#!/bin/bash

# picks up iptables/ufw message from the kernel log
# you need to enable the following line in /etc/rsyslog.conf
#   module(load="imklog" permitnonkernelfacility="on")
# and enable ufw logging:
#   ufw logging on

# pick the last 10 mins of the kern.log (2000 lines should cover that) and count the auth failures for ssh
if [[ ${1} == '+22' ]]; then
    tail -2000 /var/log/kern.log | grep '\[UFW BL' | grep 'DPT=22 ' |./last10mins | wc -l
elif [[ ${1} == '-22' ]]; then
    tail -2000 /var/log/kern.log | grep '\[UFW BL' | grep -v 'DPT=22 ' |./last10mins | wc -l
else
    # tail -2000 /var/log/kern.log | grep '\[UFW BL' | ./last10mins | wc -l
    tail -2000 /var/log/kern.log | grep '\[UFW BL' | ./last10mins | sed "s/^.*SRC=\([0-9.]*\) .*$/\1/" >/tmp/scanning.tmp
    cat /tmp/scanning.tmp | while read IP; do
        addEvent.sh "BLOCK,${IP},5,5,Portscanning attempt"
    done
    cat /tmp/scanning.tmp | wc -l
fi