OwlCyberSecurity - MANAGER

Edit File: check_ip_usage.py

#!/usr/libexec/platform-python
#
#  Created by Max.N v.0.0.1
#
# Need sudo access to
# 1) whmapi1 listaccts
# 2) whmapi1 listips
# Need read acces to
# 1) /etc/reservedipreasons
#
# need add to sudoers.d
#   like:
#  /usr/sbin/whmapi1 listips --output=json,\
#  /usr/sbin/whmapi1 listaccts --output=json,\
import argparse as ap
import json
import re
import shelve
import socket
from subprocess import Popen, PIPE
import time

sudo = '/usr/bin/sudo'
tmp_file_path = "/var/log/nagios/check_ips.conf"
whmapi = "/usr/sbin/whmapi1"
command = "listaccts --output=json"
command2 = "listips --output=json"
path_to_reserved_ips = "/etc/reservedipreasons"
path_to_outgoing_mail_ip = "/etc/outgoingmailip"
status_text = []
hostname = socket.gethostname()
exit_code = 0
# list reserved local networks
re_int_ip = re.compile(r'^('
                        r'0\.|'
                        r'10\.|'
                        r'100\.100\.0.|'
                        r'100\.101\.0.|'
                        r'100\.127\.255\.255|'
                        r'127\.|'
                        r'169\.254\.|'
                        r'172\.16\.|'
                        r'172\.(?:1[6-9])?(?:2[0-9])?(?:3[0-1])?\.|'
                        r'172\.31\.255\.255|'
                        r'192\.0\.|'
                        r'192\.88\.99\.|'
                        r'192\.168\.|'
                        r'198\.18\.|'
                        r'198\.19\.255\.255|'
                        r'198\.51\.100\.|'
                        r'198\.51\.100\.255|'
                        r'203\.0\.113\.|'
                        r'224\.0\.0\.0|'
                        r'239\.255\.255\.255|'
                        r'240\.0\.0\.|'
                        r'255\.255\.255\.254|'
                        r'255\.255\.255\.255'
                        r')',
                       re.MULTILINE)
# - Parse args -
parser = ap.ArgumentParser(description="Help")
parser.add_argument("-v", action='store_true', help='enable verbose output')
args, leftovers = parser.parse_known_args()

if args.v:
    verbosity = 1
else:
    verbosity = 0
# - end -

def get_mailip(path):
    with open(path) as file:
        ip = file.readline().splitlines()
    return ip

def verbo(text):
    if verbosity > 0:
        print(text)

def check_is_time(ip):
    result = False
    ip = str(ip)
    ip_config = shelve.open(tmp_file_path)
    unixtime = ip_config.get(ip, None)

if unixtime:
        delta = int(time.time()) - unixtime
        if delta > (24 * 60 * 60):
            result = True
    else:
        ip_config[ip] = int(time.time())

return result

def get_list_users_ips(command):
    try:
        run = [sudo, whmapi]
        run.extend(command.split())
        # print " ".join(run)
        user_ips = []
        dediated_ips_raw = json.loads(Popen(run, stdout=PIPE).stdout.read())
        accounts = dediated_ips_raw.get("data").get("acct", None)
        if accounts:
            for account in accounts:
                ip = account.get("ip", None)
                if ip not in user_ips:
                    user_ips.append(ip)
        else:
            user_ips = []
    except:
        user_ips = []

return user_ips

def get_raw_ips(command):
    try:
        run = [sudo, whmapi]
        run.extend(command.split())
        # print " ".join(run)
        ips_raw = json.loads(Popen(run, stdout=PIPE).stdout.read()).get("data").get('ip')
    except:
        ips_raw = None
    return ips_raw

def is_reseller(hostname):
    if hostname[:4] == 'host':
        return True
    else:
        return False

raw_server_ips = get_raw_ips(command2)
server_ips = []
ips_in_use = get_list_users_ips(command)
ddos_ips = []
ipmi_ips = []
shared_ips = []
mail_ip = get_mailip(path_to_outgoing_mail_ip)
# Alarm Vars
alarm_in_config = []  # syntax error
alarm_is_main = []  # in use main ip as dedicated
alarm_in_not_use = []  # ip not in use at all
alarm_is_internal = []  # ip is internal but have clients
alarm_mailip_in_use = [] # users asing to mail ip

with open(path_to_reserved_ips) as file:
    for line in file.readlines():
        line = str(line).upper()
        # print line
        if line in ['\n', '\r\n']:
            continue  # Skip blank lines
        ip = line.split("=")
        if len(ip) < 2:
            alarm_in_config.append("wtf with line " + str(line))
            continue
        elif "IPMI" in str(ip[1]).upper():
            ipmi_ips.append(ip[0])
        elif "DDOS" in str(ip[1]).upper():
            ddos_ips.append(ip[0])
        elif "SHARED" in str(ip[1]).upper():
            shared_ips.append(ip[0])

for row in raw_server_ips:
    ip = row.get("ip")
    is_main = row.get("mainaddr")
    server_ips.append(ip)
    internal = re.findall(re_int_ip, ip)
    if ip in ips_in_use:
        if len(internal) > 0:
            alarm_is_internal.append(ip)
        elif is_main == 1:
            alarm_is_main.append(ip)
        elif ip in mail_ip and ip not in shared_ips:
            alarm_mailip_in_use.append(ip)
    elif len(internal) == 0:
        if is_main == 1 or ip in ipmi_ips or ip in mail_ip or ip in shared_ips:  # skip Main or IPMI or mail ips
            continue
        if not check_is_time(ip):
            verbo("Not this time my friend " + str(ip))
            continue
        alarm_in_not_use.append(ip)

if len(alarm_in_config) > 0:
    exit_code = 1
    status_text.append(str(len(alarm_in_config)) + " something wrong in config")
    verbo("Something wrong in config")
    verbo(", ".join(alarm_in_config))

if len(alarm_in_not_use) > 0:
    exit_code = 1
    if len(alarm_in_not_use) >= 5:
        exit_code = 2
    text = str(len(alarm_in_not_use)) + " ip not in use"
    if is_reseller(hostname):
        text = text + " contact 'Billing Team'"
    status_text.append(text)
    verbo("Ip not in use")
    verbo(", ".join(alarm_in_not_use))

if not mail_ip:
    exit_code = 2
    status_text.append("No mail ip was found on server")
    verbo("Something wrong in config, No mail ips")

if len(alarm_mailip_in_use) > 0:
    exit_code = 2
    status_text.append(str(len(alarm_mailip_in_use)) + " ip is reserved as mail but clients assigned on it")
    verbo("Ip is reserved as mail but clients assigned on it")
    verbo(", ".join(alarm_mailip_in_use))

if len(alarm_is_internal) > 0:
    exit_code = 2
    status_text.append(str(len(alarm_is_internal)) + " ip is internal but clients assigned on it")
    verbo("Ip is internal but clients assign on it")
    verbo(", ".join(alarm_is_internal))

if len(alarm_is_main) > 0:
    exit_code = 2
    status_text.append(str(len(alarm_is_main)) + " main ip assign as dedicated")
    verbo("Main ip assign as dedicated")
    verbo(", ".join(alarm_is_main))

if exit_code > 0:
    print("result: {}".format(status_text))
else:
    print("result: OK")

exit(exit_code)