72 lines
2.5 KiB
Bash
72 lines
2.5 KiB
Bash
#!/bin/bash
|
|
# ansipa-check-scans.sh — analyse client scan logs and create alert files.
|
|
# Runs hourly via /etc/cron.d/ansipa-check-scans (installed by ansipa-smb-setup.sh).
|
|
#
|
|
# Input: /data/scan-results/archive/<hostname>/<YYYY-MM-DD>.log
|
|
# Output: /data/scan-results/alerts/<hostname>/<YYYY-MM-DD>.alert
|
|
# (created only when concerning patterns are found; client deletes to acknowledge)
|
|
|
|
SCAN_BASE="/data/scan-results"
|
|
ARCHIVE_DIR="$SCAN_BASE/archive"
|
|
ALERT_DIR="$SCAN_BASE/alerts"
|
|
LOG=/var/log/ansipa-check-scans.log
|
|
|
|
log() { printf '[%s] [ansipa-check-scans] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >> "$LOG"; }
|
|
|
|
# Patterns that indicate a concerning scan result (case-insensitive).
|
|
CONCERN_PATTERNS=(
|
|
"FOUND" # ClamAV: virus or trojan found
|
|
"Infected files: [^0]" # ClamAV summary with non-zero count
|
|
"Warning:" # rkhunter warning
|
|
"Possible rootkit" # rkhunter
|
|
"INFECTED" # generic
|
|
"Suspicious file" # chkrootkit
|
|
"INFECTED SOURCE" # chkrootkit
|
|
)
|
|
|
|
shopt -s nullglob
|
|
|
|
for HOST_DIR in "$ARCHIVE_DIR"/*/; do
|
|
[[ -d "$HOST_DIR" ]] || continue
|
|
HOSTNAME=$(basename "$HOST_DIR")
|
|
mkdir -p "$ALERT_DIR/$HOSTNAME"
|
|
|
|
for SCAN_LOG in "$HOST_DIR"*.log; do
|
|
[[ -f "$SCAN_LOG" ]] || continue
|
|
LOG_DATE=$(basename "$SCAN_LOG" .log)
|
|
ALERT_FILE="$ALERT_DIR/$HOSTNAME/$LOG_DATE.alert"
|
|
|
|
# Skip if we already generated an alert for this log.
|
|
[[ -f "$ALERT_FILE" ]] && continue
|
|
|
|
FINDINGS=()
|
|
for PATTERN in "${CONCERN_PATTERNS[@]}"; do
|
|
while IFS= read -r LINE; do
|
|
FINDINGS+=("$LINE")
|
|
done < <(grep -iE "$PATTERN" "$SCAN_LOG" 2>/dev/null || true)
|
|
done
|
|
|
|
# Deduplicate.
|
|
mapfile -t FINDINGS < <(printf '%s\n' "${FINDINGS[@]}" | sort -u)
|
|
|
|
if [[ ${#FINDINGS[@]} -gt 0 ]]; then
|
|
log "ALERT: $HOSTNAME / $LOG_DATE — ${#FINDINGS[@]} finding(s)"
|
|
{
|
|
printf '=== Ansipa Security Alert ===\n'
|
|
printf 'Host: %s\n' "$HOSTNAME"
|
|
printf 'Scan: %s\n' "$LOG_DATE"
|
|
printf 'Findings: %d\n' "${#FINDINGS[@]}"
|
|
printf '\nConcerning lines:\n'
|
|
printf ' %s\n' "${FINDINGS[@]}"
|
|
printf '\nFull log: %s\n' "$SCAN_LOG"
|
|
printf '\nTo acknowledge: delete this file on the client.\n'
|
|
printf '=== Generated: %s ===\n' "$(date)"
|
|
} > "$ALERT_FILE"
|
|
else
|
|
log "OK: $HOSTNAME / $LOG_DATE — clean"
|
|
fi
|
|
done
|
|
done
|
|
|
|
log "Check complete."
|