#!/bin/sh
# Script Written by hipo
# date: 20.07.2011
# contact email: hipo@pc-freak.net
# Greets for today's Saint Prophet Elijah's feast!
# What it does?: Searches for abusive files which are listed in FILES variable below
# If it gets one it does log to $abusers_log as well is capable of send mail to an email with statistics about possible abusers
# It does walk through openvz's /vz/private/ user directories to scan for abusive files
# if one is found it checks if a VM with an ID of possible abuser is running if it is it does Warns that it's possibly an abuser
# To Use the script via cron put a cron like:
# script
# 35 04 * * * /usr/sbin/search_for_abusers.sh >/dev/null 2>&1
# This script is licensed under GPL3, check the license online on http://www.gnu.org

####### CONFIGURE OPTIONS #########
abusers_log=/var/log/abuser_content_users.log
datee=$(date);
FILES='ircd kaiten dos.pl ddos.pl exploit msfconsole tfn logs.ddos trinoo trinity shaft';
SEND_MAIL='YES';
report_to_mail='hip0@somedomain.com';
mail_server='mail.somemailserver.com';
###################################

	echo "Log started on: $datee" | tee -a $abusers_log;
for L in $FILES; do
	for i in $(locate $L|grep -v apache|grep -i private|sed -e "s#/# #g"|awk '{ print $3 }'|sort -rn| uniq ); do
##echo '----' 
#>> $abusers_log
#locate $L 
#>> $abusers_log
##echo '----' 
#>> $abusers_log
#if [[ $( find /vz/private/$i $L) ]]; then
if [[ $(find /vz/private/$i -iname "$L") ]]; then 
	echo -n 'Found in VM ID:';
		find /vz/private/$i -iname "$L"|sed -e 's#/# #g'|awk '{ print $3 }'| uniq |tee -a $abusers_log
			echo 'Suspicious files:' | tee -a $abusers_log; echo | tee -a $abusers_log
				find /vz/private/$i -iname "$L" | tee -a $abusers_log

	if [[ $(vzlist | grep -i $i) ]]; then
		echo '--------' | tee -a $abusers_log;
		echo "VM ID:$i Might need to be Suspended" | tee -a $abusers_log;
		echo '--------' | tee -a $abusers_log;
			array[${#array[*]}]="$i";
		else
		echo '--------' | tee -a $abusers_log;
		echo "Suspicious files found but VM of ID: $i is not running" |tee -a $abusers_log;
		echo '--------'| tee -a $abusers_log;
	fi
fi

done


	done

		if [[ ${#array[*]} ]]; then
			echo -e '\n\n'| tee -a $abusers_log;
			echo 'Scan for Possible Abusers -- End Statistics:' | tee -a $abusers_log;
			echo '**************************************************************************' | tee -a $abusers_log;
			HOST_MAIN_IP=$(ifconfig |grep eth0 -A 2|grep 'inet addr'|sed -e 's#:# #g'|awk '{ print $3 }');
			echo "| $HOST_MAIN_IP |" | tee -a $abusers_log;
				host_name=$(host $HOST_MAIN_IP);
			echo "| $host_name |" | tee -a $abusers_log;
			echo 'Possible VMs to be Suspended' | tee -a $abusers_log;
			
				for ((z=0; z<${#array[*]}; z++)); do 
					echo '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^' | tee -a $abusers_log;
					echo "$(vzlist |grep -i ${array[$z]})" |tee -a $abusers_log; done
					echo '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^' | tee -a $abusers_log;
					echo '**************************************************************************' | tee -a $abusers_log;

fi


		if [[ $SEND_MAIL == "YES" ]] ; then
			echo -e '\n\n' >> /tmp/mail.tmp;
			echo 'Scan for Possible Abusers -- End Statistics:' >>/tmp/mail.tmp;
			echo '**************************************************************************' >> /tmp/mail.tmp;
				HOST_MAIN_IP=$(ifconfig |grep eth0 -A 2|grep 'inet addr'|sed -e 's#:# #g'|awk '{ print $3 }');
			echo "| $HOST_MAIN_IP |" >> /tmp/mail.tmp;
				host_name=$(host $HOST_MAIN_IP);
			echo "| $host_name |" >> /tmp/mail.tmp;
			echo 'Possible VMs to be Suspended' >> /tmp/mail.tmp;
				for ((z=0; z<${#array[*]}; z++)); do
				echo '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^' >> /tmp/mail.tmp;
				echo "$(vzlist |grep -i ${array[$z]})"; done
				echo '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^' >> /tmp/mail.tmp;
				echo '**************************************************************************' >> /tmp/mail.tmp;

			echo "Sending mail report to mail $report_to_mail";
				cat /tmp/mail.tmp | nail -r "hipo@$HOST_MAIL_IP" -s "Possible VPN server Abusers Report $(date)" -S smtp=$mail_server $report_to_mail
				rm -f /tmp/mail.tmp;
		fi
			echo "Log Ended on: $datee" | tee -a $abusers_log;