1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
#!/usr/bin/perl -w
##########################################################################
# $Id: mountd,v 1.13 2003/12/15 18:09:23 kirk Exp $
##########################################################################
########################################################
# This was written and is maintained by:
# Kirk Bauer <kirk@kaybee.org>
#
# Please send all comments, suggestions, bug reports,
# etc, to kirk@kaybee.org.
########################################################
use Logwatch ':ip';
$Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
while (defined($ThisLine = <STDIN>)) {
if ( ($ThisLine =~ /^Unauthorized access by NFS client .*$/ ) or
($ThisLine =~ /^NFS client [^ ]+ tried to access .*$/ ) ) {
# don't care about this, as the next line reports the IP again
}
elsif ( ($IP,$Mount) = ($ThisLine =~ /^Blocked attempt of (\d+\.\d+\.\d+\.\d+) to mount (.*)$/) ) {
$Name = LookupIP ($IP);
$Mount = " " . $Mount;
$Rejected{$Name}{$Mount}++;
}
elsif ( ($Name,$Mount) = ($ThisLine =~ /^refused mount request from (.+) for ([^ ]+)/) ) {
$Mount = " " . $Mount;
$Rejected{$Name}{$Mount}++;
}
elsif ( ($Mount) = ($ThisLine =~ /can.t stat exported dir (.*): No such file or directory/) ) {
$Mount = " " . $Mount;
$NotFound{$Mount}++;
}
elsif ( ($Mount,$IP) = ($ThisLine =~ /^NFS mount of (.*) attempted from (\d+\.\d+\.\d+\.\d+) $/) ) {
$Name = LookupIP ($IP);
$Mount = " " . $Mount;
$Attempted{$Name}{$Mount}++;
}
elsif ( ($Name) = ($ThisLine =~ /^authenticated (?:un)?mount request from ([\w:]+)/) ) {
$Mount = " unknown";
$Mounted{$Name}{$Mount}++;
}
elsif ( ($Mount,$IP) = ($ThisLine =~ /^(.*) has been mounted by (\d+\.\d+\.\d+\.\d+) $/) ) {
$Name = LookupIP ($IP);
$Mount = " " . $Mount;
$Mounted{$Name}{$Mount}++;
}
else {
# Report any unmatched entries...
push @OtherList,$ThisLine;
}
}
if (keys %Rejected) {
print "\nRefused NFS mount attempts:\n";
foreach $ThisOne (keys %Rejected) {
print " " . $ThisOne . ":\n";
foreach $ThatOne (keys %{$Rejected{$ThisOne}}) {
print $ThatOne . ': ' . $Rejected{$ThisOne}{$ThatOne} . " Time(s)\n";
}
}
}
if (keys %NotFound) {
print "\nAttemts to mount nonexisting files or directories:\n";
foreach $ThisOne (keys %NotFound) {
print " " . $ThisOne .":" . $NotFound{$ThisOne} . " Time(s)\n";
}
}
if (($Detail >= 5) and (keys %Mounted)) {
print "\nSuccessful NFS mounts:\n";
foreach $ThisOne (keys %Mounted) {
print " " . $ThisOne . ":\n";
foreach $ThatOne (keys %{$Mounted{$ThisOne}}) {
print $ThatOne . ': ' . $Mounted{$ThisOne}{$ThatOne} . " Time(s)\n";
}
}
}
if (($Detail >= 10) and (keys %Attempted)) {
print "\nAttempted NFS mounts:\n";
foreach $ThisOne (keys %Attempted) {
print " " . $ThisOne . ":\n";
foreach $ThatOne (keys %{$Attempted{$ThisOne}}) {
print $ThatOne . ': ' . $Attempted{$ThisOne}{$ThatOne} . " Time(s)\n";
}
}
}
if ($#OtherList >= 0) {
print "\n**Unmatched Entries**\n";
print @OtherList;
}
exit(0);
# vi: shiftwidth=3 tabstop=3 et
|
