Visitantes Apache

Adjunto mini-script que lee el apache.log y te saca IP - Nº de conexiones que ha hecho. La idea es enviar un email diario con esto para ir viendo que ip's se conectan. Una chorrada, si, pero yo en 1 semana ya he visto conexiones 'raras' de EE.UU...

#!/bin/bash

LOG=/var/log/apache2/access.log


echo "-----------------------: -------------"
echo "IP : N. Conexions"
echo "-----------------------: -------------"
echo ""

for ip in $(cat $LOG | cut -d - -f 1 | sort | uniq); do

  echo -e "$ip : $(cat $LOG | grep $ip | wc -l )"

done

echo "-----------------------:--------------"

entonces hacemos un crontab que ejecute:

apache-access.sh | column -t -s ':' | mail -s "ACCESSOS APACHE" admin@example.xxx

Script para ver accesos imap y desde que ip:

#!/bin/bash

LOG=/var/log/mail.log

echo "-----------------------|-------------"
echo "User | Ip."
echo "-----------------------|-------------"
echo ""

#busquem usuaris
for user in $(cat $LOG | grep imap-login | grep ": Login" | cut -d \  -f 8 | sort | uniq); do

  echo "$user"

  #ip de cada user
  for ip in $(cat $LOG | grep imap-login | grep $user | cut -d \  -f 10 | sort | uniq); do

     lip=$(expr "${ip:4}" : '\([0-9]*\.[0-9]*\.[0-9]*\.[0-9]*\)')

     #ojo si el campo 10 no es la ip (p.e. auth fail)
     if [ -n "$lip" ]; then
       echo " | $ip - $(host $lip | cut -d \  -f 5| tr -d '\n')"
     fi
  done
done
echo "-----------------------|--------------"

echo ""
echo "ERRORS AUTH |  "
echo "----------- | "
echo " | $(cat $LOG | grep Abort)"

Script para ver accesos al submission

#!/bin/bash

LOG=/var/log/mail.log

(echo "-----------------------|-------------"
echo "IP | HOST"
echo "-----------------------|-------------"
echo ""


for ip in $(cat $LOG | grep submission | grep ": connect" | cut -d \[ -f 3 | tr -d \] | sort | uniq); do
   echo "$ip | $(host $ip dns-server | cut -d \  -f 5 | tr -d '\n')"
done

echo "."
echo "AUTH FAILED |"
echo "----------- |") | column -t -s '|'
cat /var/log/mail.log| grep submission | grep 'authentication failed'