cPanel Community,
I am writing a munin plugin to look at CSF entries. One of things I am trying to do is to read the csf.allow and csf.deny entries and determine the number IP/CIDR entries are loaded. My regex is not working correctly. The regex into the CIDR variable is not pulling in the number. I also have another problem is that this feature is only supported in what I think is perl 5.12 and beyond, so while I can test it out on my local machine with 5.18, it will not work on my cPanel server which is 5.8.8.
Suggestions?
Thanks,
Frank
- - - Updated - - -
Just to provide more about my project, this is what I plan to have this plugin do:
I am writing a munin plugin to look at CSF entries. One of things I am trying to do is to read the csf.allow and csf.deny entries and determine the number IP/CIDR entries are loaded. My regex is not working correctly. The regex into the CIDR variable is not pulling in the number. I also have another problem is that this feature is only supported in what I think is perl 5.12 and beyond, so while I can test it out on my local machine with 5.18, it will not work on my cPanel server which is 5.8.8.
Suggestions?
Thanks,
Frank
Code:
#open ALLOW, "/etc/csf/csf.allow";
open ALLOW, "csf.allow.txt";
my $allow_value = 0;
while (my $line=<ALLOW>)
{
next if $line =~ m/^\s*(?:#.*)?$/;
$line =~ m#^\s*(?<ipaddress>(?:(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])(\/|\s)))(?<CIDR>(3[0-2]|[1-2][0-9]|[0-9]))?#;
my ($ipaddress,$cidr) = ($+{ipaddress},$+{cidr});
print $ipaddress,$cidr;;
if (defined $cidr)
{
$allow_value += 2**(32 - $cidr);
}
else
{
$allow_value += 1;
}
}
close(ALLOW);
#
# csf.allow example, but ignore the first # as that does not exist
# 204.11.102.34 # Manually allowed - Fri Mar 4 05:41:19 2011
# 99.63.50.19/24 # Manually allowed - Thu Mar 10 00:07:47 2011
#Just to provide more about my project, this is what I plan to have this plugin do:
Code:
# Configuration 1: CSF_status
# - Shows # of IP entries in the following log files
# - /etc/csf/csf.allow
# - use CIDR format to turn all entires into actual number of IPs allowed. IP address is first in the line
# - file has # for comments at the beginning of the line
# - /etc/csf/csf.deny
# - use CIDR format to turn all entires into actual number of IPs denied. IP address is first in the line
# - file has # for comments at the beginning of the line
# - Output
# - Title "CSF Status: Loaded IP Addresses For IPTABLES"
# - CSF_Allow.label "# of IP Addresses Allowed"
# - CSF_Allow.value xx (where xx is equal to the number of IP addresses allowed)
# - CSF_Deny.label "# of IP Addresses Denied"
# - CSF_Deny.value yy (where yy is equal to the number of IP addresses denied)
# Configuration 2: CSF_denyCountry
# - Shows # of IP entries for each Country
# - /etc/csf/csf.deny
# - use CIDR format to turn all entires into actual number of IPs denied. IP address is first in the line
# - file has # for comments at the beginning of the line
# - Country is encapsulated in "...(AA/Abcdefg/FQDN)..." where AA is the country code and Abcdefg is the Long Country Name
# - Output
# - Title "CSF Status: Denied IP Addresses by Country of Origin"
# - CSF_Deny_AA.label Abcdefg (where AA is the country code and Abcdefg is the long country name)
# - CSF_Deny_AA.value xx (where AA is the country code and xx is the number of IP CIDR entries for that country)
# Configuration 3: CSF_denyType
# - Shows reason for denial
# - /etc/csf/csf.deny
# - use CIDR format to turn all entires into actual number of IPs denied. IP address is first in the line
# - file has # for comments at the beginning of the line
# - Detected failure has four examples:
# - "...# lfd: (type)..." where type equals the service that was attacked and detected
# - "...# lfd: *type*..." where type equals a non service detection
# - "...# lfd: aa.bb.cc.dd (AA/Abcdefg/FQDN), xx distributed_type..." where distrubted type equals the service and type of attack
# - "...# type..." where type is actual a manual entry because lfd: is not listed.
# - Output
# - Title "CSF Status: Denied IP Addresses by Detected Attack"
# - CSF_Deny_type.label type (where type is qual to the value of type where type is equal the above examples of type, distributed_type, or manual)
# - CSF_Deny_type.value xx (where type is qual to the value of type where type is equal the above examples of type, distributed_type, or manual. xx is the number of CIDR entires)
