| |
|---|
| | |
|---|
| | |
|---|
| | ########## |
|---|
| | |
|---|
| | VERSION = "$Id: abck,v 1.95 2001/07/27 01:45:24 tundra Exp $" |
|---|
| | VERSION = "$Id: abck,v 1.96 2001/07/27 02:09:15 tundra Exp $" |
|---|
| | |
|---|
| | |
|---|
| | |
|---|
| | #################### |
|---|
| |
|---|
| | |
|---|
| | DONE = FALSE |
|---|
| | |
|---|
| | #################### |
|---|
| | # Constants |
|---|
| | # General Constants |
|---|
| | #################### |
|---|
| | |
|---|
| | ANS = ";; ANSWER SECTION:" |
|---|
| | AUTH = ";; AUTHORITY SECTION:" |
|---|
| | DLEN = 24*60*60 |
|---|
| | DIG = "dig -t ptr -x " |
|---|
| | HIST = ".abck_history" |
|---|
| | HISTFILE = os.path.join(os.getenv("HOME"), HIST) |
|---|
| | LOG = "/var/log/messages" |
|---|
| | MOS = ["", "Jan", "Feb", "Mar", "Apr", "May", "Jun", |
|---|
| | "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"] |
|---|
| | WHO = "whois " |
|---|
| | |
|---|
| | #################### |
|---|
| | # Constants Used In Outgoing eMail |
|---|
| | #################### |
|---|
| | |
|---|
| | HOSTNAME = socket.gethostname() |
|---|
| | HOSTADDR = socket.gethostbyname(HOSTNAME) |
|---|
| | HOSTTZ = time.tzname |
|---|
| | LOG = "/var/log/messages" |
|---|
| | MOS = ["", "Jan", "Feb", "Mar", "Apr", "May", "Jun", |
|---|
| | "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"] |
|---|
| | NOTIFYWHO = ("abuse", "root") |
|---|
| | ORG = os.getenv("ORGANIZATION") |
|---|
| | PROMPT = "\nLog Record:\n%s\n\nWho Gets Message For: <%s>? %s[%s] " |
|---|
| | WHO = "whois " |
|---|
| | |
|---|
| | #################### |
|---|
| | # Prompt And Message Strings |
|---|
| | #################### |
|---|
| | |
|---|
| | SUBJ = "\"Attempted Intrusion Attempt\"" |
|---|
| | |
|---|
| | MAILCMD = "mail -s %s" % (SUBJ) |
|---|
| | |
|---|
| | MAILMSG = "An *unauthorized* attempt to access one of our computers\n" + \ |
|---|
| | "has been detected originating from your address space/domain.\n\n" + \ |
|---|
| | "Our machine, %s, has IP address,\n%s, and is located in the " + \ |
|---|
| | "%s Time Zone.\n\n" + \ |
|---|
| | "Our log entry documenting the attempted intrusion\n" + \ |
|---|
| | "from your address space/domain, follows:\n\n\"%s\"\n\n" + \ |
|---|
| | "from your address space/domain, follows:\n\n%s\n\n" + \ |
|---|
| | "Please take the necessary steps to remedy this situation.\n" + \ |
|---|
| | "Thank-You\n" + ORG + "\n" |
|---|
| | |
|---|
| | |
|---|
| | #################### |
|---|
| | # Prompt And Message Strings |
|---|
| | #################### |
|---|
| | |
|---|
| | |
|---|
| | PROMPT = "\nLog Record:\n%s\n\nWho Gets Message For: <%s>? %s[%s] " |
|---|
| | |
|---|
| | USAGE = "abck " + VERSION.split()[2] + " " + \ |
|---|
| | "Copyright (c) 2001, TundraWare Inc. All Rights Reserved.\n" + \ |
|---|
| | " usage:\n" + \ |
|---|
| |
|---|
| | # Notify the responsible authority about the attempted intrusion |
|---|
| | |
|---|
| | def Notify(logrecord, domain): |
|---|
| | dest=[] |
|---|
| | logrecord = "\"" + logrecord + "\"" |
|---|
| | msg = (MAILMSG % (HOSTNAME, HOSTADDR, "/".join(HOSTTZ), logrecord)) |
|---|
| | for x in NOTIFYWHO: |
|---|
| | dest.append(x + "@" + domain) |
|---|
| | dest.append("root@" + HOSTNAME) |
|---|
| | |
|---|
| | print msg |
|---|
| | print dest |
|---|
| | |
|---|
| | |
|---|
| | |
|---|
| | os.popen(MAILCMD + " " + " ".join(dest), "w").write(msg) |
|---|
| | |
|---|
| | |
|---|
| | #################### |
|---|
| | |
|---|
| |
|---|
| | |
tundra
authored
on 26 Jul 2001