| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar-activity_report.sh 3249 2025-02-10 10:21:58Z rexy $
|
2 |
# $Id: alcasar-activity_report.sh 3252 2025-02-21 18:40:30Z rexy $
|
| 3 |
#
|
3 |
#
|
| 4 |
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
|
4 |
# Create an activity report for ALCASAR every week (sunday at 5.35 pm --> see cron.d).
|
| 5 |
# We read configuration files and logs to create cool charts.
|
5 |
# We read configuration files and logs to create cool charts.
|
| 6 |
# Written by Raphaël PION, Rexy & Tom HOUDAYER
|
6 |
# Written by Raphaël PION, Rexy & Tom HOUDAYER
|
| 7 |
|
7 |
|
| Line 44... |
Line 44... |
| 44 |
|
44 |
|
| 45 |
# if empty logs, replace charts by text.
|
45 |
# if empty logs, replace charts by text.
|
| 46 |
ENABLE_BL=0
|
46 |
ENABLE_BL=0
|
| 47 |
ENABLE_BL_WEEK=0
|
47 |
ENABLE_BL_WEEK=0
|
| 48 |
ENABLE_AV=0
|
48 |
ENABLE_AV=0
|
| 49 |
|
- |
|
| 50 |
if [ -e $TMP_AV ]
|
49 |
if [ -e $TMP_AV ]
|
| 51 |
then
|
50 |
then
|
| 52 |
rm $TMP_AV
|
51 |
rm $TMP_AV
|
| 53 |
fi
|
52 |
fi
|
| 54 |
|
- |
|
| 55 |
if [ -e $TMP_BL ]
|
53 |
if [ -e $TMP_BL ]
|
| 56 |
then
|
54 |
then
|
| 57 |
rm $TMP_BL
|
55 |
rm $TMP_BL
|
| 58 |
fi
|
56 |
fi
|
| 59 |
|
- |
|
| 60 |
if [ -e $TMP_BL_WEEK ]
|
57 |
if [ -e $TMP_BL_WEEK ]
|
| 61 |
then
|
58 |
then
|
| 62 |
rm $TMP_BL_WEEK
|
59 |
rm $TMP_BL_WEEK
|
| 63 |
fi
|
60 |
fi
|
| 64 |
|
- |
|
| 65 |
if [ -e $TMP_BL_WEEK_CAT ]
|
61 |
if [ -e $TMP_BL_WEEK_CAT ]
|
| 66 |
then
|
62 |
then
|
| 67 |
rm $TMP_BL_WEEK_CAT
|
63 |
rm $TMP_BL_WEEK_CAT
|
| 68 |
fi
|
64 |
fi
|
| 69 |
|
- |
|
| 70 |
if [ -e $HTML_REPORT ]
|
65 |
if [ -e $HTML_REPORT ]
|
| 71 |
then
|
66 |
then
|
| 72 |
rm $HTML_REPORT
|
67 |
rm $HTML_REPORT
|
| 73 |
fi
|
68 |
fi
|
| 74 |
|
- |
|
| 75 |
echo "<!doctype html>" >> $HTML_REPORT
|
69 |
echo "<!doctype html>" >> $HTML_REPORT
|
| 76 |
echo "<html>" >> $HTML_REPORT
|
70 |
echo "<html>" >> $HTML_REPORT
|
| 77 |
echo "<head>" >> $HTML_REPORT
|
71 |
echo "<head>" >> $HTML_REPORT
|
| 78 |
echo "<meta charset=\"utf-8\">" >> $HTML_REPORT
|
72 |
echo "<meta charset=\"utf-8\">" >> $HTML_REPORT
|
| 79 |
echo "<title>ALCASAR report</title>" >> $HTML_REPORT
|
73 |
echo "<title>ALCASAR report</title>" >> $HTML_REPORT
|
| Line 81... |
Line 75... |
| 81 |
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/report.css\">" >> $HTML_REPORT
|
75 |
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../../../css/report.css\">" >> $HTML_REPORT
|
| 82 |
echo "<script src=\"../../../js/Chart.bundle.min.js\"></script>" >> $HTML_REPORT
|
76 |
echo "<script src=\"../../../js/Chart.bundle.min.js\"></script>" >> $HTML_REPORT
|
| 83 |
echo "<script src=\"../../../js/jquery.min.js\"></script>" >> $HTML_REPORT
|
77 |
echo "<script src=\"../../../js/jquery.min.js\"></script>" >> $HTML_REPORT
|
| 84 |
echo "</head>" >> $HTML_REPORT
|
78 |
echo "</head>" >> $HTML_REPORT
|
| 85 |
echo "<body>" >> $HTML_REPORT
|
79 |
echo "<body>" >> $HTML_REPORT
|
| - |
|
80 |
echo "<h1><center>Rapport d'activité ALCASAR</center></h1>" >> $HTML_REPORT
|
| 86 |
echo "<h1><center>Rapport d'activité de l'ALCASAR-$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)</center></h1>" >> $HTML_REPORT
|
81 |
echo "<h2><center>$(grep ^ORGANISM= $CONF_FILE | cut -d'=' -f2-)</center></h2>" >> $HTML_REPORT
|
| 87 |
echo "<i><p style=\"text-align: right;\">Date de création $(date +%F)</p></i>" >> $HTML_REPORT
|
82 |
echo "<i><p style=\"text-align: right;\">Date de création $(date +%F)</p></i>" >> $HTML_REPORT
|
| 88 |
echo "<font size=\"1\">" >> $HTML_REPORT
|
83 |
echo "<font size=\"1\">" >> $HTML_REPORT
|
| 89 |
|
84 |
|
| 90 |
######################TABINFO######################
|
85 |
######################TABINFO######################
|
| 91 |
echo "Create information about system and ALCASAR"
|
86 |
echo "Create information about system and ALCASAR"
|
| Line 159... |
Line 154... |
| 159 |
echo ${LINE_HTML/XXMAJBLXX/$VALUE} >> $HTML_REPORT
|
154 |
echo ${LINE_HTML/XXMAJBLXX/$VALUE} >> $HTML_REPORT
|
| 160 |
|
155 |
|
| 161 |
elif [ "$(echo $LINE_HTML | grep 'XXRPMXX' | wc -l)" -eq 1 ]
|
156 |
elif [ "$(echo $LINE_HTML | grep 'XXRPMXX' | wc -l)" -eq 1 ]
|
| 162 |
then
|
157 |
then
|
| 163 |
#show every ALCASAR RPM updated since X day ago
|
158 |
#show every ALCASAR RPM updated since X day ago
|
| 164 |
#get timestamp of X day ago. Then we get every packets chich have been updated since this date.
|
159 |
#get timestamp of X day ago. Then we get every packets which have been updated since this date.
|
| 165 |
if [ "$(rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | wc -l)" -gt 1 ]
|
160 |
if [ "$(rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | wc -l)" -gt 1 ]
|
| 166 |
then
|
161 |
then
|
| 167 |
PACKAGE='php|apache|iptables|unbound|radius|nfdump|e2guardian|clamav|ulogd|chilli|fail2ban|openssh|ipt-netflow|wget|mariadb|gnupg|openssl'
|
162 |
PACKAGE='php|apache|iptables|unbound|radius|nfdump|e2guardian|clamav|ulogd|chilli|fail2ban|openssh|ipt-netflow|wget|mariadb|gnupg|openssl'
|
| 168 |
rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | while read RPM_ALCASAR
|
163 |
rpm -qa --queryformat '%{installtime} %{name} %{version}\n' | awk -v seuil="$SECS_AGO" '$1 > seuil' | sort -n | grep -E "$PACKAGE" | while read RPM_ALCASAR
|
| 169 |
do
|
164 |
do
|
| Line 210... |
Line 205... |
| 210 |
#we convert www.test.co.uk => test.co.uk to find the category of this website
|
205 |
#we convert www.test.co.uk => test.co.uk to find the category of this website
|
| 211 |
if [ "$(grep -o '\.' <<< "$website_bl" | wc -l)" -ge "2" ]
|
206 |
if [ "$(grep -o '\.' <<< "$website_bl" | wc -l)" -ge "2" ]
|
| 212 |
then
|
207 |
then
|
| 213 |
website_bl=$(echo $website_bl | cut -d'.' -f2-)
|
208 |
website_bl=$(echo $website_bl | cut -d'.' -f2-)
|
| 214 |
fi
|
209 |
fi
|
| 215 |
|
- |
|
| 216 |
#get BL category
|
210 |
#get BL category
|
| 217 |
categorie_bl=$(grep -Rl "$website_bl" /usr/local/share/unbound-bl-enabled/ | cut -d'/' -f6 | head -1)
|
211 |
categorie_bl=$(grep -Rl "$website_bl" /usr/local/share/unbound-bl-enabled/ | cut -d'/' -f6 | head -1)
|
| 218 |
|
- |
|
| 219 |
CURRENT_TS=$(echo $LOG_BL | cut -d '[' -f2 | cut -d ']' -f1)
|
212 |
CURRENT_TS=$(echo $LOG_BL | cut -d '[' -f2 | cut -d ']' -f1)
|
| 220 |
echo "$CURRENT_TS:$categorie_bl:" >> $TMP_BL
|
213 |
echo "$CURRENT_TS:$categorie_bl:" >> $TMP_BL
|
| 221 |
done < $tmp_log
|
214 |
done < $tmp_log
|
| 222 |
done
|
215 |
done
|
| 223 |
rm $tmp_log
|
216 |
rm $tmp_log
|
| Line 226... |
Line 219... |
| 226 |
if [ -e $TMP_BL ]
|
219 |
if [ -e $TMP_BL ]
|
| 227 |
then
|
220 |
then
|
| 228 |
ENABLE_BL=1
|
221 |
ENABLE_BL=1
|
| 229 |
#count every BL website consulted since installation (maximum 1 year)
|
222 |
#count every BL website consulted since installation (maximum 1 year)
|
| 230 |
DATE_END=$(cat $TMP_BL | cut -d':' -f1 | sort -n | head -1 )
|
223 |
DATE_END=$(cat $TMP_BL | cut -d':' -f1 | sort -n | head -1 )
|
| 231 |
|
- |
|
| 232 |
|
- |
|
| 233 |
for TS in $(seq $C_TS -$STEP_TS $DATE_END)
|
224 |
for TS in $(seq $C_TS -$STEP_TS $DATE_END)
|
| 234 |
do
|
225 |
do
|
| 235 |
DATE_1=$TS
|
226 |
DATE_1=$TS
|
| 236 |
DATE_2=$((TS-$STEP_TS))
|
227 |
DATE_2=$((TS-$STEP_TS))
|
| 237 |
COUNT_BL_INSTALLATION=0
|
228 |
COUNT_BL_INSTALLATION=0
|
| 238 |
|
- |
|
| 239 |
for LINE in $(cat $TMP_BL)
|
229 |
for LINE in $(cat $TMP_BL)
|
| 240 |
do
|
230 |
do
|
| 241 |
TS_FILE=$(echo $LINE | cut -d':' -f1)
|
231 |
TS_FILE=$(echo $LINE | cut -d':' -f1)
|
| 242 |
|
232 |
|
| 243 |
if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
|
233 |
if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
|
| 244 |
then
|
234 |
then
|
| 245 |
COUNT_BL_INSTALLATION=$((COUNT_BL_INSTALLATION+1))
|
235 |
COUNT_BL_INSTALLATION=$((COUNT_BL_INSTALLATION+1))
|
| 246 |
fi
|
236 |
fi
|
| 247 |
done
|
237 |
done
|
| 248 |
|
- |
|
| 249 |
VALUE_BL_INSTALLATION_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_BL_INSTALLATION_LABEL"
|
238 |
VALUE_BL_INSTALLATION_LABEL="'$(date -d @$DATE_2 "+%Y-%m-%d" )', $VALUE_BL_INSTALLATION_LABEL"
|
| 250 |
VALUE_BL_INSTALLATION_DATA="$COUNT_BL_INSTALLATION, $VALUE_BL_INSTALLATION_DATA"
|
239 |
VALUE_BL_INSTALLATION_DATA="$COUNT_BL_INSTALLATION, $VALUE_BL_INSTALLATION_DATA"
|
| 251 |
done
|
240 |
done
|
| 252 |
|
241 |
|
| 253 |
#create Antivirus section in html document
|
242 |
#create Antivirus section in html document
|
| Line 303... |
Line 292... |
| 303 |
echo $LINE_JS >> $HTML_REPORT
|
292 |
echo $LINE_JS >> $HTML_REPORT
|
| 304 |
fi
|
293 |
fi
|
| 305 |
done
|
294 |
done
|
| 306 |
echo "</script>" >> $HTML_REPORT
|
295 |
echo "</script>" >> $HTML_REPORT
|
| 307 |
else
|
296 |
else
|
| 308 |
echo "<h2>Aucune activité de la Blacklist depuis l'installation.</h2>" >> $HTML_REPORT
|
297 |
echo "<h3>Aucune activité de la Blacklist depuis l'installation.</h3>" >> $HTML_REPORT
|
| 309 |
fi
|
298 |
fi
|
| 310 |
|
299 |
|
| 311 |
|
300 |
|
| 312 |
|
301 |
|
| 313 |
######################Unbound BLACKLIST######################
|
302 |
######################Unbound BLACKLIST######################
|
| Line 319... |
Line 308... |
| 319 |
ENABLE_BL_WEEK=1
|
308 |
ENABLE_BL_WEEK=1
|
| 320 |
#find data
|
309 |
#find data
|
| 321 |
#count every BL website consulted since DAYS_AGO
|
310 |
#count every BL website consulted since DAYS_AGO
|
| 322 |
DATE_1=$C_TS
|
311 |
DATE_1=$C_TS
|
| 323 |
DATE_2=$((DATE_1-$STEP_TS))
|
312 |
DATE_2=$((DATE_1-$STEP_TS))
|
| 324 |
|
- |
|
| 325 |
touch $TMP_BL_WEEK
|
313 |
touch $TMP_BL_WEEK
|
| 326 |
|
- |
|
| 327 |
for LINE in $(cat $TMP_BL)
|
314 |
for LINE in $(cat $TMP_BL)
|
| 328 |
do
|
315 |
do
|
| 329 |
TS_FILE=$(echo $LINE | cut -d':' -f1)
|
316 |
TS_FILE=$(echo $LINE | cut -d':' -f1)
|
| 330 |
#select only elements between DATE_1 and DATE_2
|
317 |
#select only elements between DATE_1 and DATE_2
|
| 331 |
if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
|
318 |
if [ "$TS_FILE" -le "$DATE_1" ] && [ "$TS_FILE" -ge "$DATE_2" ]
|
| Line 341... |
Line 328... |
| 341 |
done
|
328 |
done
|
| 342 |
|
329 |
|
| 343 |
#we sort by number of occurence and we take the top 10 BL categories
|
330 |
#we sort by number of occurence and we take the top 10 BL categories
|
| 344 |
for LINE in $(sort -t':' -k2 -rn $TMP_BL_WEEK_CAT | head -n 10)
|
331 |
for LINE in $(sort -t':' -k2 -rn $TMP_BL_WEEK_CAT | head -n 10)
|
| 345 |
do
|
332 |
do
|
| 346 |
|
- |
|
| 347 |
DATA=$(echo $LINE | cut -d':' -f2)
|
333 |
DATA=$(echo $LINE | cut -d':' -f2)
|
| 348 |
LABEL=$(echo $LINE | cut -d':' -f1)
|
334 |
LABEL=$(echo $LINE | cut -d':' -f1)
|
| 349 |
if [ $DATA -ne 0 ]
|
335 |
if [ $DATA -ne 0 ]
|
| 350 |
then
|
336 |
then
|
| 351 |
VALUE_BL_DATA="$VALUE_BL_DATA $DATA, "
|
337 |
VALUE_BL_DATA="$VALUE_BL_DATA $DATA, "
|
| Line 365... |
Line 351... |
| 365 |
CONF_BL='config_bl'
|
351 |
CONF_BL='config_bl'
|
| 366 |
echo "<center>" >> $HTML_REPORT
|
352 |
echo "<center>" >> $HTML_REPORT
|
| 367 |
echo "<canvas id='$NAME_BL' width='450' height='450' ></canvas>" >> $HTML_REPORT
|
353 |
echo "<canvas id='$NAME_BL' width='450' height='450' ></canvas>" >> $HTML_REPORT
|
| 368 |
echo "</center>" >> $HTML_REPORT
|
354 |
echo "</center>" >> $HTML_REPORT
|
| 369 |
echo "<script>" >> $HTML_REPORT
|
355 |
echo "<script>" >> $HTML_REPORT
|
| 370 |
|
- |
|
| 371 |
cat $MODEL_CHARTJS | while read LINE_JS
|
356 |
cat $MODEL_CHARTJS | while read LINE_JS
|
| 372 |
do
|
357 |
do
|
| 373 |
#variable name
|
358 |
#variable name
|
| 374 |
if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
|
359 |
if [ "$(echo $LINE_JS | grep 'XXCONFXX' | wc -l)" -eq 1 ]
|
| 375 |
then
|
360 |
then
|
| Line 410... |
Line 395... |
| 410 |
echo $LINE_JS >> $HTML_REPORT
|
395 |
echo $LINE_JS >> $HTML_REPORT
|
| 411 |
fi
|
396 |
fi
|
| 412 |
done
|
397 |
done
|
| 413 |
echo "</script>" >> $HTML_REPORT
|
398 |
echo "</script>" >> $HTML_REPORT
|
| 414 |
else
|
399 |
else
|
| 415 |
echo "<h2>Aucune activité de la Blacklist cette semaine.</h2>" >> $HTML_REPORT
|
400 |
echo "<h3>Aucune activité de la Blacklist cette semaine.</h3>" >> $HTML_REPORT
|
| 416 |
fi
|
401 |
fi
|
| 417 |
|
402 |
|
| 418 |
######################VIRUS THREAT######################
|
403 |
######################VIRUS THREAT######################
|
| 419 |
echo "Create AV logs since the installation of ALCASAR"
|
404 |
echo "Create AV logs since the installation of ALCASAR"
|
| 420 |
|
405 |
|
| 421 |
#decompress every logs, if they exist
|
406 |
#decompress every logs, if they exist
|
| 422 |
if [ "$(ls -1 /var/log/clamav/clamd.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
|
407 |
if [ "$(ls -1 /var/log/clamav/clamd.log.*.gz 2>/dev/null | wc -l)" -ge 1 ]
|
| 423 |
then
|
408 |
then
|
| 424 |
gunzip -d clamd.log.*.gz
|
409 |
gunzip -d clamd.log.*.gz
|
| 425 |
fi
|
410 |
fi
|
| 426 |
|
- |
|
| 427 |
for FILE in /var/log/clamav/clamd.log*
|
411 |
for FILE in /var/log/clamav/clamd.log*
|
| 428 |
do
|
412 |
do
|
| 429 |
while read LINE_AV
|
413 |
while read LINE_AV
|
| 430 |
do
|
414 |
do
|
| 431 |
if [ "`echo $LINE_AV|grep -c FOUND`" == 1 ]
|
415 |
if [ "`echo $LINE_AV|grep -c FOUND`" == 1 ]
|
| Line 437... |
Line 421... |
| 437 |
CURRENT_TS=$(date -d "$M $D $Y $H" +"%s")
|
421 |
CURRENT_TS=$(date -d "$M $D $Y $H" +"%s")
|
| 438 |
echo $CURRENT_TS >> $TMP_AV
|
422 |
echo $CURRENT_TS >> $TMP_AV
|
| 439 |
fi
|
423 |
fi
|
| 440 |
done < $FILE
|
424 |
done < $FILE
|
| 441 |
done
|
425 |
done
|
| 442 |
|
- |
|
| 443 |
if [ -e $TMP_AV ]
|
426 |
if [ -e $TMP_AV ]
|
| 444 |
then
|
427 |
then
|
| 445 |
ENABLE_AV=1
|
428 |
ENABLE_AV=1
|
| 446 |
DATE_END=$(cat $TMP_AV | sort -n | head -1)
|
429 |
DATE_END=$(cat $TMP_AV | sort -n | head -1)
|
| 447 |
for TS in $(seq $C_TS -$STEP_TS $DATE_END)
|
430 |
for TS in $(seq $C_TS -$STEP_TS $DATE_END)
|
| Line 467... |
Line 450... |
| 467 |
CONF_AV='config_av'
|
450 |
CONF_AV='config_av'
|
| 468 |
echo "<center>" >> $HTML_REPORT
|
451 |
echo "<center>" >> $HTML_REPORT
|
| 469 |
echo "<canvas id='$NAME_AV' width='450' height='450' ></canvas>" >> $HTML_REPORT
|
452 |
echo "<canvas id='$NAME_AV' width='450' height='450' ></canvas>" >> $HTML_REPORT
|
| 470 |
echo "</center>" >> $HTML_REPORT
|
453 |
echo "</center>" >> $HTML_REPORT
|
| 471 |
|
454 |
|
| 472 |
|
- |
|
| 473 |
#create chart bar in html file with javascript (chartjs.com)
|
455 |
#create chart bar in html file with javascript (chartjs.com)
|
| 474 |
echo "<script>" >> $HTML_REPORT
|
456 |
echo "<script>" >> $HTML_REPORT
|
| 475 |
cat $MODEL_CHARTJS | while read LINE_JS
|
457 |
cat $MODEL_CHARTJS | while read LINE_JS
|
| 476 |
do
|
458 |
do
|
| 477 |
#name of variable
|
459 |
#name of variable
|
| Line 516... |
Line 498... |
| 516 |
echo $LINE_JS >> $HTML_REPORT
|
498 |
echo $LINE_JS >> $HTML_REPORT
|
| 517 |
fi
|
499 |
fi
|
| 518 |
done
|
500 |
done
|
| 519 |
echo "</script>" >> $HTML_REPORT
|
501 |
echo "</script>" >> $HTML_REPORT
|
| 520 |
else
|
502 |
else
|
| 521 |
echo "<h2>Aucune menace virale.</h2>" >> $HTML_REPORT
|
503 |
echo "<h3>Aucune menace virale.</h3>" >> $HTML_REPORT
|
| 522 |
fi
|
504 |
fi
|
| 523 |
|
505 |
|
| 524 |
|
506 |
|
| 525 |
######################ALCASAR : DAILY USE######################
|
507 |
######################ALCASAR : DAILY USE######################
|
| 526 |
echo "Get daily use connection of the week"
|
508 |
echo "Get daily use connection of the week"
|
| 527 |
#create html document
|
- |
|
| - |
|
509 |
|
| 528 |
echo "<h2>Statistiques volumétrie connexions</h2>" >> $HTML_REPORT
|
510 |
echo "<h3>Statistiques volumétrie connexions</h3>" >> $HTML_REPORT
|
| 529 |
|
511 |
|
| 530 |
#create new htdigest user to consult statistique of ACC
|
512 |
#create new htdigest user to consult statistique of ACC
|
| 531 |
#if user does not exist, we create him
|
513 |
#if user does not exist, we create him
|
| 532 |
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -lt 1 ]
|
514 |
if [ "$(grep "$tmp_account:" $DIR_KEY/key_only_manager | wc -l)" -lt 1 ]
|
| 533 |
then
|
515 |
then
|
| Line 560... |
Line 542... |
| 560 |
echo "Get ACC log access of the week"
|
542 |
echo "Get ACC log access of the week"
|
| 561 |
|
543 |
|
| 562 |
ROWS=""
|
544 |
ROWS=""
|
| 563 |
while read -r access ; do
|
545 |
while read -r access ; do
|
| 564 |
access_datas=(${access//|/ })
|
546 |
access_datas=(${access//|/ })
|
| 565 |
|
- |
|
| 566 |
accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
|
547 |
accces_date_intl=$(echo "${access_datas[0]} ${access_datas[1]}" | sed -E 's@^([0-9]{2})+/+([0-9]{2})+/+([0-9]{4})+@\3-\2-\1@') # Convert date format DD/MM/YYYY to YYYY-MM-DD
|
| 567 |
access_date=$(date -d "$accces_date_intl" +%s)
|
548 |
access_date=$(date -d "$accces_date_intl" +%s)
|
| 568 |
access_user=${access_datas[2]}
|
549 |
access_user=${access_datas[2]}
|
| 569 |
access_ip=${access_datas[3]}
|
550 |
access_ip=${access_datas[3]}
|
| 570 |
access_agent=$(echo "$access" | cut -d'|' -f4)
|
551 |
access_agent=$(echo "$access" | cut -d'|' -f4)
|
| 571 |
if [ $access_date -lt $SECS_AGO ]; then
|
552 |
if [ $access_date -lt $SECS_AGO ]; then
|
| 572 |
break
|
553 |
break
|
| 573 |
fi
|
554 |
fi
|
| 574 |
|
- |
|
| 575 |
access_date_formatted=$(date -d @$access_date +"%x %X")
|
555 |
access_date_formatted=$(date -d @$access_date +"%x %X")
|
| 576 |
|
- |
|
| 577 |
ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td><td>$access_agent</td></tr>"
|
556 |
ROWS="$ROWS<tr><td>$access_date_formatted</td><td>$access_user</td><td>$access_ip</td><td>$access_agent</td></tr>"
|
| 578 |
done < <(cat /var/Save/security/acc_access.log | sort -r)
|
557 |
done < <(cat /var/Save/security/acc_access.log | sort -r)
|
| 579 |
# TODO: Read archives if necessary
|
558 |
# TODO: Read archives if necessary
|
| 580 |
|
- |
|
| 581 |
if [ -z "$ROWS" ]; then
|
559 |
if [ -z "$ROWS" ]; then
|
| 582 |
ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucune connexion</td></tr>"
|
560 |
ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucune connexion</td></tr>"
|
| 583 |
fi
|
561 |
fi
|
| 584 |
|
562 |
|
| 585 |
# Create HTML document
|
563 |
# Create HTML document
|
| 586 |
echo "<h2>Connexion à l'ALCASAR Control Center (ACC)</h2>" >> $HTML_REPORT
|
564 |
echo "<h3>Connexion à l'ALCASAR Control Center (ACC)</h3>" >> $HTML_REPORT
|
| 587 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
565 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
| 588 |
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th><th>Agent</th></tr></thead><tbody>" >> $HTML_REPORT
|
566 |
echo "<thead><tr><th>Date</th><th>Utilisateur</th><th>Adresse IP</th><th>Agent</th></tr></thead><tbody>" >> $HTML_REPORT
|
| 589 |
echo "$ROWS" >> $HTML_REPORT
|
567 |
echo "$ROWS" >> $HTML_REPORT
|
| 590 |
echo "</tbody></table>" >> $HTML_REPORT
|
568 |
echo "</tbody></table>" >> $HTML_REPORT
|
| 591 |
|
569 |
|
| Line 600... |
Line 578... |
| 600 |
year=$(echo "$entry" | sed -n 's/.*"year": \([0-9]*\).*/\1/p')
|
578 |
year=$(echo "$entry" | sed -n 's/.*"year": \([0-9]*\).*/\1/p')
|
| 601 |
month=$(echo "$entry" | sed -n 's/.*"month": \([0-9]*\).*/\1/p')
|
579 |
month=$(echo "$entry" | sed -n 's/.*"month": \([0-9]*\).*/\1/p')
|
| 602 |
day=$(echo "$entry" | sed -n 's/.*"day": \([0-9]*\).*/\1/p')
|
580 |
day=$(echo "$entry" | sed -n 's/.*"day": \([0-9]*\).*/\1/p')
|
| 603 |
rx=$(echo "$entry" | sed -n 's/.*"rx": \([0-9]*\).*/\1/p')
|
581 |
rx=$(echo "$entry" | sed -n 's/.*"rx": \([0-9]*\).*/\1/p')
|
| 604 |
tx=$(echo "$entry" | sed -n 's/.*"tx": \([0-9]*\).*/\1/p')
|
582 |
tx=$(echo "$entry" | sed -n 's/.*"tx": \([0-9]*\).*/\1/p')
|
| 605 |
|
- |
|
| 606 |
if [ -n "$year" ]; then
|
583 |
if [ -n "$year" ]; then
|
| 607 |
date_year=$year
|
584 |
date_year=$year
|
| 608 |
fi
|
585 |
fi
|
| 609 |
|
- |
|
| 610 |
if [ -n "$month" ]; then
|
586 |
if [ -n "$month" ]; then
|
| 611 |
if [ $month -le 9 ]; then
|
587 |
if [ $month -le 9 ]; then
|
| 612 |
date_month="0$month"
|
588 |
date_month="0$month"
|
| 613 |
else
|
589 |
else
|
| 614 |
date_month=$month
|
590 |
date_month=$month
|
| 615 |
fi
|
591 |
fi
|
| 616 |
fi
|
592 |
fi
|
| 617 |
|
- |
|
| 618 |
if [ -n "$day" ]; then
|
593 |
if [ -n "$day" ]; then
|
| 619 |
if [ $day -le 9 ]; then
|
594 |
if [ $day -le 9 ]; then
|
| 620 |
date_day="0$day"
|
595 |
date_day="0$day"
|
| 621 |
else
|
596 |
else
|
| 622 |
date_day=$day
|
597 |
date_day=$day
|
| 623 |
fi
|
598 |
fi
|
| 624 |
fi
|
599 |
fi
|
| 625 |
|
- |
|
| 626 |
if [ -n "$rx" ]; then
|
600 |
if [ -n "$rx" ]; then
|
| 627 |
day_rx=$rx
|
601 |
day_rx=$rx
|
| 628 |
fi
|
602 |
fi
|
| 629 |
|
- |
|
| 630 |
if [ -n "$tx" ]; then
|
603 |
if [ -n "$tx" ]; then
|
| 631 |
day_tx=$tx
|
604 |
day_tx=$tx
|
| 632 |
fi
|
605 |
fi
|
| 633 |
|
- |
|
| 634 |
if [ -n "$date_year" ] && [ -n "$date_month" ] && [ -n "$date_day" ] && [ -n "$day_rx" ] && [ -n "$day_tx" ]; then
|
606 |
if [ -n "$date_year" ] && [ -n "$date_month" ] && [ -n "$date_day" ] && [ -n "$day_rx" ] && [ -n "$day_tx" ]; then
|
| 635 |
day_date="$date_day$date_month$date_year"
|
607 |
day_date="$date_day$date_month$date_year"
|
| 636 |
day_total=$((day_rx * day_tx))
|
608 |
day_total=$((day_rx * day_tx))
|
| 637 |
ROWS="$ROWS<tr><td>$day_date</td><td>$day_rx</td><td>$day_tx</td><td>$day_total</td></tr>"
|
609 |
ROWS="$ROWS<tr><td>$day_date</td><td>$day_rx</td><td>$day_tx</td><td>$day_total</td></tr>"
|
| 638 |
date_month=""
|
610 |
date_month=""
|
| 639 |
date_day=""
|
611 |
date_day=""
|
| 640 |
date_year=""
|
612 |
date_year=""
|
| 641 |
fi
|
613 |
fi
|
| 642 |
done < <(vnstat -i $EXIT_IF --json d -b $(date --date="7 days ago" "+%Y-%m-%d") | python -m json.tool | sed -n 's/.*"day": \([0-9]*\).*/\1/p')
|
614 |
done < <(vnstat -i $EXIT_IF --json d -b $(date --date="7 days ago" "+%Y-%m-%d") | python -m json.tool | sed -n 's/.*"day": \([0-9]*\).*/\1/p')
|
| 643 |
|
- |
|
| 644 |
if [ -z "$ROWS" ]; then
|
615 |
if [ -z "$ROWS" ]; then
|
| 645 |
ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
|
616 |
ROWS="<tr><td colspan=\"4\" style=\"text-align: center;\">Aucun jour capturé</td></tr>"
|
| 646 |
fi
|
617 |
fi
|
| 647 |
|
618 |
|
| 648 |
# Create html document
|
619 |
# Create html document
|
| 649 |
echo "<h2>Trafic global</h2>" >> $HTML_REPORT
|
620 |
echo "<h3>Trafic global</h3>" >> $HTML_REPORT
|
| 650 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
621 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
| 651 |
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
|
622 |
echo "<thead><tr><th>Date</th><th>Entrant</th><th>Sortant</th><th>Total</th></tr></thead><tbody>" >> $HTML_REPORT
|
| 652 |
echo "$ROWS" >> $HTML_REPORT
|
623 |
echo "$ROWS" >> $HTML_REPORT
|
| 653 |
echo "</tbody></table>" >> $HTML_REPORT
|
624 |
echo "</tbody></table>" >> $HTML_REPORT
|
| 654 |
|
625 |
|
| Line 670... |
Line 641... |
| 670 |
|
641 |
|
| 671 |
if [ -z "$ROWS" ]; then
|
642 |
if [ -z "$ROWS" ]; then
|
| 672 |
ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
|
643 |
ROWS="<tr><td colspan=\"3\" style=\"text-align: center;\">Aucune adresse IP bloquée</td></tr>"
|
| 673 |
fi
|
644 |
fi
|
| 674 |
|
645 |
|
| 675 |
# Create html document
|
646 |
#Create html document
|
| 676 |
echo "<h2>Adresse(s) IP bloquée(s) (Fail2Ban)</h2>" >> $HTML_REPORT
|
647 |
echo "<h3>Adresse(s) IP bloquée(s) (Fail2Ban)</h3>" >> $HTML_REPORT
|
| 677 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
648 |
echo "<table class=\"table table-striped\">" >> $HTML_REPORT
|
| 678 |
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
|
649 |
echo "<thead><tr><th>Date</th><th>Adresse IP</th><th>Règle</th></tr></thead><tbody>" >> $HTML_REPORT
|
| 679 |
echo $ROWS >> $HTML_REPORT
|
650 |
echo $ROWS >> $HTML_REPORT
|
| 680 |
echo "</tbody></table>" >> $HTML_REPORT
|
651 |
echo "</tbody></table>" >> $HTML_REPORT
|
| 681 |
|
652 |
|
| 682 |
|
653 |
|
| 683 |
######################FIN HTML######################
|
654 |
######################HTML END######################
|
| 684 |
|
655 |
|
| 685 |
#Execute our javascript function to print charts
|
656 |
#Execute our javascript function to print charts
|
| 686 |
echo "<script>window.onload = function() {" >> $HTML_REPORT
|
657 |
echo "<script>window.onload = function() {" >> $HTML_REPORT
|
| 687 |
#BL SINCE INSTALLATION
|
658 |
#BL since installation
|
| 688 |
if [ $ENABLE_BL -eq "1" ]
|
659 |
if [ $ENABLE_BL -eq "1" ]
|
| 689 |
then
|
660 |
then
|
| 690 |
echo "var ctx_$NAME_BL_INSTALLATION = document.getElementById('$NAME_BL_INSTALLATION').getContext('2d');" >> $HTML_REPORT
|
661 |
echo "var ctx_$NAME_BL_INSTALLATION = document.getElementById('$NAME_BL_INSTALLATION').getContext('2d');" >> $HTML_REPORT
|
| 691 |
echo "var $NAME_BL_INSTALLATION = new Chart(ctx_$NAME_BL_INSTALLATION, $CONF_BL_INSTALLATION);" >> $HTML_REPORT
|
662 |
echo "var $NAME_BL_INSTALLATION = new Chart(ctx_$NAME_BL_INSTALLATION, $CONF_BL_INSTALLATION);" >> $HTML_REPORT
|
| 692 |
fi
|
663 |
fi
|
| 693 |
#BL WEEK
|
664 |
#BL week
|
| 694 |
if [ $ENABLE_BL_WEEK -eq "1" ]
|
665 |
if [ $ENABLE_BL_WEEK -eq "1" ]
|
| 695 |
then
|
666 |
then
|
| 696 |
echo "var ctx_$NAME_BL = document.getElementById('$NAME_BL').getContext('2d');" >> $HTML_REPORT
|
667 |
echo "var ctx_$NAME_BL = document.getElementById('$NAME_BL').getContext('2d');" >> $HTML_REPORT
|
| 697 |
echo "var $NAME_BL = new Chart(ctx_$NAME_BL, $CONF_BL);" >> $HTML_REPORT
|
668 |
echo "var $NAME_BL = new Chart(ctx_$NAME_BL, $CONF_BL);" >> $HTML_REPORT
|
| 698 |
fi
|
669 |
fi
|
| 699 |
#VIRUS THREAT
|
670 |
#malware Threat
|
| 700 |
if [ $ENABLE_AV -eq "1" ]
|
671 |
if [ $ENABLE_AV -eq "1" ]
|
| 701 |
then
|
672 |
then
|
| 702 |
echo "var ctx_$NAME_AV = document.getElementById('$NAME_AV').getContext('2d');" >> $HTML_REPORT
|
673 |
echo "var ctx_$NAME_AV = document.getElementById('$NAME_AV').getContext('2d');" >> $HTML_REPORT
|
| 703 |
echo "var $NAME_AV = new Chart(ctx_$NAME_AV, $CONF_AV);" >> $HTML_REPORT
|
674 |
echo "var $NAME_AV = new Chart(ctx_$NAME_AV, $CONF_AV);" >> $HTML_REPORT
|
| 704 |
fi
|
675 |
fi
|