569 
ROWS=""
570 
while read -r access ; do
2267 richard 571 
	access_datas=(${access//|/ })
2209 tom.houday 572 
	accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
573 
	access_date=$(date -d "$accces_date_intl" +%s)
574 
	access_user=${access_datas[2]}
575 
	access_ip=${access_datas[3]}
2286 tom.houday 576 
	access_agent=$(echo "$access" | cut -d'|' -f4)
2209 tom.houday 577 
	if [ $access_date -lt $SECS_AGO ]; then
578 
		break
579 
	fi
580 
	access_date_formatted=$(date -d @$access_date +"%x %X")
2267 richard 581 
	ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td><td>$access_agent</td></tr>"
582 
done < <(cat /var/Save/security/acc_access.log | sort -r)
2209 tom.houday 583 
# TODO: Read archives if necessary
584 
if [ -z "$ROWS" ]; then
2267 richard 585 
	ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucune connexion</td></tr>"
2190 tom.houday 586 
fi
587 
 
2209 tom.houday 588 
# Create HTML document
3267 rexy 589 
echo "<BR><h3>Connexion à l'ALCASAR Control Center (ACC)</h3>" >> $HTML_REPORT
2209 tom.houday 590 
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
2267 richard 591 
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th><th>Agent</th></tr></thead><tbody>" >> $HTML_REPORT
2688 lucas.echa 592 
echo "$ROWS" >> $HTML_REPORT
2209 tom.houday 593 
echo "</tbody></table>" >> $HTML_REPORT
2190 tom.houday 594 
 
2209 tom.houday 595 
 
2190 tom.houday 596 
###################### ALCASAR : GLOBAL TRAFFIC ######################
597 
echo "Get Global traffic of the last 30 days"
598 
 
599 
ROWS=""
2474 tom.houday 600 
EXTIF=$(grep ^EXTIF= $CONF_FILE | cut -d'=' -f2)
2190 tom.houday 601 
 
3249 rexy 602 
while read -r entry; do
3267 rexy 603 
    year=$(echo "$entry" | grep -oP '(?<=<year>).*(?=</year>)')
604 
    month=$(echo "$entry" | grep -oP '(?<=<month>).*(?=</month>)')
605 
    day=$(echo "$entry" | grep -oP '(?<=<day>).*(?=</day>)')
606 
    rx=$(echo "$entry" | grep -oP '(?<=<rx>).*(?=</rx>)')
607 
    tx=$(echo "$entry" | grep -oP '(?<=<tx>).*(?=</tx>)')
3249 rexy 608 
    if [ -n "$year" ]; then
609 
        date_year=$year
610 
    fi
611 
    if [ -n "$month" ]; then
612 
            date_month=$month
613 
    fi
614 
    if [ -n "$day" ]; then
615 
            date_day=$day
616 
    fi
617 
    if [ -n "$rx" ]; then
3267 rexy 618 
        day_rx=`echo "$rx" | numfmt --to iec`
3249 rexy 619 
    fi
620 
    if [ -n "$tx" ]; then
3267 rexy 621 
        day_tx=`echo "$tx" | numfmt --to iec`
3249 rexy 622 
    fi
623 
    if [ -n "$date_year" ] && [ -n "$date_month" ] && [ -n "$date_day" ] && [ -n "$day_rx" ] && [ -n "$day_tx" ]; then
3267 rexy 624 
        day_date="$date_day-$date_month-$date_year"
625 
        rxtx=$((rx + tx))
626 
        day_total=`echo "$rxtx" | numfmt --to iec`
3249 rexy 627 
        ROWS="$ROWS<tr><td>$day_date</td><td>$day_rx</td><td>$day_tx</td><td>$day_total</td></tr>"
628 
        date_month=""
629 
        date_day=""
630 
        date_year=""
631 
    fi
3267 rexy 632 
done < <(vnstat -i $EXTIF --days --begin $(date --date "Sunday - 6 days" +"%Y-%m-%d") --xml d | grep id= | tr -d ' '| rev | cut -c7- | rev)
2209 tom.houday 633 
if [ -z "$ROWS" ]; then
634 
	ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
635 
fi
636 
 
2190 tom.houday 637 
# Create html document
3267 rexy 638 
echo "<BR><h3>Trafic global</h3>" >> $HTML_REPORT
2190 tom.houday 639 
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
640 
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
2688 lucas.echa 641 
echo "$ROWS" >> $HTML_REPORT
2190 tom.houday 642 
echo "</tbody></table>" >> $HTML_REPORT
643 
 
3252 rexy 644 
######################HTML END######################
2009 raphael.pi 645 
 
646 
#Execute our javascript function to print charts
647 
echo "<script>window.onload = function() {" >> $HTML_REPORT
3252 rexy 648 
#BL since installation
2009 raphael.pi 649 
if [ $ENABLE_BL -eq "1" ]
650 
then
651 
	echo "var ctx_$NAME_BL_INSTALLATION = document.getElementById('$NAME_BL_INSTALLATION').getContext('2d');" >> $HTML_REPORT
652 
	echo "var $NAME_BL_INSTALLATION = new Chart(ctx_$NAME_BL_INSTALLATION, $CONF_BL_INSTALLATION);" >> $HTML_REPORT
653 
fi
3252 rexy 654 
#BL week
2009 raphael.pi 655 
if [ $ENABLE_BL_WEEK -eq "1" ]
656 
then
657 
	echo "var ctx_$NAME_BL = document.getElementById('$NAME_BL').getContext('2d');" >> $HTML_REPORT
658 
	echo "var $NAME_BL = new Chart(ctx_$NAME_BL, $CONF_BL);" >> $HTML_REPORT
659 
fi
3252 rexy 660 
#malware Threat
2009 raphael.pi 661 
if [ $ENABLE_AV -eq "1" ]
662 
then
663 
	echo "var ctx_$NAME_AV = document.getElementById('$NAME_AV').getContext('2d');" >> $HTML_REPORT
664 
	echo "var $NAME_AV = new Chart(ctx_$NAME_AV, $CONF_AV);" >> $HTML_REPORT
665 
fi
666 
echo "};</script>" >> $HTML_REPORT
667 
echo "</body>" >> $HTML_REPORT
668 
echo "</html>" >> $HTML_REPORT
669 
 
670 
#convert html document to PDF
2688 lucas.echa 671 
/usr/bin/wkhtmltopdf $HTML_REPORT "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
672 
chown apache:apache "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
673 
chmod 644 "$(echo $HTML_REPORT | cut -d'.' -f1).pdf"
674 
mv "$(echo $HTML_REPORT | cut -d'.' -f1).pdf" /var/Save/activity_report/
2009 raphael.pi 675 
 
2013 raphael.pi 676 
#compress every logs, if they exist
2841 rexy 677 
if [ "$(ls -1 /var/log/clamav/clamd.log.* 2>/dev/null | wc -l)" -ge 1 ]
2013 raphael.pi 678 
then
2841 rexy 679 
	gzip /var/log/clamav/clamd.log.*
2013 raphael.pi 680 
fi
681 
 
682 
#compress every logs
2688 lucas.echa 683 
if [ "$(ls -1 /var/log/unbound/unbound-blacklist.log.* 2>/dev/null | wc -l)" -ge 1 ]
2013 raphael.pi 684 
then
2688 lucas.echa 685 
	gzip /var/log/unbound/unbound-blacklist.log.*
2013 raphael.pi 686 
fi
687 
 
688 
#remove our files
2141 richard 689 
rm -f $TMP_BL
690 
rm -f $TMP_BL_WEEK
691 
rm -f $TMP_BL_WEEK_CAT
692 
rm -f $TMP_STATS
693 
rm -f $TMP_STATS_2
694 
rm -f $HTML_REPORT