fail.sh - Scan auth logs and if at least THRESHOLD failed IPv4 addresses have the same first 3 octets list them

fail.sh

#!/usr/bin/env bash

syntax='Usage: fail.sh [OPTION]... [LOG]...'

# If at least $threshold failed IPv4 addresses have the same first 3 octets list them
scan() {
	if ! echo "$log" | grep -q /; then
		log=/var/log/$log
	fi
	# Ordered unique IPv4 addresses found in auth.log
	# auth.log says identification, preauth, or Failed if login fails
	ips=$(less "$log" | grep -E "identification|preauth|Failed" | grep -Eo "([0-9]{1,3}\\.){3}[0-9]{1,3}" | sort -u)
	echo "$log"

	for ip in $ips; do
		# First 3 octets of $ip
		oct=$(echo "$ip" | cut -d . -f 1-3)
		if [ -z "$old_oct" ] || [ "$oct" = "$old_oct" ]; then
			sketchy+=("$ip")
		else
			if [ "${#sketchy[@]}" -ge "$threshold" ]; then
				printf "%15s" "${#sketchy[@]} total"
				col=15
				for x in "${sketchy[@]}"; do
					if [ "$col" -gt "$((cols - 17))" ]; then
						printf "\n%15s" ''
						col=15
					fi
					printf "  %-15s" "$x"
					col=$((col + 17))
				done
				printf "\n"
			fi
			unset sketchy
			sketchy+=("$ip")
		fi
		old_oct=$oct
	done
}

heredoc() {
	cat <<- end
	$(scan)
end
}

# Wrapper for less
lesser() {
	echo 'Press Ctrl-C then q to exit'
	echo "Scroll with arrow keys (If PgDown doesn't work try Shift-PgDown)"
	echo
	if [ "$(echo "$logs" | wc -w)" -gt 1 ]; then
		echo Scanning auth logs...
		for log in $logs; do
			heredoc &
		done
		wait
	else
		log=$logs
		scan
	fi
}

args=$(getopt -l help,threshold: -o ht: -- "$@")
eval set -- "$args"
while [ "$1"  != -- ]; do
	case $1 in
	--help|-h)
		echo "$syntax"
		echo Scan auth logs and if at least THRESHOLD failed IPv4 addresses have the same first 3 octets list them.
		echo
		echo Mandatory arguments to long options are mandatory for short options too.
		echo '-t, --threshold=THRESHOLD  minimum failed IPv4 addresses with the same first 3 octets. defaults to 2'
		echo
		echo "If LOG doesn't include / it will start with /var/log/."
		exit
		;;
	--threshold|-t)
		threshold=$2
		if [[ ! "$threshold" =~ ^-?[0-9]+$ ]]; then
			>&2 echo THRESHOLD must be an integer
		fi
		if [ "$threshold" -lt 2 ]; then
			>&2 echo THRESHOLD must be at least 2
		fi
		shift 2
		;;
	esac
done
shift

if [ "$#" -gt 0 ]; then
	logs=$*
else
	logs=$(ls /var/log/auth.log*)
fi

if [ -z "$threshold" ]; then
	threshold=2
fi

cols=$(stty size | cut -d ' ' -f 2 -s)
if ! [[ "$cols" =~ ^-?[0-9]+$ ]] || [ "$cols" -lt 32 ]; then
	cols=32
fi

lesser | less

fail.sh LICENSE

MIT License

Copyright (c) 2018 

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.