SHELL笔记之管家

1.通过监控用户登录找出入侵者

入侵者定义： 屡次试图登入系统达两分钟以上，并且期间的登录过程全部失败。 凡这类用户都应该被检测出并生成以下细节报告：试图登录的账号；试图登录的次数；攻击者的IP地址；IP地址对应的主机；进行登录的时间。

用户认证会话日志会被记录在日志文件/var/log/auth.log中。

=========================

#!/bin/bash

#filename: intruder_detect.sh

#use to check out the invilad login

AUTHLOG=/var/log/auth.log

if [[ -n $1 ]];

then

AUTHLOG=$1

echo Using Log file: $AUTHLOG

fi

LOG=/tmp/valid.$$.log

grep -v "invalid" $AUTHLOG > $LOG

users=$(grep "Failed password" $LOG | awk '{print $(NF-5) }' | sort | uniq )

printf "%-5s|%-10s|%-10s|%-13s|%-33s|%s\n" "Sr#" "User" "Attempts" "IP address" "Host_Mapping" "Time range"

ucount=0;

ip_list="$(egrep -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" $LOG | sort | uniq)"

for ip in $ip_list;

do

grep $ip $LOG > /tmp/tmp.$$.log

for user in $users;

do

grep $user /tmp/tmp.$$.log > /tmp/$$.log

cut -c-16 /tmp/$$.log >$$.time

tstart=$(head -1 $$.time);

start=$(date -d "$tstart" "+%s");

tend=$(tail -1 $$.time);

end=$(date -d "$tend" "+%s")

limit=$(( $end - $start ))

if [ $limit -gt 120 ];

then

let ucount++;

IP=$(egrep -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" /tmp/$$.log | head -1 );

TIME_RANGE="$tstart-->$tend"

ATTEMPTS=$(cat /tmp/$$.log|wc -l);

HOST=$(host $IP | awk '{print $NF }' )

printf "%-5s|%-10s|%-10s|%-10s|%-33s|%-s\n" "$ucount" "$user" "$ATTEMPTS" "$IP" "$HOST" "$TIME_RANGE";

fi

done

done

rm /tmp/valid.$$.log /tmp/$$.log $$.time /tmp/tmp.$$.log 2>/dev/null