Subversion Repositories ALCASAR

Rev

Rev 2107 | Rev 2113 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2107 Rev 2108
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-watchdog.sh 2107 2017-01-05 22:23:35Z raphael.pion $
 2 
# $Id: alcasar-watchdog.sh 2108 2017-01-06 08:50:25Z richard $
3 
 
 3 
 
4 
# alcasar-watchdog.sh
 4 
# alcasar-watchdog.sh
5 
# by Rexy
 5 
# by Rexy
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
# Ce script prévient les usagers de l'indisponibilité de l'accès Internet
 7 
# - Ce script prévient les usagers de l'indisponibilité de l'accès Internet
8 
# il déconnecte les usagers dont
 - 
 
9 
# - les équipements réseau ne répondent plus ( si la fenetre status.php a été fermé. Les autorisations par adresse mac sont laissé de côté)
 8 
# - Il déconnecte les usagers dont les équipements réseau ne répondent plus (leur onglet 'status.php' a été fermé)
10 
# - les adresses MAC sont usurpées
 9 
# - Il deconnecte les usagers dont les adresses MAC sont usurpées
- 
 
 10 
#
11 
# This script tells users that Internet access is down
 11 
# - This script tells users that Internet access is down
12 
# it logs out users whose
- 
 
13 
# - PCs are quiet (it means that status.php has been closed. We put aside @MAC Authorization )
 12 
# - It logs out users whose PCs are quiet (their status tab is closed)
14 
# - MAC address is used by other systems (usurped)
 13 
# - It logs out users whose MAC address is used by other systems (usurped)
15 
 
 14 
 
16 
CONF_FILE="/usr/local/etc/alcasar.conf"
 15 
CONF_FILE="/usr/local/etc/alcasar.conf"
17 
EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2`			# EXTernal InterFace
 16 
EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2`			# EXTernal InterFace
18 
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`			# INTernal InterFace
 17 
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`			# INTernal InterFace
19 
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
 18 
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
20 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 19 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
21 
PRIVATE_IP=`echo "$private_ip_mask" |cut -d"/" -f1`      # @ip du portail (côté LAN)
 20 
PRIVATE_IP=`echo "$private_ip_mask" |cut -d"/" -f1`      # @ip du portail (côté LAN)
22 
PRIVATE_IP=${PRIVATE_IP:=192.168.182.1}
 21 
PRIVATE_IP=${PRIVATE_IP:=192.168.182.1}
23 
tmp_file="/tmp/watchdog.txt"
 - 
 
24 
current_users_file="/tmp/current_users.txt"
 22 
current_users_file="/var/tmp/havp/current_users.txt"	# file containing active users with their "status.php" tab open
25 
DIR_WEB="/var/www/html"
 23 
DIR_WEB="/var/www/html"
26 
Index_Page="$DIR_WEB/index.php"
 24 
Index_Page="$DIR_WEB/index.php"
27 
IPTABLES="/sbin/iptables"
 25 
IPTABLES="/sbin/iptables"
28 
TUNIF="tun0"						# listen device for chilli daemon
 26 
TUNIF="tun0"						# listen device for chilli daemon
29 
OLDIFS=$IFS
 27 
OLDIFS=$IFS
Line 103... Line 101...
103 
		lan_test
 101 
		lan_test
104 
		exit 0
 102 
		exit 0
105 
		;;
 103 
		;;
106 
	*)
 104 
	*)
107 
		lan_test
 105 
		lan_test
108 
 
 - 
 
109 
		# We disconnect inactive users (its means that status.php has been closed)
 106 
		# We disconnect inactive users (its means that their 'status.php' tab has been closed --> their ip address isn't in $current_users_file)
110 
		# Each user inform about his connectivity by filling in /tmp/current_users.txt his own @IP
 - 
 
111 
		# process each equipment known by chilli to check if any equipment is usurped (@MAC)
 107 
		# process each equipment known by chilli to check if IP address is usurped (with arping)
112 
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
 108 
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
113 
		do
 109 
		do
114 
			active_ip=`echo $system |cut -d" " -f2`
 110 
			active_ip=`echo $system |cut -d" " -f2`
115 
			active_session=`echo $system |cut -d" " -f5`
 111 
			active_session=`echo $system |cut -d" " -f5`
116 
			active_mac=`echo $system | cut -d" " -f1`
 112 
			active_mac=`echo $system | cut -d" " -f1`
117 
			active_user=`echo $system |cut -d" " -f6`
 113 
			active_user=`echo $system |cut -d" " -f6`
118
- 
 
119 
			#We disconnect inactive user here :
 114 
			#We disconnect inactive user here :
120 
			#We check if this is not an auth @MAC and if he is still connected
 115 
			#We check if this is not an auth @MAC and if he is still connected
121 
			if [ "$active_user" != "$active_mac" ] && [ $(echo $system | awk '$5 == 1' | wc -c) -gt 1 ]; then
 116 
			if [ "$active_user" != "$active_mac" ] && [ $(expr $active_session) -eq 1 ]; then
122 
				# If /tmp/current_user.txt exists ...
 117 
				# If /tmp/current_user.txt exists ...
123 
				if [ -e $current_users_file ]; then
 118 
				if [ -e $current_users_file ]; then
124 
					# We check if user @IP is in 'current_users.txt'
 119 
					# We check if user @IP is in 'current_users.txt'
125 
					cmp_user_ok=$(cat $current_users_file | grep $active_ip | wc -w)
 120 
					cmp_user_ok=$(cat $current_users_file | grep $active_ip | wc -w)
126 
					# If this @IP is not in this file, we disconnect this user.
 121 
					# If not we disconnect this user.
127 
					if [ $cmp_user_ok -eq 0 ]; then
 122 
					if [ $cmp_user_ok -eq 0 ]; then
128 
						logger "alcasar-watchdog $active_ip ($active_mac) can't be contact. Alcasar disconnects the user ($active_user)."
 123 
						logger "alcasar-watchdog $active_ip ($active_mac) can't be contact. Alcasar disconnects the user ($active_user)."
129 
						echo "Disconnect : $active_ip $active_mac $active_user"
 - 
 
130 
						/usr/sbin/chilli_query logout $active_mac
 124 
						/usr/sbin/chilli_query logout $active_mac
131 
					fi
 125 
					fi
132 
					# We clean 'current_users.txt'. Every user need to inform their @IP everytime to prove thier connectivity.
 126 
					# Remove the user's IP from 'current_users.txt'. Every user need to insert their @IP everytime to prove their connectivity.
133 
					sed -i 'd' $current_users_file
 127 
					sed -i "/^$active_ip/d" $current_users_file
134 
				else # If /tmp/current_user.txt does not exists we disconnect every users.
 128 
				else # "/tmp/current_user.txt" does not exists. We disconnect every users.
135 
					logger "Le fichier /tmp/current_users.txt n'existe pas."
 129 
					logger "Le fichier /tmp/current_users.txt n'existe pas."
136 
					logger "alcasar-watchdog $active_ip ($active_mac) can't be contact. Alcasar disconnects the user ($active_user)."
 130 
					logger "alcasar-watchdog $active_ip ($active_mac) can't be contact. Alcasar disconnects the user ($active_user)."
137 
					echo "Disconnect : $active_ip $active_mac $active_user"
 - 
 
138 
					/usr/sbin/chilli_query logout $active_mac
 131 
					/usr/sbin/chilli_query logout $active_mac
139 
				fi
 132 
				fi
140 
			fi
 133 
			fi
141 
 
 - 
 
142 
 
 - 
 
143 
 
 - 
 
144 
			# process only equipment with an authenticated user
 134 
			# IP usurpation test : process only equipment with an authenticated user
145 
			if [[ $(expr $active_session) -eq 1 ]]
 135 
			if [[ $(expr $active_session) -eq 1 ]]
146 
			then
 136 
			then
147 
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
 137 
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
148 
				# disconnect users whose equipement is usurped (@MAC). For example, if there are 2 same @MAC it will make 3 lines in output.
 138 
				# disconnect users whose equipement is usurped. For example, if there are 2 same @MAC it will make 3 lines in output.
149 
				if [[ $(expr $arp_reply) -gt 2 ]]
 139 
				if [[ $(expr $arp_reply) -gt 2 ]]
150 
	       				then
140 
	       				then
151 
					echo "$(date "+[%x-%X] : ")alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/security/watchdog.log
 141 
					echo "$(date "+[%x-%X] : ")alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/security/watchdog.log
152 
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
 142 
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
153 
					/usr/sbin/chilli_query logout $active_mac
 143 
					/usr/sbin/chilli_query logout $active_mac
Line 156... Line 146...
156 
			fi
 146 
			fi
157 
		done
 147 
		done
158 
		;;
 148 
		;;
159 
esac
149 
esac
160 
IFS=$OLDIFS
 150 
IFS=$OLDIFS
161 
 
 -