установка:
Код: Выделить всё
vim /usr/local/bin/dovecot_failed_auth.shКод: Выделить всё
#!/bin/bash
# ============================================================
# Скрипт для анализа неудачных попыток входа с геолокацией
# ============================================================
EMAIL_TO="admin@padonak.su"
HOSTNAME=$(hostname -f)
DOVECOT_LOG="/var/log/dovecot/dovecot_info.log"
POSTFIX_LOG="/var/log/mail.log"
REPORT_FILE=$(mktemp)
# Функция для получения геолокации по IP
get_geo() {
local ip=$1
# Локальные IP
if [[ "$ip" == 127.0.0.1 || "$ip" == ::1 || "$ip" == 192.168.* || "$ip" == 10.* || "$ip" == 172.16.* || "$ip" == 93.95.101.238 ]]; then
echo "Локальный"
return
fi
# Пробуем через ip-api.com
local geo=$(curl -s "http://ip-api.com/line/$ip?fields=country,city,isp" 2>/dev/null)
if [ -n "$geo" ]; then
country=$(echo "$geo" | sed -n '1p')
city=$(echo "$geo" | sed -n '2p')
isp=$(echo "$geo" | sed -n '3p')
echo "${country:-Неизв}, ${city:-Неизв}"
else
echo "Неизвестно"
fi
}
{
echo "============================================================"
echo " 📊 ОТЧЁТ ПО НЕУДАЧНЫМ ПОПЫТКАМ ВХОДА"
echo " Сервер: $HOSTNAME"
echo " Дата: $(date '+%Y-%m-%d %H:%M:%S')"
echo "============================================================"
echo ""
# ============================================================
# 1. НЕУДАЧНЫЕ ПОПЫТКИ IMAP (Dovecot) С ГЕОЛОКАЦИЕЙ
# ============================================================
echo "📧 1. НЕУДАЧНЫЕ ПОПЫТКИ IMAP (Dovecot) — за 24 часа"
echo "------------------------------------------------------------------------------------------"
printf " %-30s %-18s %-25s %5s\n" "USERNAME" "IP ADDRESS" "COUNTRY/CITY" "ATTEMPTS"
echo "------------------------------------------------------------------------------------------"
# Собираем данные в массив
declare -A geo_cache
tail -5000 "$DOVECOT_LOG" 2>/dev/null | \
grep -E "auth failed|auth_failed" | \
awk '
{
if (match($0, /user=<([^>]*)>/, u) && match($0, /rip=([0-9\.]*)/, i)) {
key = u[1] "|" i[1]
count[key]++
}
}
END {
for (key in count) {
split(key, parts, "|")
printf "%s|%s|%d\n", parts[1], parts[2], count[key]
}
}' | sort -t'|' -k3 -n -r | head -20 | \
while IFS='|' read username ip attempts; do
# Получаем геолокацию (с кешированием)
if [ -z "${geo_cache[$ip]}" ]; then
geo_cache[$ip]=$(get_geo "$ip")
fi
geo="${geo_cache[$ip]}"
printf " %-30s %-18s %-25s %5d\n" "$username" "$ip" "$geo" "$attempts"
done
echo "------------------------------------------------------------------------------------------"
echo ""
# ============================================================
# 2. НЕУДАЧНЫЕ ПОПЫТКИ SASL (Postfix) С ГЕОЛОКАЦИЕЙ
# ============================================================
echo "📨 2. НЕУДАЧНЫЕ ПОПЫТКИ SASL (Postfix SMTP) — за 24 часа"
echo "------------------------------------------------------------------------------------------"
printf " %-30s %-18s %-25s %5s\n" "USERNAME" "IP ADDRESS" "COUNTRY/CITY" "ATTEMPTS"
echo "------------------------------------------------------------------------------------------"
# Очищаем кеш для SASL
unset geo_cache
declare -A geo_cache
tail -50000 "$POSTFIX_LOG" 2>/dev/null | \
grep "SASL PLAIN authentication failed" | \
awk '
{
if (match($0, /sasl_username=([^,]*)/, u)) {
username = u[1]
if (match($0, /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/, ip)) {
key = username "|" ip[0]
count[key]++
}
}
}
END {
for (key in count) {
split(key, parts, "|")
printf "%s|%s|%d\n", parts[1], parts[2], count[key]
}
}' | sort -t'|' -k3 -n -r | head -20 | \
while IFS='|' read username ip attempts; do
# Получаем геолокацию (с кешированием)
if [ -z "${geo_cache[$ip]}" ]; then
geo_cache[$ip]=$(get_geo "$ip")
fi
geo="${geo_cache[$ip]}"
printf " %-30s %-18s %-25s %5d\n" "$username" "$ip" "$geo" "$attempts"
done
echo "------------------------------------------------------------------------------------------"
echo ""
# ============================================================
# 3. ГЕОЛОКАЦИЯ АТАКУЮЩИХ IP (топ-10)
# ============================================================
echo "🌍 3. ГЕОЛОКАЦИЯ АТАКУЮЩИХ IP (топ-10)"
echo "------------------------------------------------------------"
echo " IP ADDRESS COUNTRY/CITY ATTEMPTS"
echo "------------------------------------------------------------"
tail -50000 "$POSTFIX_LOG" 2>/dev/null | \
grep "SASL PLAIN authentication failed" | \
grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
sort | uniq -c | sort -rn | head -10 | \
while read count ip; do
geo=$(get_geo "$ip")
printf " %-18s %-25s %5d\n" "$ip" "$geo" "$count"
done
echo "------------------------------------------------------------"
echo ""
# ============================================================
# 4. ОБЩАЯ СТАТИСТИКА
# ============================================================
echo "📊 4. ОБЩАЯ СТАТИСТИКА"
echo "------------------------------------------------------------"
IMAP_TOTAL=$(tail -5000 "$DOVECOT_LOG" 2>/dev/null | grep -E "auth failed|auth_failed" | wc -l)
SASL_TOTAL=$(tail -50000 "$POSTFIX_LOG" 2>/dev/null | grep "SASL PLAIN authentication failed" | wc -l)
UNIQ_IMAP_USERS=$(tail -5000 "$DOVECOT_LOG" 2>/dev/null | grep -E "auth failed|auth_failed" | sed -n 's/.*user=<\([^>]*\)>.*/\1/p' | sort -u | wc -l)
UNIQ_SASL_USERS=$(tail -50000 "$POSTFIX_LOG" 2>/dev/null | grep "SASL PLAIN authentication failed" | sed -n 's/.*sasl_username=\([^,]*\).*/\1/p' | sort -u | wc -l)
echo " 📧 IMAP: $IMAP_TOTAL попыток, $UNIQ_IMAP_USERS уникальных пользователей"
echo " 📨 SASL: $SASL_TOTAL попыток, $UNIQ_SASL_USERS уникальных пользователей"
echo "------------------------------------------------------------"
echo ""
echo "============================================================"
echo "Отчёт сгенерирован: $(date '+%Y-%m-%d %H:%M:%S')"
echo "============================================================"
} > "$REPORT_FILE"
mail -s "[Dovecot/Postfix Report] Auth attempts on $HOSTNAME" "$EMAIL_TO" < "$REPORT_FILE"
rm -f "$REPORT_FILE"
echo "✅ Отчёт отправлен на $EMAIL_TO"
Код: Выделить всё
chmod +x /usr/local/bin/dovecot_failed_auth.shКод: Выделить всё
sudo crontab -eКод: Выделить всё
0 8 * * * /usr/local/bin/dovecot_failed_auth.shКод: Выделить всё
3. ГЕОЛОКАЦИЯ АТАКУЮЩИХ IP (топ-10)
------------------------------------------------------------
IP ADDRESS COUNTRY/CITY ATTEMPTS
------------------------------------------------------------
210.0.90.82 Australia, Forest Lodge 10
222.117.0.253 South Korea, Anyang-si 8
210.0.90.81 Australia, Forest Lodge 6
111.0.81.84 China, Hangzhou 5
45.178.227.0 Brazil, Paquetá 4
131.0.190.152 Brazil, Santa Luzia 4
49.0.82.4 Thailand, Bangkok 3
31.173.0.140 Russia, Moscow 3
201.46.124.0 Colombia, Bogotá 3
180.111.0.21 China, Nanjing 3
------------------------------------------------------------
📊 4. ОБЩАЯ СТАТИСТИКА
------------------------------------------------------------
📧 IMAP: 5 попыток, 3 уникальных пользователей
📨 SASL: 1161 попыток, 116 уникальных пользователей
------------------------------------------------------------
============================================================
Отчёт сгенерирован: 2026-09-05 16:56:09
============================================================
