psad4conky

psad4conky.txt

#! /bin/bash

### Leif Gregory leif@devtek.org
### GPG: 0x5E5D2700
### 20180809

### This script is meant to be called from /etc/psad/psad.conf as:
### ENABLE_EXT_SCRIPT_EXEC      Y;
### EXTERNAL_SCRIPT             <path/to/this_script>;
### EXEC_EXT_SCRIPT_PER_ALERT   Y;

attackers=$(psad -S | grep -A 5 'Top 25 attackers') #Grab this line plus five more
rm /home/bishop/logs/psad4conky #Get rid of the old log

while read -r line
do
  if [ ! -z "$line" ]; then #If it's not a blank line continue
    if grep -q 'attackers' <<<"$line"; then
      true
    else
    printf '%s\n' "$line" >> /home/bishop/logs/psad4conky #Append attacker IPs
    fi
else #There's less than five lines so stop iterating (found a blank line)
    break
  fi
done <<< "$attackers"

#chown to normal user vs. root that psad is running as
chown bishop:bishop /home/bishop/logs/psad4conky