diff --git a/logreader/logreader.py b/logreader/logreader.py index 1e52ace2..12a24d85 100644 --- a/logreader/logreader.py +++ b/logreader/logreader.py @@ -24,9 +24,15 @@ __date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -import os, sys +import os, sys, time + +from sshd import Sshd class LogReader: + """ Reads a log file and reports information about IP that make password + failure, bad user or anything else that is considered as doubtful login + attempt. + """ def __init__(self, logPath, logSys, findTime = 3600): self.logPath = logPath @@ -34,15 +40,22 @@ class LogReader: self.ignoreIpList = [] self.lastModTime = 0 self.logSys = logSys + self.parserList = ["Sshd"] def addIgnoreIP(self, ip): + """ Adds an IP to the ignore list. + """ self.logSys.debug("Add "+ip+" to ignore list") self.ignoreIpList.append(ip) def inIgnoreIPList(self, ip): + """ Checks if IP is in the ignore list. + """ return ip in self.ignoreIpList def openLogFile(self): + """ Opens the log file specified on init. + """ try: fileHandler = open(self.logPath) except OSError: @@ -51,6 +64,8 @@ class LogReader: return fileHandler def isModified(self): + """ Checks if the log file has been modified using os.stat(). + """ try: logStats = os.stat(self.logPath) except OSError: @@ -64,6 +79,45 @@ class LogReader: self.lastModTime = logStats.st_mtime return True + def matchLine(self, line): + """ Checks if the line contains a pattern. It does this for all + classes specified in *parserList*. We use a singleton to avoid + creating/destroying objects too much. + + Return a dict with the IP and number of retries. + """ + for i in self.parserList: + match = eval(i).getInstance().parseLogLine(line) + if match: + return match + return None + + def getFailInfo(self, findTime): + """ Gets the failed login attempt. Returns a dict() which contains + IP and the number of retries. + """ + ipList = dict() + logFile = self.openLogFile() + for line in logFile.readlines(): + match = self.matchLine(line) + if match: + ip = match[0] + unixTime = match[1] + if unixTime < time.time()-self.findTime: + continue + if self.inIgnoreIPList(ip): + self.logSys.debug("Ignore "+ip) + continue + self.logSys.debug("Found "+ip) + if ipList.has_key(ip): + ipList[ip] = (ipList[ip][0]+1, unixTime) + else: + ipList[ip] = (1, unixTime) + logFile.close() + return ipList + def getPwdFailure(self): + """ Executes the getFailInfo method. Not very usefull... + """ failList = self.getFailInfo(self.findTime) return failList