2005-03-09 #1

#!/bin/bash
# 系統狀態
# System Status
TODAY=$(date +%Y-%m-%d)
SERVERNAME=$(hostname -f)
# 歷史記錄
# History
HISTORY_FILE=/tmp/samba-check.log
# 重複 IP (預設使用 iptables 阻擋，應該能禁止才對)
# Duplicate IP ( Use iptables for droping connections )
WARNING_FILE=/tmp/samba-warning-$TODAY.log
# Samba 記錄檔所在目錄
# Samba log file patch
SAMBA_LOG_PATH=/var/log/samba3
# 重複 IP 警告信通知對像
# Duplicate IP warning mail recipient
INFORMER=yourname@your.domain.name
touch $HISTORY_FILE
touch $WARNING_FILE
for FILE in $(find $SAMBA_LOG_PATH -name 'log.[0-9]*');
do
  IP=$(basename $FILE | sed -e 's/log.//g' | sed -e 's/.old//g' )
  CNT=$(grep -c $IP $HISTORY_FILE)
  if [ "$CNT" = "0" ];
  then
    echo $IP >> $HISTORY_FILE
    /sbin/iptables -I INPUT -s $IP -p tcp -m tcp -j DROP
    /sbin/iptables -I INPUT -s $IP -p udp -m udp -j DROP
  else
    echo $IP >> $WARNING_FILE
  fi;
  rm $FILE
done;
if [ -s $WARNING_FILE ];
then
  /bin/mailx -s "$SERVERNAME $TODAY Samba Intruder Dectection List" $INFORMER < $WARNING_FILE
  rm $WARNING_FILE
fi;