#!/bin/bash
# 作者: 阿杰
# 用途: 實(shí)時(shí)檢測(cè)登錄日志,統(tǒng)計(jì)異常登錄
# 腳本名稱: watch_secure.sh
# 用法: bash watch_seacure.sh

# 日志記錄
log_err() {
  printf "[$(date +'%Y-%m-%dT%H:%M:%S')]: \033[31mERROR: \033[0m$@\n"
}

log_info() {
  printf "[$(date +'%Y-%m-%dT%H:%M:%S')]: \033[32mINFO: \033[0m$@\n"
}

log_warning() {
  printf "[$(date +'%Y-%m-%dT%H:%M:%S')]: \033[33mWARNING: \033[0m$@\n"
}

# 初始化Map
declare -A secureMap

init() {
    # 行數(shù)記錄文件
    line_file_name="conf/line_file.txt"
    # inode存儲(chǔ)文件
    inode_file="conf/inode.txt"
    # 認(rèn)證失敗文件記錄
    ssh_auth_failed_file="conf/ssh_auth_failed.csv"

    # 文件列表
    file_array=("$line_file_name" "$inode_file" "$ssh_auth_failed_file")
    # inode 文件狀態(tài)
    inode_file_status=0
    # 控制是否進(jìn)行寫入 0為可寫，1為不可寫
    write_status=1

    oneSecureKey=""

    {
        if [ ! -d "conf" ];then
            mkdir conf
        fi
        # 檢查文件是否存在
        for file in ${file_array[@]};do
            check_file_exists $file
        done
        line=$(cat $line_file_name)
        if [ -z "$line" ];then
            line=0
        fi
        # 認(rèn)證失敗文件第一次創(chuàng)建
        if [ $(wc -l < $ssh_auth_failed_file) -eq 0 ];then
            # 時(shí)間以月天為單位(None為空賬號(hào)或不存在賬號(hào))
            echo "登錄認(rèn)證失敗時(shí)間,源IP地址,登錄賬號(hào),連接認(rèn)證失敗次數(shù)" > $ssh_auth_failed_file
        fi

    }

    file_name="/var/log/secure"
    if [ -z "$(rpm -qa | grep 'inotify-tools')" ];then
        yum install -y inotify-tools > /dev/null 2>&1
        if [ $? -ne 0 ];then
            log_err "[init] inotify-tools 安裝失敗!"
        fi
    fi


}
# 檢查文件是否存在，不存在則創(chuàng)建
check_file_exists() {
    local file_name=$1
    if [ ! -f "$file_name" ];then
        touch $file_name
        if [ $? -ne 0 ];then
            log_err "[check_file_exists] file: $file_name 文件創(chuàng)建失敗!"
        fi
    fi
}



# 監(jiān)聽文件事件
watch_file() {
    inotifywait -mrq --format '%e' --event create,delete,modify $file_name | while read event ;do
        case "$event" in
        MODIFY)
            start_read_file
        ;;
        # 文件被刪除或重新創(chuàng)建
        CREATE|DELETE)
            # 重置文件行數(shù)
            line=0
            > $line_file_name
            check
        ;;
        *)
            log_warning "[watch_file] watch file event: $event"
        ;;
        esac
    done
}

# 只讀一行
read_line_file() {
    ((line++))
    echo $line > $line_file_name
    # 不是指定數(shù)據(jù)退出
    if [ $(sed -n "$line p" $file_name  | grep 'pam_unix(sshd:auth): authentication failure;' | wc -l ) -ne 1 ];then
        return
    fi
    # 控制是否進(jìn)行寫入
    write_status=0
    oneSecureKey=$(sed -n "$line p" $file_name  |awk -v dateNow=$(date +"%Y") '{
        split($0,rhost,"rhost=")
        split(rhost[2],rhost," ")
        split($0,user," user=")
        if (length(user[2])==0) {
            user[2]="None"
        }
        print dateNow":"$1":"$2","rhost[1]","user[2]
    }')
    log_info "[read_line_file] line: $line data:[$oneSecureKey]"

    send_map $oneSecureKey
}

# 往MAP中塞入數(shù)據(jù)
send_map() {
    local key=$1
    if [ -n ${secureMap[$key]} ];then
        secureMap[$key]=`expr ${secureMap[$key]} + 1`
    else
        secureMap[$key]=1
    fi
}

wirte_all_secure() {
    for key in ${!secureMap[@]};do
        write_one_secure $key
    done
}

write_one_secure() {
    local key="$@"
    local data=$(grep -w -n "$key" $ssh_auth_failed_file)
    if [ -n "$data" ];then
        local i=$(echo $data | awk -F: '{print $1}')
        local a=$(echo $data | awk -F, '{print $NF}')
        sed -i "${i} s#$a#${secureMap[$key]}#" $ssh_auth_failed_file
        if [ $? -ne 0 ];then
            log_err "[write_secure] 寫 $ssh_auth_failed_file 文件失敗! data:[$key,${secureMap[$key]}]"
        fi
    else
        # 新數(shù)據(jù)
        echo "$key,${secureMap[$key]}" >> $ssh_auth_failed_file
        if [ $? -ne 0 ];then
            log_err "[write_secure] 寫 $ssh_auth_failed_file 文件失敗! data:[$key,${secureMap[$key]}]"
        fi
    fi
    log_info "[write_secure] line: $line status: $write_status data:[$key,${secureMap[$key]}]"
}



# 啟動(dòng)前應(yīng)先檢查是否讀取過
check() {
    # 檢查預(yù)存Inode是否一致
    check_secure_file_inode
}

# 檢查登錄日志Inode是否一致
check_secure_file_inode() {
    inode=$(ls -i $file_name | awk '{print $1}')
    inode_file_data="$(cat $inode_file)"
    if [ -n "$inode_file_data" ]; then
        if [ $inode -ne $inode_file_data ];then
            log_warning "[check_secure_file_inode] secure file inode is inconsistency"
            # inode不一致,重置
            echo "$inode" > $inode_file
            inode_file_status=1
        else
           inode_file_status=0
        fi
    else
        # 第一次讀取
        echo "$inode" > $inode_file
        inode_file_status=1
    fi
}

# 開始讀取文件
start_read_file() {
    # 第一次讀取
    if [ $inode_file_status -eq 1 ] ;then
        # 使用循環(huán)將歷史內(nèi)容讀取
        while true;do
            if [ $line -eq $(wc -l < $file_name) ];then
                break
            fi
            read_line_file
        done
        wirte_all_secure
    elif [  $line -ne $(wc -l < $file_name) ];then
        # 使用循環(huán)將行數(shù)對(duì)齊
        while true;do
            if [ $line -eq $(wc -l < $file_name) ];then
                break
            fi
            read_line_file
            if [ $write_status -eq 0 ];then
                write_one_secure $oneSecureKey
            fi
            # 狀態(tài)設(shè)置為1
            write_status=1
        done
    # else
    #     read_line_file
    #     if [ $write_status -eq 0 ];then
    #         write_one_secure $oneSecureKey
    #     fi
    #     # 狀態(tài)設(shè)置為1
    #     write_status=1
    fi
}

test_main() {
    init
    check_secure_file_inode

}

main() {
    # 初始化
    init
    # 內(nèi)容檢查
    check
    start_read_file
    log_info "[main] watch secure startd"
    watch_file
}

main