mirror of
https://github.com/kenzok8/small-package
synced 2025-01-07 07:06:58 +08:00
update 2023-11-02 16:21:23
This commit is contained in:
github-actions[bot]
parent
afe6133a13
commit
eaf6496190
@ -1,4 +1,3 @@
|
||||
cip.cc
|
||||
ddns.oray.com/checkip
|
||||
www.net.cn/static/customercare/yourip.asp
|
||||
ip.3322.net
|
||||
|
||||
@ -1234,10 +1234,10 @@ function get_ip_attribution(){
|
||||
|
||||
# 登录提醒通知
|
||||
function login_send(){
|
||||
[ -n "$login_web_black" ] && [ "$login_web_black" -eq "1" ] && init_ip_black "ipv4"
|
||||
[ -n "$login_web_black" ] && [ "$login_web_black" -eq "1" ] && init_ip_black "ipv6"
|
||||
[ -n "$port_knocking_enable" ] && [ "$port_knocking_enable" -eq "1" ] && init_ip_white "ipv4"
|
||||
[ -n "$port_knocking_enable" ] && [ "$port_knocking_enable" -eq "1" ] && init_ip_white "ipv6"
|
||||
[ -n "$login_web_black" ] && [ "$login_web_black" -eq 1 ] && init_ip_black "ipv4"
|
||||
[ -n "$login_web_black" ] && [ "$login_web_black" -eq 1 ] && init_ip_black "ipv6"
|
||||
[ -n "$port_knocking_enable" ] && [ "$port_knocking_enable" -eq 1 ] && init_ip_white "ipv4"
|
||||
[ -n "$port_knocking_enable" ] && [ "$port_knocking_enable" -eq 1 ] && init_ip_white "ipv6"
|
||||
tmp_ip_list=`echo "$login_ip_white_list"|grep -v "^$"|sort -u`
|
||||
while IFS= read -r tmp_ip; do
|
||||
[ -n "$tmp_ip" ] && add_ip_white "$tmp_ip" "0"
|
||||
@ -1245,113 +1245,139 @@ function login_send(){
|
||||
[ -z "$web_logged" ] && [ -z "$ssh_logged" ] && [ -z "$web_login_failed" ] && [ -z "$ssh_login_failed" ] && return
|
||||
set_ip_black
|
||||
sys_log=$(logread notice)
|
||||
local login_title
|
||||
local login_content
|
||||
|
||||
# Web 登录提醒
|
||||
[ -f ${dir}web_login ] && for login_ip in `cat ${dir}web_login | sort -u`; do
|
||||
[ -f ${dir}web_login ] && for login_ip in `cat ${dir}web_login | awk '{print $1}' | sort -u`; do
|
||||
[ -z "$login_ip" ] && continue
|
||||
local login_time=$(echo "$sys_log" | grep -w ${login_ip} | awk '{print $4}' | tail -n 1)
|
||||
local login_mode=$(echo "$sys_log" | grep -w ${login_ip} | awk '{print $13}' | tail -n 1)
|
||||
local login_time=$(cat ${dir}web_login | grep -w ${login_ip} | awk '{print $2}' | tail -n 1)
|
||||
local login_mode=$(echo "$sys_log" | grep -E ".* $login_time.*$login_ip.*" | awk '{print $13}' | tail -n 1)
|
||||
[ "$login_mode" = "/" ] && login_mode="/ (首页登录)"
|
||||
unset log_only content_attribution content_mode
|
||||
echo "$login_ip_white_list" | grep -w -q "$login_ip" && log_only="1" && [ -n "$login_log_enable" ] && continue
|
||||
if [ -z "$log_only" ] && [ ! -z "$login_disturb" ] && [ "$login_disturb" -eq "2" ]; then
|
||||
if [ -z "$log_only" ] && [ ! -z "$login_disturb" ] && [ "$login_disturb" -eq 2 ]; then
|
||||
[ -f "$logfile" ] && login_log=$(grep -w "$login_ip" "$logfile" | grep -v "\【info\】" | tail -n 1)
|
||||
[ ! -z "$login_log" ] && log_timestamp=$(date -d "$(echo "$login_log" | awk '{print $1, $2}')" +%s) || log_timestamp=0
|
||||
[ $(($(date +%s) - log_timestamp)) -lt $login_notification_delay ] && log_only="1" && [ -n "$login_log_enable" ] && continue
|
||||
fi
|
||||
[ -n "$log_only" ] && echo "`date "+%Y-%m-%d"` ${login_time} 【info】设备 ${login_ip} 通过 Web ${login_mode} 登录了路由器 " >> ${logfile} && continue
|
||||
[ -n "$log_only" ] && echo "$(date "+%Y-%m-%d") ${login_time} 【info】设备 ${login_ip} 通过 Web ${login_mode} 登录了路由器 " >> ${logfile} && continue
|
||||
|
||||
local login_ip_attribution=$(get_ip_attribution ${login_ip})
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}IP 归属地： ${str_space}${str_space}${str_space}${str_space}${login_ip_attribution}"
|
||||
[ -n "$login_mode" ] && content_mode="${str_linefeed}${str_tab}登录方式： ${str_space}${str_space}${str_space}${str_space}${login_mode}"
|
||||
if { [ -z "$login_disturb" ] || [ "$login_disturb" -ne "1" ]; }; then
|
||||
if [ -z "$title" ]; then
|
||||
title="${login_ip} 通过 Web 登录了路由器"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
elif ( echo "$title"|grep -q "登录了路由器" ); then
|
||||
title="${login_ip} ${title}"
|
||||
content="${content}${str_splitline}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}归属地：${str_space}${str_space}${login_ip_attribution}"
|
||||
[ -n "$login_mode" ] && content_mode="${str_linefeed}${str_tab}登录方式：${str_space}Web ${login_mode}"
|
||||
if [ -z "$login_disturb" ] || [ "$login_disturb" -ne "1" ]; then
|
||||
local title_prefix="${login_ip} 登录了路由器"
|
||||
if [ -z "$login_title" ]; then
|
||||
login_title="${title_prefix}"
|
||||
elif ( echo "$login_title" | grep -q "登录了路由器" ); then
|
||||
login_title="${login_ip} ${login_title}"
|
||||
else
|
||||
title="${login_ip} 通过 Web 登录了路由器"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
login_title="设备状态变化"
|
||||
fi
|
||||
content_title="${str_splitline}${str_title_start} 登录信息${str_title_end}"
|
||||
content_time="${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${login_time}"
|
||||
content_ip="${str_linefeed}${str_tab}设备 IP：${str_space}${str_space}${login_ip}"
|
||||
login_content="${login_content}${content_title}${content_time}${content_ip}${content_attribution}${content_mode}"
|
||||
fi
|
||||
echo "`date "+%Y-%m-%d"` ${login_time} ${disturb_text}设备 ${login_ip} (${login_ip_attribution}) 通过 Web ${login_mode} 登录了路由器 " >> ${logfile}
|
||||
unset title_prefix content_time content_ip content_attribution content_mode
|
||||
echo "$(date "+%Y-%m-%d") ${login_time} ${disturb_text}设备 ${login_ip} (${login_ip_attribution}) 通过 URL ${login_mode} 登录了路由器 " >> ${logfile}
|
||||
done
|
||||
rm -f ${dir}web_login >/dev/null 2>&1
|
||||
unset login_ip login_time login_mode
|
||||
unset login_ip login_time login_mode log_only
|
||||
# SSH 登录提醒
|
||||
[ -f ${dir}ssh_login ] && for login_ip in `cat ${dir}ssh_login | sort -u`; do
|
||||
[ -f ${dir}ssh_login ] && for login_ip in `cat ${dir}ssh_login | awk '{print $1}' | sort -u`; do
|
||||
[ -z "$login_ip" ] && continue
|
||||
local login_time=$(echo "$sys_log" | grep -w ${login_ip} | awk '{print $4}' | tail -n 1)
|
||||
local login_mode=$(echo "$sys_log" | grep -w ${login_ip} | awk '{print $8}' | tail -n 1)
|
||||
unset log_only content_attribution content_mode
|
||||
local login_time=$(cat ${dir}ssh_login | grep -w ${login_ip} | awk '{print $2}' | tail -n 1)
|
||||
local login_mode=$(echo "$sys_log" | grep -E ".* $login_time.*$login_ip.*" | awk '{print $8}' | tail -n 1)
|
||||
echo "$login_ip_white_list"|grep -w -q "$login_ip" && log_only="1" && [ -n "$login_log_enable" ] && continue
|
||||
if [ -z "$log_only" ] && [ ! -z "$login_disturb" ] && [ "$login_disturb" -eq "2" ]; then
|
||||
if [ -z "$log_only" ] && [ ! -z "$login_disturb" ] && [ "$login_disturb" -eq 2 ]; then
|
||||
[ -f "$logfile" ] && login_log=$(grep -w "$login_ip" "$logfile" | grep -v "\【info\】" | tail -n 1)
|
||||
[ ! -z "$login_log" ] && log_timestamp=$(date -d "$(echo "$login_log" | awk '{print $1, $2}')" +%s) || log_timestamp=0
|
||||
[ $(($(date +%s) - log_timestamp)) -lt $login_notification_delay ] && log_only="1" && [ -n "$login_log_enable" ] && continue
|
||||
fi
|
||||
[ -n "$log_only" ] && echo "`date "+%Y-%m-%d"` ${login_time} 【info】设备 ${login_ip} 通过 SSH ${login_mode} 登录了路由器 " >> ${logfile} && continue
|
||||
[ -n "$log_only" ] && echo "$(date "+%Y-%m-%d") ${login_time} 【info】设备 ${login_ip} 通过 SSH ${login_mode} 登录了路由器 " >> ${logfile} && continue
|
||||
|
||||
local login_ip_attribution=$(get_ip_attribution ${login_ip})
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}IP 归属地： ${str_space}${str_space}${str_space}${str_space}${login_ip_attribution}"
|
||||
[ ! -z "$login_mode" ] && content_mode="${str_linefeed}${str_tab}登录方式： ${str_space}${str_space}${str_space}${str_space}${login_mode}"
|
||||
if { [ -z "$login_disturb" ] || [ "$login_disturb" -ne "1" ]; }; then
|
||||
if [ -z "$title" ]; then
|
||||
title="${login_ip} 通过 SSH 登录了路由器"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
elif ( echo "$title"|grep -q "登录了路由器" ); then
|
||||
title="${login_ip} ${title}"
|
||||
content="${content}${str_splitline}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}归属地：${str_space}${str_space}${login_ip_attribution}"
|
||||
[ ! -z "$login_mode" ] && content_mode="${str_linefeed}${str_tab}登录方式：${str_space}SSH ${login_mode}"
|
||||
if [ -z "$login_disturb" ] || [ "$login_disturb" -ne "1" ]; then
|
||||
local title_prefix="${login_ip} 登录了路由器"
|
||||
if [ -z "$login_title" ]; then
|
||||
login_title="${title_prefix}"
|
||||
elif ( echo "$login_title" | grep -q "登录了路由器" ); then
|
||||
login_title="${login_ip} ${login_title}"
|
||||
else
|
||||
title="${login_ip} 通过 SSH 登录了路由器"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${str_space}${login_time}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}${content_mode}"
|
||||
login_title="设备状态变化"
|
||||
fi
|
||||
content_title="${str_splitline}${str_title_start} 登录信息${str_title_end}"
|
||||
content_time="${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${login_time}"
|
||||
content_ip="${str_linefeed}${str_tab}设备 IP：${str_space}${str_space}${login_ip}"
|
||||
login_content="${login_content}${content_title}${content_time}${content_ip}${content_attribution}${content_mode}"
|
||||
fi
|
||||
echo "`date "+%Y-%m-%d"` ${login_time} ${disturb_text}设备 ${login_ip} (${login_ip_attribution}) 通过 SSH ${login_mode} 登录了路由器 " >> ${logfile}
|
||||
unset title_prefix content_time content_ip content_attribution content_mode
|
||||
echo "$(date "+%Y-%m-%d") ${login_time} ${disturb_text}设备 ${login_ip} (${login_ip_attribution}) 通过 SSH ${login_mode} 登录了路由器 " >> ${logfile}
|
||||
done
|
||||
rm -f ${dir}ssh_login >/dev/null 2>&1
|
||||
unset login_ip login_time login_mode
|
||||
unset login_ip login_time login_mode log_only
|
||||
# Web 非法登录
|
||||
[ -f ${dir}web_failed ] && for login_ip in `cat ${dir}web_failed | sort -u`; do
|
||||
[ -f ${dir}web_failed ] && for login_ip in `cat ${dir}web_failed | awk '{print $1}' | sort -u`; do
|
||||
[ -z "$login_ip" ] && continue
|
||||
local login_time=$(cat ${dir}web_failed | grep -w ${login_ip} | awk '{print $2}' | tail -n 1)
|
||||
local login_mode=$(echo "$sys_log" | grep -E ".* $login_time.*$login_ip.*" | awk '{print $13}' | tail -n 1)
|
||||
[ "$login_mode" = "/" ] && login_mode="/ (首页登录)"
|
||||
local login_ip_attribution=$(get_ip_attribution ${login_ip})
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}IP 归属地： ${str_space}${str_space}${str_space}${str_space}${login_ip_attribution}" || unset content_attribution
|
||||
echo "`date "+%Y-%m-%d %H:%M:%S"` 【！！！】设备 ${login_ip} (${login_ip_attribution}) 通过 Web 频繁尝试登录" >> ${logfile}
|
||||
[ -n "$login_disturb" ] && [ "$login_disturb" -eq "1" ] && continue
|
||||
if [ -z "$title" ]; then
|
||||
title="${login_ip} 通过 Web 频繁尝试登录"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
elif ( echo "$title"|grep -q "频繁尝试登录" ); then
|
||||
title="${login_ip} ${title}"
|
||||
content="${content}${str_splitline}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}归属地：${str_space}${str_space}${login_ip_attribution}"
|
||||
echo "$(date "+%Y-%m-%d") ${login_time} 【！！！】设备 ${login_ip} (${login_ip_attribution}) 通过 Web 频繁尝试登录" >> ${logfile}
|
||||
[ -n "$login_disturb" ] && [ "$login_disturb" -eq 1 ] && continue
|
||||
local title_prefix="${login_ip} 频繁尝试登录"
|
||||
if [ -z "$login_title" ]; then
|
||||
login_title="${title_prefix}"
|
||||
elif ( echo "$login_title" | grep -q "频繁尝试登录" ); then
|
||||
login_title="${login_ip} ${login_title}"
|
||||
else
|
||||
title="设备状态变化"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
login_title="设备状态变化"
|
||||
fi
|
||||
content_title="${str_splitline}${str_title_start} 登录信息${str_title_end}"
|
||||
content_time="${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${login_time}"
|
||||
content_ip="${str_linefeed}${str_tab}设备 IP：${str_space}${str_space}${login_ip}"
|
||||
content_mode="${str_linefeed}${str_tab}登录方式：${str_space}Web ${login_mode}"
|
||||
login_content="${login_content}${content_title}${content_time}${content_ip}${content_attribution}${content_mode}"
|
||||
unset title_prefix content_time content_ip content_attribution content_mode
|
||||
done
|
||||
rm -f ${dir}web_failed >/dev/null 2>&1
|
||||
unset login_ip
|
||||
unset login_ip login_time login_mode
|
||||
# SSH 非法登录
|
||||
[ -f ${dir}ssh_failed ] && for login_ip in `cat ${dir}ssh_failed | sort -u`; do
|
||||
[ -f ${dir}ssh_failed ] && for login_ip in `cat ${dir}ssh_failed | awk '{print $1}' | sort -u`; do
|
||||
[ -z "$login_ip" ] && continue
|
||||
local login_time=$(cat ${dir}ssh_failed | grep -w ${login_ip} | awk '{print $2}' | tail -n 1)
|
||||
local login_ip_attribution=$(get_ip_attribution ${login_ip})
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}IP 归属地： ${str_space}${str_space}${str_space}${str_space}${login_ip_attribution}" || unset content_attribution
|
||||
echo "`date "+%Y-%m-%d %H:%M:%S"` 【！！！】设备 ${login_ip} (${login_ip_attribution}) 通过 SSH 频繁尝试登录" >> ${logfile}
|
||||
[ -n "$login_disturb" ] && [ "$login_disturb" -eq "1" ] && continue
|
||||
if [ -z "$title" ]; then
|
||||
title="${login_ip} 通过 SSH 频繁尝试登录"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
elif ( echo "$title"|grep -q "频繁尝试登录" ); then
|
||||
title="${login_ip} ${title}"
|
||||
content="${content}${str_splitline}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
[ -n "$login_ip_attribution" ] && content_attribution="${str_linefeed}${str_tab}归属地：${str_space}${str_space}${login_ip_attribution}"
|
||||
echo "$(date "+%Y-%m-%d") ${login_time} 【！！！】设备 ${login_ip} (${login_ip_attribution}) 通过 SSH 频繁尝试登录" >> ${logfile}
|
||||
[ -n "$login_disturb" ] && [ "$login_disturb" -eq 1 ] && continue
|
||||
local title_prefix="${login_ip} 频繁尝试登录"
|
||||
if [ -z "$login_title" ]; then
|
||||
login_title="${title_prefix}"
|
||||
elif ( echo "$login_title" | grep -q "频繁尝试登录" ); then
|
||||
login_title="${login_ip} ${login_title}"
|
||||
else
|
||||
title="设备状态变化"
|
||||
content="${content}${str_splitline}${str_title_start} 登录信息${str_title_end}${str_linefeed}${str_tab}设备 IP： ${str_space}${str_space}${str_space}${str_space}${login_ip}${content_attribution}"
|
||||
login_title="设备状态变化"
|
||||
fi
|
||||
content_title="${str_splitline}${str_title_start} 登录信息${str_title_end}"
|
||||
content_time="${str_linefeed}${str_tab}时间：${str_space}${str_space}${str_space}${str_space}${login_time}"
|
||||
content_ip="${str_linefeed}${str_tab}设备 IP：${str_space}${str_space}${login_ip}"
|
||||
content_mode="${str_linefeed}${str_tab}登录方式：${str_space}SSH"
|
||||
login_content="${login_content}${content_title}${content_time}${content_ip}${content_attribution}${content_mode}"
|
||||
unset title_prefix content_time content_ip content_attribution content_mode
|
||||
done
|
||||
rm -f ${dir}ssh_failed >/dev/null 2>&1
|
||||
unset login_ip
|
||||
unset login_ip login_time login_mode
|
||||
|
||||
disturb;disturb=$?
|
||||
[ -z "$login_title" ] && return
|
||||
[ ! -z "$device_name" ] && login_title="【$device_name】$login_title"
|
||||
( echo "$lite_enable"|grep -q "login_content" ) && login_content="$login_title"
|
||||
[ "$disturb" -eq 0 ] && [ -n "$login_title" ] && diy_send "${login_title}" "${login_content}" "${jsonpath}" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# 添加白名单，懒得写删除项和信息显示了，纯粹就是懒
|
||||
@ -1647,9 +1673,11 @@ for i in `seq 1 $thread_num`; do
|
||||
done
|
||||
unset i
|
||||
|
||||
# 处理登录事件，传递参数 $1：login_ip $2：日志时间(从日志中读取而不是使用当前时间，避免秒对应不上) $3：数组名
|
||||
process_login() {
|
||||
local login_ip=$1
|
||||
local -n login_counts=$2
|
||||
local login_time=$2
|
||||
local -n login_counts=$3
|
||||
|
||||
if [ -z "${login_counts["$login_ip"]}" ]; then
|
||||
login_counts["$login_ip"]=0
|
||||
@ -1658,26 +1686,28 @@ process_login() {
|
||||
local count=${login_counts["$login_ip"]}
|
||||
login_log=$(logread notice | grep -w -i "$login_ip" | tail -n 1)
|
||||
|
||||
if [[ $count -eq $login_max_num && ( "$2" == "web_failed_counts" || "$2" == "ssh_failed_counts" ) ]]; then
|
||||
if [[ $count -eq $login_max_num && ( "$3" == "web_failed_counts" || "$3" == "ssh_failed_counts" ) ]]; then
|
||||
add_ip_black ${login_ip}
|
||||
unset login_counts["$login_ip"]
|
||||
[ "$2" == "web_failed_counts" ] && echo "${login_ip}" >> ${dir}web_failed
|
||||
[ "$2" == "ssh_failed_counts" ] && echo "${login_ip}" >> ${dir}ssh_failed
|
||||
[ "$3" == "web_failed_counts" ] && echo "${login_ip} ${login_time}" >> ${dir}web_failed
|
||||
[ "$3" == "ssh_failed_counts" ] && echo "${login_ip} ${login_time}" >> ${dir}ssh_failed
|
||||
fi
|
||||
|
||||
if [[ "$2" == "web_login_counts" || "$2" == "ssh_login_counts" ]]; then
|
||||
if [[ "$3" == "web_login_counts" || "$3" == "ssh_login_counts" ]]; then
|
||||
add_ip_white ${login_ip}
|
||||
unset web_failed_counts["$login_ip"]
|
||||
unset ssh_failed_counts["$login_ip"]
|
||||
unset login_counts["$login_ip"]
|
||||
[ "$2" == "web_login_counts" ] && echo "${login_ip}" >> ${dir}web_login
|
||||
[ "$2" == "ssh_login_counts" ] && echo "${login_ip}" >> ${dir}ssh_login
|
||||
[ "$3" == "web_login_counts" ] && echo "${login_ip} ${login_time}" >> ${dir}web_login
|
||||
[ "$3" == "ssh_login_counts" ] && echo "${login_ip} ${login_time}" >> ${dir}ssh_login
|
||||
[ "${#login_counts[@]}" -gt "100" ] && login_counts=("${login_counts[@]: -100}")
|
||||
fi
|
||||
> ${dir}send_enable.lock && login_send && deltemp
|
||||
}
|
||||
|
||||
# 监听登录事件
|
||||
if [ -n "$web_logged" ] || [ -n "$ssh_logged" ] || [ -n "$web_login_failed" ] || [ -n "$ssh_login_failed" ]; then
|
||||
# 声明关联数组
|
||||
declare -A web_login_counts
|
||||
declare -A ssh_login_counts
|
||||
declare -A web_failed_counts
|
||||
@ -1685,26 +1715,27 @@ if [ -n "$web_logged" ] || [ -n "$ssh_logged" ] || [ -n "$web_login_failed" ] ||
|
||||
[ -f ${dir}child_pid ] && child_pid=$(cat ${dir}child_pid)
|
||||
[ -n "$child_pid" ] && kill $child_pid >/dev/null 2>&1
|
||||
(
|
||||
# 监听系统日志，并分类处理
|
||||
logread -f -p notice | while IFS= read -r line; do
|
||||
[ -n "$web_logged" ] && {
|
||||
web_login_ip=$(echo "$line" | grep -i "accepted login" | awk '{print $NF}')
|
||||
[ -n "$web_login_ip" ] && process_login "$web_login_ip" web_login_counts
|
||||
[ -n "$web_login_ip" ] && process_login "$web_login_ip" $(echo "$line" | awk '{print $4}') web_login_counts
|
||||
}
|
||||
|
||||
[ -n "$ssh_logged" ] && {
|
||||
ssh_login_ip=$(echo "$line" | grep -i "Password auth succeeded\|Pubkey auth succeeded" | awk '{print $NF}' | sed -nr 's#^(.*):.[0-9]{1,5}#\1#gp' | sed -e 's/%.*//')
|
||||
[ -n "$ssh_login_ip" ] && process_login "$ssh_login_ip" ssh_login_counts
|
||||
[ -n "$ssh_login_ip" ] && process_login "$ssh_login_ip" $(echo "$line" | awk '{print $4}') ssh_login_counts
|
||||
}
|
||||
|
||||
[ -n "$web_login_failed" ] && {
|
||||
web_failed_ip=$(echo "$line" | grep -i "failed login"|awk '{print $NF}')
|
||||
[ -n "$web_failed_ip" ] && process_login "$web_failed_ip" web_failed_counts
|
||||
[ -n "$web_failed_ip" ] && process_login "$web_failed_ip" $(echo "$line" | awk '{print $4}') web_failed_counts
|
||||
}
|
||||
|
||||
[ -n "$ssh_login_failed" ] && {
|
||||
ssh_failed_ip=$(echo "$line" | grep -i "Bad password attempt\|Login attempt for nonexistent user from" | awk '{print $NF}' | sed -nr 's#^(.*):.[0-9]{1,5}#\1#gp' | sed -e 's/%.*//')
|
||||
[ -z "$ssh_failed_ip" ] && ssh_failed_num=$(echo "$line" | sed -n 's/.*authpriv\.warn dropbear\[\([0-9]\+\)\]: Login attempt for nonexistent user/\1/p') && [ -n "$ssh_failed_num" ] && ssh_failed_ip=$(logread notice | grep "authpriv\.info dropbear\[${failed_user_id}\].*Child connection from" | awk '{print $NF}' | sed -nr 's#^(.*):.[0-9]{1,5}#\1#gp' | sed -e 's/%.*//')
|
||||
[ -n "$ssh_failed_ip" ] && process_login "$ssh_failed_ip" ssh_failed_counts
|
||||
[ -n "$ssh_failed_ip" ] && process_login "$ssh_failed_ip" $(echo "$line" | awk '{print $4}') ssh_failed_counts
|
||||
}
|
||||
done
|
||||
) &
|
||||
@ -1770,13 +1801,13 @@ while [ "$enable" -eq "1" ]; do
|
||||
[ ! -f "${dir}send_enable.lock" ] && get_client_usage
|
||||
|
||||
# 登录提醒通知
|
||||
[ ! -f "${dir}send_enable.lock" ] && login_send
|
||||
#[ ! -f "${dir}send_enable.lock" ] && login_send
|
||||
|
||||
# 推送
|
||||
if [ ! -f "${dir}send_enable.lock" ] && [ ! -z "$title" ] && [ ! -z "$content" ]; then
|
||||
[ ! -z "$device_name" ] && title="【$device_name】$title"
|
||||
( echo "$lite_enable"|grep -q "content" ) && content="$title"
|
||||
[ "$disturb" -eq "0" ] && diy_send "${title}" "${content}" "${jsonpath}" >/dev/null 2>&1
|
||||
[ "$disturb" -eq 0 ] && diy_send "${title}" "${content}" "${jsonpath}" >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
# 等待定时任务推送完成
|
||||
|
||||
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
LUCI_TITLE:=Design Theme
|
||||
LUCI_DEPENDS:=
|
||||
PKG_VERSION:=5.7.7-20230502
|
||||
PKG_VERSION:=5.7.8-20231102
|
||||
|
||||
include $(TOPDIR)/feeds/luci/luci.mk
|
||||
|
||||
|
||||
@ -2989,8 +2989,8 @@ body.lang_pl.node-main-login .cbi-value-title {
|
||||
padding: 0;
|
||||
display: inline-block;
|
||||
position: absolute;
|
||||
width: 300px;
|
||||
height: 50px;
|
||||
width: 18.75rem;
|
||||
height: 2.8125rem;
|
||||
padding: 1.15rem 2rem;
|
||||
}
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -12,13 +12,13 @@ PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
GEOIP_VER:=202310260037
|
||||
GEOIP_VER:=202311020038
|
||||
GEOIP_FILE:=geoip.dat.$(GEOIP_VER)
|
||||
define Download/geoip
|
||||
URL:=https://github.com/v2fly/geoip/releases/download/$(GEOIP_VER)/
|
||||
URL_FILE:=geoip.dat
|
||||
FILE:=$(GEOIP_FILE)
|
||||
HASH:=f24e09d29ffadb75d5eb41483b4eddfe139b9b448886dd2bcdeb2df2c0dcca24
|
||||
HASH:=53393a6b9886cf9f0a3b7fb1efda1472af64f4885d4bda9fa6276610f9890c8a
|
||||
endef
|
||||
|
||||
GEOSITE_VER:=20231031055637
|
||||
|
||||
Loading…
Reference in New Issue
Block a user