Subversion Repositories ALCASAR

Rev

Rev 1154 | Rev 1165 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1154 Rev 1157
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-watchdog.sh 1154 2013-07-15 14:27:10Z crox53 $
 2 
# $Id: alcasar-watchdog.sh 1157 2013-07-16 10:48:11Z stephane $
3 
 
 3 
 
4 
# alcasar-watchdog.sh
 4 
# alcasar-watchdog.sh
5 
# by Rexy
 5 
# by Rexy
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 - 
 
8 
# Ce script prévient les usagers de l'indisponibilité de l'accès Internet
 7 
# Ce script prévient les usagers de l'indisponibilité de l'accès Internet
9 
# il déconnecte les usagers dont
 8 
# il déconnecte les usagers dont
10 
# - les équipements réseau ne répondent plus
 9 
# - les équipements réseau ne répondent plus
11 
# - les adresses MAC sont usurpées
 10 
# - les adresses MAC sont usurpées
12 
# This script tells users that Internet access is down
 11 
# This script tells users that Internet access is down
13 
# it logs out users whose
12 
# it logs out users whose
14 
# - PCs are quiet
 13 
# - PCs are quiet
15 
# - MAC address are in used by other systems (usurped)
 14 
# - MAC address is used by other systems (usurped)
16 
 
 15 
 
17 
EXTIF="eth0"
 16 
EXTIF="eth0"
18 
INTIF="eth1"
 17 
INTIF="eth1"
19 
conf_file="/usr/local/etc/alcasar.conf"
 18 
conf_file="/usr/local/etc/alcasar.conf"
20 
private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
 19 
private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
21 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 20 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
22 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 21 
PRIVATE_IP=`echo "$private_ip_mask" |cut -d"/" -f1`      # @ip du portail (côté LAN)
- 
 
 22 
PRIVATE_IP=${PRIVATE_IP:=192.168.182.1}
23 
tmp_file="/tmp/watchdog.txt"
 23 
tmp_file="/tmp/watchdog.txt"
24 
DIR_WEB="/var/www/html"
 24 
DIR_WEB="/var/www/html"
25 
Index_Page="$DIR_WEB/index.php"
 25 
Index_Page="$DIR_WEB/index.php"
26 
OLDIFS=$IFS
 26 
OLDIFS=$IFS
27 
IFS=$'\n'
 27 
IFS=$'\n'
28 
 
 28 
 
29 
function lan_down_alert ()
 29 
function lan_down_alert ()
30 
# users are redirected on ALCASAR IP address if LAN Pb detected
 30 
# users are redirected on ALCASAR IP address if a LAN problem is detected
31 
{
 31 
{
32 
	case $LAN_DOWN in
 32 
	case $LAN_DOWN in
33 
	"1")
 33 
	"1")
34 
		logger "eth0 link down"
 34 
		logger "eth0 link down"
35 
		echo "eth0 is down"
 35 
		echo "eth0 is down"
Line 40... Line 40...
40 
		echo "can't contact the default router"
 40 
		echo "can't contact the default router"
41 
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the default router\";?g" $Index_Page
 41 
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the default router\";?g" $Index_Page
42 
		;;
 42 
		;;
43 
	esac
 43 
	esac
44 
	net_pb=`cat /etc/dnsmasq.conf|grep "address=/#/"|wc -l`
 44 
	net_pb=`cat /etc/dnsmasq.conf|grep "address=/#/"|wc -l`
45 
	if [ $net_pb = "0" ] # on alerte les usagers (si ce n'est pas déjà le cas).
 45 
	if [ $net_pb = "0" ] # user alert
46 
		then
 46 
		then
47 
		/bin/sed -i "s?^\$network_pb.*?\$network_pb = True;?g" $Index_Page
 47 
		/bin/sed -i "s?^\$network_pb.*?\$network_pb = True;?g" $Index_Page
48 
		/bin/sed -i "s?^conf-dir=.*?address=\/#\/$PRIVATE_IP?g" /etc/dnsmasq-blackhole.conf
 48 
		/bin/sed -i "s?^conf-dir=.*?address=\/#\/$PRIVATE_IP?g" /etc/dnsmasq-blackhole.conf
49 
		/bin/sed -i "1i\address=\/#\/$PRIVATE_IP" /etc/dnsmasq.conf
 49 
		/bin/sed -i "1i\address=\/#\/$PRIVATE_IP" /etc/dnsmasq.conf
50 
		/etc/init.d/dnsmasq restart
 50 
		/etc/init.d/dnsmasq restart
Line 121... Line 121...
121 
					/usr/sbin/chilli_query dhcp-release $noresponse_mac  # release dhcp for mac_auth equipment
121 
					/usr/sbin/chilli_query dhcp-release $noresponse_mac  # release dhcp for mac_auth equipment
122 
				fi
 122 
				fi
123 
			done
 123 
			done
124 
			rm $tmp_file
 124 
			rm $tmp_file
125 
		fi
 125 
		fi
126 
# on traite chaque équipements connus de chilli
 126 
# process each equipment known by chilli
127 
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
 127 
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
128 
		do
 128 
		do
129 
			active_ip=`echo $system |cut -d" " -f2`
 129 
			active_ip=`echo $system |cut -d" " -f2`
130 
			active_session=`echo $system |cut -d" " -f5`
 130 
			active_session=`echo $system |cut -d" " -f5`
131 
			active_mac=`echo $system | cut -d" " -f1`
 131 
			active_mac=`echo $system | cut -d" " -f1`
132 
			active_user=`echo $system |cut -d" " -f6`
 132 
			active_user=`echo $system |cut -d" " -f6`
133 
# on ne traite que les équipements exploitées par un usager authentifié (test de 2 réponses en 4 secondes)
 133 
# process only equipment with an authenticated user
134 
			if [[ $(expr $active_session) -eq 1 ]]
 134 
			if [[ $(expr $active_session) -eq 1 ]]
135 
				then
 135 
			then
136 
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
 136 
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
137 
# on stocke les adresses IP des stations muettes
 137 
# store @IP of quiet equipments
138 
				if [[ $(expr $arp_reply) -eq 0 ]]
 138 
				if [[ $(expr $arp_reply) -eq 0 ]]
139 
	       				then
 139 
	       				then
- 
 
 140 
					PTN='^[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]$'
- 
 
 141 
					if [[ $(expr $active_user : $PTN) -eq 0 ]] # don't process @mac auth equipments
- 
 
 142 
					then
140 
					echo "$active_ip $active_mac $active_user" >> $tmp_file
 143 
						echo "$active_ip $active_mac $active_user" >> $tmp_file
- 
 
 144 
					fi
141 
				fi
 145 
				fi
142 
# on deconnecte l'usager d'une stations usurpée (@MAC)
 146 
# disconnect users whose equipement is usurped (@MAC)
143 
				if [[ $(expr $arp_reply) -gt 2 ]]
 147 
				if [[ $(expr $arp_reply) -gt 2 ]]
144 
	       				then
 148 
	       				then
145 
					echo "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/logs/security/watchdog.log
 149 
					echo "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/logs/security/watchdog.log
146 
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
 150 
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
147 
					/usr/sbin/chilli_query logout $active_mac
 151 
					/usr/sbin/chilli_query logout $active_mac