I wanted to improve this script that I had originally written in bash and I took the opportunity to learn python (three days).
Please, comment! I need criticism… more precisely about the thread management, I understand that’s bad programming.
In fact the portscan takes about 4 minutes with 50 hosts… but work!
Usage of the script:
usage:
python authfail.py FILE [FILE]
Parse an auth.log FILE and return the ascending stats list with
geolocalization about ip addresses that cause a sshd's auth failure.
If you specify the [FILE] it checks if IP addresses which attacks
came from and have sshd's port 22 open and save the results on it.
The auth.log file path is:
/var/log/auth.log
however may change…
This software is under GPLv3 license.
Here the source code:
"""
Copyright (C) 2011 Simone Aonzo
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
import threading, Queue
import urllib2
import socket
import socket
import sys
import re
# Keyword in auth.log for invalid login
authFail = "Failed password for invalid user"
# Regex of ip address (tnx evilsocket for compile suggest!)
ipRegEx = re.compile(r"\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b")
# Website that provide api
apiHostIp = "http://api.hostip.info/get_html.php?ip="
# Dictionary and List initializer
dictBase = {}
listAtt = []
# sshd port
SSHPORT = 22
#scan flag
SCAN = False
# Usage
help = """
AuthFail 1.0 - by Six110
http://sixthevicious.wordpress.com/
========================================
usage:
python authfail.py FILE [FILE]
Parse an auth.log FILE and return the ascending stats list with
geolocalization about ip addresses that cause a sshd's auth failure.
If you specify the [FILE] it checks if IP addresses which attacks
came from and have sshd's port 22 open and save the results on it.
This software is released under GPLv3 license.
"""
# Check if input string match the regexp
def ipFormatChk (ipStr):
if ipRegEx.match(ipStr):
return True
else:
return False
# Convert a list of tuple into the ip address string
def fromRegexToString (line):
return (" ".join( ipRegEx.findall(line)[0] )).replace(" ",".")
# Class with data of the attacker
class Attacker(object):
def __init__(self, ip, hits, country, city, isopenssh=None):
self.ip = ip
self.hits = hits
self.country = country
self.city = city
self.isopenssh = isopenssh
# Class that implement portscanning with threading
class Scanner(threading.Thread):
def __init__(self, inq, outq):
threading.Thread.__init__(self)
self.setDaemon(1)
# queues for Attackers
self.inq = inq
self.outq = outq
def run(self):
while True:
# Retrive attacker from queue
a = self.inq.get()
host, port = a.ip, SSHPORT
sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sd.connect((host, port))
except socket.error:
a.isopenssh = "False"
self.outq.put(a)
else:
a.isopenssh = "True"
self.outq.put(a)
sd.close()
#======================================================================#
alen = len(sys.argv)
if (alen < 2) or (alen > 3):
print help
quit()
if (alen == 3):
try:
fileOUT = open (sys.argv[2], 'w')
SCAN = True
except:
fileOUT = None
print "Error! I can't write this file -> " + sys.argv[2]
else:
fileOUT = None
try:
fileIN = open(sys.argv[1], "r")
except:
fileIN = None
print "Error! I can't read this file -> " + sys.argv[1]
sys.exit(1)
line = fileIN.readline()
# Read each line of the file
# if found an ip it search the dictionary for the entry
# if it's present, increment the counter
# otherwise add the ip and initialize the counter
while line:
if (line.find(authFail) != -1):
ipFound = fromRegexToString (line)
if ( ipFound in dictBase):
dictBase[ipFound] = dictBase.get(ipFound)+1
else :
dictBase[ipFound] = 1
line = fileIN.readline()
# Close the input files
fileIN.close()
items = 0
# Create the classes and add them to the list counting the entries
for ip, hits in dictBase.iteritems():
resp = urllib2.urlopen( apiHostIp+ip ).read()
country = resp [ resp.find('Country: ')+9 : resp.find('\n') ]
city = resp [ resp.find('City: ')+6 : resp.find('\n',resp.find('City: ')) ]
listAtt.append( Attacker(ip, hits, country, city) )
items += 1
# Free the dictionary
dictBase.clear()
# Start ssh scanner
if (SCAN):
toscan = Queue.Queue()
scanned = Queue.Queue()
scanners = [Scanner(toscan, scanned) for i in range(items)]
for scanner in scanners:
scanner.start()
for a in listAtt:
toscan.put(a)
listAtt.count
for c in range(0,items):
try:
scanned.get(16)
except Queue.Empty:
c = items
# Redefines the sort function with the total order relation
# for confront two Attacker classes
listAtt.sort (lambda x, y: cmp(y.hits, x.hits) )
for a in listAtt:
if ( fileOUT != None and SCAN == True and a.isopenssh == "True"):
fileOUT.write(a.ip+"\n")
print "\nIp: "+ a.ip + "\nHits: %d"% a.hits + "\nPort %s open: "%SSHPORT + str(a.isopenssh) + "\nCountry: %s"%a.country + "\nCity: %s\n"%a.city
# Close the output file
if (fileOUT != None):
fileOUT.close()
