forked from yurisshOS/debian7os
-
Notifications
You must be signed in to change notification settings - Fork 1
/
dropmon.sh
53 lines (50 loc) · 1.45 KB
/
dropmon.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/usr/bin
if [ $1 ];then
port_dropbear=$1
log=/var/log/auth.log
loginsukses='Password auth succeeded'
echo ' '
echo ' '
echo " Dropbear Users Login Monitor "
echo "---------------------------------------------------------------"
echo " Date-time | PID | User Name | From Host "
echo "---------------------------------------------------------------"
pids=`ps ax |grep dropbear |grep " $port_dropbear" |awk -F" " '{print $1}'`
for pid in $pids
do
pidlogs=`grep $pid $log |grep "$loginsukses" |awk -F" " '{print $3}'`
i=0
for pidend in $pidlogs
do
let i=i+1
done
if [ $pidend ];then
login=`grep $pid $log |grep "$pidend" |grep "$loginsukses"`
PID=$pid
user=`echo $login |awk -F" " '{print $10}' | sed -r "s/'/ /g"`
waktu=`echo $login |awk -F" " '{print $2,$3}'`
while [ ${#waktu} -lt 13 ]
do
waktu=$waktu" "
done
while [ ${#user} -lt 16 ]
do
user=$user" "
done
while [ ${#PID} -lt 8 ]
do
PID=$PID" "
done
fromip=`echo $login |awk -F" " '{print $12}' |awk -F":" '{print $1}'`
echo " $waktu| $PID | $user| $fromip "
fi
done
echo "---------------------------------------------------------------"
echo " Script Modified by YurisshOS "
else
echo " Gunakan perintah ./dropmon.sh [port]"
echo " contoh : ./dropmon.sh 443"
echo \n
echo \n
fi
exit 0