87 lines
3.2 KiB
Python
Executable File
87 lines
3.2 KiB
Python
Executable File
#!/usr/bin/python3
|
|
|
|
import os
|
|
from twisted.internet import protocol, reactor, endpoints
|
|
from datetime import datetime
|
|
from sendAuthMail import SendOff
|
|
|
|
# HOMEIP='213.46.222.164'
|
|
with open('/root/SAVEIPS') as f:
|
|
SAVEIPS = f.read().splitlines()
|
|
|
|
# run this as a daemon
|
|
# # nohup python3 eventService.py &
|
|
# start-stop-daemon -SbCv -x /opt/Monitor/monitor/eventService.py
|
|
|
|
def log_event(text):
|
|
with open('/tmp/event.log', 'a') as f1:
|
|
f1.write(text)
|
|
|
|
|
|
class Event(protocol.Protocol):
|
|
|
|
events = {}
|
|
illegal_events = 0
|
|
|
|
def dataReceived(self, data):
|
|
'''
|
|
data contains the event, which a 1-liner like:
|
|
"type,key,repetition-treshold,time-out,event-text"
|
|
type: ERROR, BLOCK, WARNING
|
|
key: error-id, incse of BLOCK this is an IP-address
|
|
repetition-treshold and time-out: if 5 times in 10 minutes, take action (ERROR: sendmail, BLOCK: block thre ip-address)
|
|
'''
|
|
event = str(data, 'utf-8').strip()
|
|
now = datetime.now()
|
|
now_label = now.strftime('%d.%H:%M:%S')
|
|
|
|
# put ther raw event in the log
|
|
log_event("{} {}\n".format(now_label, event))
|
|
|
|
# saving and dealing with the event comes here....
|
|
if not (event.count(',') == 4 and (event.startswith('ERROR') or event.startswith('WARN') or event.startswith('BLOCK'))):
|
|
event="ERROR,ILLEGAL,3,10,Misformed event has been sent to the logger"
|
|
|
|
(evtype, evkey, evrep, evtimeout, evtext) = event.split(',')
|
|
if evtype == 'ERROR' or evtype == 'BLOCK':
|
|
new_timestamp_list = []
|
|
if evkey in self.events.keys():
|
|
timestamp_list = self.events[evkey]
|
|
for timestamp in timestamp_list:
|
|
# if timestamp is younger than now - evtimeout, add it to the new list
|
|
delta_time = now - timestamp
|
|
if delta_time.total_seconds() < (60.0 * int(evtimeout)):
|
|
new_timestamp_list.append(timestamp)
|
|
new_timestamp_list.append(now)
|
|
self.events[evkey] = new_timestamp_list
|
|
|
|
# print(self.events)
|
|
|
|
if len(new_timestamp_list) >= int(evrep):
|
|
# delete the event in the key-list
|
|
del self.events[evkey]
|
|
# now send a message or block an ip
|
|
if evtype == 'ERROR':
|
|
# send an email
|
|
log_event("***** Previous line caused an alert *****\n")
|
|
s = SendOff(event)
|
|
s.ignace()
|
|
elif evtype == 'BLOCK':
|
|
# evkey is the IP address, check if its not my own
|
|
if not evkey in SAVEIPS:
|
|
log_event("***** Blocking IP {} full access *****\n".format(evkey))
|
|
# block the IP address
|
|
os.system("ufw insert 1 deny from {}".format(evkey))
|
|
# os.system("ufw insert 1 deny log from {}".format(evkey))
|
|
|
|
|
|
|
|
class EventFactory(protocol.Factory):
|
|
def buildProtocol(self, addr):
|
|
return Event()
|
|
|
|
|
|
endpoints.serverFromString(reactor, "tcp:1234").listen(EventFactory())
|
|
reactor.run() # pylint: disable=no-member
|
|
|