first commit

eventService.py

@@ -0,0 +1,86 @@
+#!/usr/bin/python3
+
+import os
+from twisted.internet import protocol, reactor, endpoints
+from datetime import datetime
+from sendAuthMail import SendOff
+
+# HOMEIP='213.46.222.164'
+with open('/root/SAVEIPS') as f:
+    SAVEIPS = f.read().splitlines()
+
+# run this as a daemon
+#   # nohup python3 eventService.py &
+#   start-stop-daemon -SbCv -x /opt/Monitor/monitor/eventService.py
+
+def log_event(text):
+    with open('/tmp/event.log', 'a') as f1:
+        f1.write(text)
+
+
+class Event(protocol.Protocol):
+
+    events = {}
+    illegal_events = 0
+
+    def dataReceived(self, data):
+        '''
+            data contains the event, which a 1-liner like:
+            "type,key,repetition-treshold,time-out,event-text"
+            type: ERROR, BLOCK, WARNING
+            key: error-id, incse of BLOCK this is an IP-address
+            repetition-treshold and time-out: if 5 times in 10 minutes, take action (ERROR: sendmail, BLOCK: block thre ip-address)
+        '''
+        event = str(data, 'utf-8').strip()
+        now = datetime.now()
+        now_label = now.strftime('%d.%H:%M:%S')
+
+        # put ther raw event in the log
+        log_event("{} {}\n".format(now_label, event))
+
+        # saving and dealing with the event comes here....
+        if not (event.count(',') == 4 and (event.startswith('ERROR') or event.startswith('WARN') or event.startswith('BLOCK'))):
+            event="ERROR,ILLEGAL,3,10,Misformed event has been sent to the logger"
+
+        (evtype, evkey, evrep, evtimeout, evtext) = event.split(',')
+        if evtype == 'ERROR' or evtype == 'BLOCK':
+            new_timestamp_list = []
+            if evkey in self.events.keys():
+                timestamp_list = self.events[evkey]
+                for timestamp in timestamp_list:
+                    # if timestamp is younger than now - evtimeout, add it to the new list 
+                    delta_time = now - timestamp
+                    if delta_time.total_seconds() < (60.0 * int(evtimeout)):
+                        new_timestamp_list.append(timestamp)
+            new_timestamp_list.append(now)    
+            self.events[evkey] = new_timestamp_list
+
+            #  print(self.events)
+
+            if len(new_timestamp_list) >= int(evrep):
+                # delete the event in the key-list
+                del self.events[evkey]
+                # now send a message or block an ip
+                if evtype == 'ERROR':
+                    # send an email
+                    log_event("***** Previous line caused an alert *****\n")
+                    s = SendOff(event)
+                    s.ignace()
+                elif evtype == 'BLOCK':
+                    # evkey is the IP address, check if its not my own
+                    if not evkey in SAVEIPS:
+                        log_event("***** Blocking IP {} full access  *****\n".format(evkey))
+                        # block the IP address
+                        os.system("ufw insert 1 deny from {}".format(evkey))
+                        # os.system("ufw insert 1 deny log from {}".format(evkey))
+
+
+
+class EventFactory(protocol.Factory):
+    def buildProtocol(self, addr):
+        return Event()
+
+
+endpoints.serverFromString(reactor, "tcp:1234").listen(EventFactory())
+reactor.run()    # pylint: disable=no-member
+