#!/usr/bin/perl
print "Content-type: text/html \n\n";

use IO::File;
use Fcntl;
use Socket;
use Time::localtime;
use Time::Local;
use strict;

print "SECUR\n";

my ($con,$res,$start,$stop,$time,$date,$day,$month,$year,$key,$ipa_count,$T0,$ip,$pip);
my ($line,$p,$i,$minutes,$hours,$seconds,$date_time,$record,$j,$r,$mark,$m,$fl);
my (@ary,@len,@nam,@LL,@LLL,@records,$form_data,$tm,$pin1);	# array, returned with request
my @mon=("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec");
my @patern=("refused connect from","warning: /etc/hosts.allow");
my %ipa=();			# IP-hash-array
my $i=0;
my $k=0;
my $n_req=0;
my $flag=0;			# Is the data in memory? (not the first request)

#########################################
# Yu. Semenov				#
# Script reads file:			#
# <secure>, extracts the records    	#
# with pattern, showing refused access 	#
# output in <ip_log.txt>		#
#########################################

$p="/var/log/secure";		# input file  <secure>
open(h_point,$p) or die "Can't start tst1: $!\n";
$pin1="/home/httpd/htdocs/saturn/attacks/ids/secure_log1.txt";	# Filtered Log-file
sysopen(Fpi, $pin1, O_RDWR|O_TRUNC|O_CREAT) or die$!;	# Open/create file <secure>
$pip="/home/httpd/htdocs/saturn/attacks/ids/ip_log.txt";# Filtered Log-file
sysopen(Fip, $pip, O_RDWR|O_TRUNC|O_CREAT) or die$!;	# Open/create file <ip_log.txt>
$start=time;
$stop=$start-86400;				# one day before
$tm=localtime;
$year=($tm->year);
$month=($tm->mon);
$day=$tm->mday;
print "Year=",$year," day=",$day," mon=",$month," time=",$start," stop=",$stop,"\n";

#####################################
while (!eof(h_point)) 	{			# Cycle for <secure>-file
$line=readline(h_point);			# read line of <secure>
@LL=split/\s+/,$line;
$month=$LL[0];
for($i=0;$i<12;$i++){if($month eq $mon[$i]){$month=$i;}}#
$day=$LL[1];
$time=$LL[2];
@LLL=split/\:/,$time;
$hours=$LLL[0];
$minutes=$LLL[1];
$seconds=$LLL[2];
$T0=timelocal($seconds,$minutes,$hours,$day,$month,$year);	#
#if($T0>1272611137){print "STOP=",$stop," T0=",$T0,"\n";}
if($T0>$stop)	{
#print "STOP=",$stop," T0=",$T0,"\n";
$fl=0;								# init includings flag
for($r=0;$r<$#patern+1;$r++)	{	#################
if($r==0 && index($line,$patern[$r])>=0)	{	#
	$ip=$LL[9];					#
	$ip=substr($ip,1);				# remove starting "("
	$ip=substr($ip,0,-1);				# remove the last ")"
if(exists($ipa{$ip}))	{		# IP-hash updating		#####
$ipa{$ip}=$ipa{$ip}+1;								#
#print "ipa=",$ip," n=",$ipa{$ip}," type=",$att_type," brwsr=",$browser,"\n";
			}						#####
else{$ipa{$ip}=1;}
#print "IP=",$ip,"\n";
						}	#
if($fl==0)	{		#####################		#
if(index($line,$patern[$r])>=0){$fl=1;}	#			#
#print "Flag=",$fl," idx=",index($line,"spider18.yandex")," incl=",$incl[$i],"\n";
			}		#####################	#
#print "fl=",$fl," I=",$r," LL=",$line,"\n";			#
		}			#####################
if($fl!=0)	{			# There is a refusal of access	#####
#print "indx=",index($line,$incl[$i]),"\nline=",$line,"\n";		    #
#print "F=",$fl," LLL=",$line,"\n";					    #
$records[$n_req]=$line;	# put down the record				    #
print Fpi $line;							    #
$n_req++;								    #
		}							#####

#print "time=",$T0," Start=",$start," Stop=",$stop,"\n";
					}				#end of IF
						}			# end of WHILE

#print "date_time=",$date_time," time=",$TIME," tim_star=",$time_start," NNN=",$i,"\n";
close(h_point);
close(Fpi);
$ipa_count=0;
foreach $key (reverse sort {$ipa{$a}<=>$ipa{$b}} keys %ipa)
{print Fip "$key $ipa{$key}\n";	# Writing into file <ip_log.txt>
$ipa_count++;
	print " ipa= $key $ipa{$key}\n";
    }
close(Fip);

do "/home/crontab_files/big_data_control.pl";	# monitor time access to DB

#print "</head></html>";
#exit(0);

