Munin contributed plugins

#!/usr/bin/env ruby

=begin

Plugin to monitor the number of invalid access to sshd per country

Require read permissions for SYSLOG

   ref) ls -l /var/log/secure

Require geoip rubygem

   ref) http://geoip.rubyforge.org/

Require GeoIP-database for searching ip or host for the country

   ref) http://www.maxmind.com/app/geoip_country

Parameters:

      config   (required)

      autoconf (optional - used by munin-config)

$Log$

Revision 1.0  2010/12/25 11:56:12 hirata yoshiyuki

    released.

Magick markers (optional):

#%# family=auto

#%# capabilities=autoconf

config example for /etc/munin/plugin-conf.d/munin-node

[sshd_invalid_countries_ruby]

user root

group root

env.logfile /var/log/secure

env.geoip /home/you/GeoIP.dat

env.loadpath /usr/local/lib/ruby/gems/1.9.1/gems/geoip-0.8.8/lib/

=end

require (ENV['loadpath'] || '') + 'geoip'

SYSLOG   = ENV['syslog'] || '/var/log/secure'

GEOIP_DB = ENV['geoip']  || '/var/www/conf/bbs/GeoIP.dat'

AWK_CMD  = 'awk \'/sshd\[.*Did not receive identification string/{print $12} ' +

           '/sshd\[.*Failed password for (root|ROOT)/{print $11} ' +

           '/sshd\[.*Invalid user/{print $10}a\' < ' + SYSLOG

def getInvalids

  c = {}

  wholeips = `#{AWK_CMD}`.split("\n")

  uniqueips = wholeips.inject({}) do |hash, key|

    hash.include?(key) ? hash[key] += 1 : hash[key] = 1;

    hash

  end

  geoip = GeoIP.new(GEOIP_DB)

  uniqueips.each do |ip, cnt|

    begin

      country = geoip.country(ip)[5]

      c[country] = c[country] ? c[country] + cnt : cnt

    rescue

      c['Unknown'] = c['Unknown'] ? c['Unknown'] + cnt : cnt

    end

  end

  c = c.to_a.sort { |a, b| a[0] <=> b[0] }

  c

end

case ARGV[0]

when 'autoconf'

  begin

    fh = open(SYSLOG, 'r')

  rescue

    puts 'no'

    exit 0

  else

    puts 'yes'

    exit 0

  end

when 'config'

  puts 'graph_title SSHD invalid countries from ' + SYSLOG

  puts 'graph_args --base 1000 -l 0'

  puts 'graph_vlabel number of invalid access per country'

  puts 'graph_category security'

  puts 'graph_info This graph shows the countries of invalid access to sshd.'

  getInvalids.each { |k, v| puts k + '.label ' + k }

  exit 0

else

  getInvalids.each { |k, v| puts k + '.value ' + v.to_s }

end