| 3 |
liveuser |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/*
|
|
|
4 |
|
|
|
5 |
QBPWCF, Quick Build PHP website Component base on Fedora Linux.
|
| 239 |
liveuser |
6 |
Copyright (C) 2014~2026 MIN ZHI, CHEN
|
| 3 |
liveuser |
7 |
|
|
|
8 |
This file is part of QBPWCF.
|
|
|
9 |
|
|
|
10 |
QBPWCF is free software: you can redistribute it and/or modify
|
|
|
11 |
it under the terms of the GNU General Public License as published by
|
|
|
12 |
the Free Software Foundation, either version 3 of the License, or
|
|
|
13 |
(at your option) any later version.
|
|
|
14 |
|
|
|
15 |
QBPWCF is distributed in the hope that it will be useful,
|
|
|
16 |
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
17 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
18 |
GNU General Public License for more details.
|
|
|
19 |
|
|
|
20 |
You should have received a copy of the GNU General Public License
|
|
|
21 |
along with QBPWCF. If not, see <http://www.gnu.org/licenses/>.
|
|
|
22 |
|
|
|
23 |
*/
|
|
|
24 |
namespace qbpwcf;
|
|
|
25 |
|
|
|
26 |
/*
|
|
|
27 |
類別說明:
|
| 368 |
liveuser |
28 |
跟網頁、資訊安全性有關的類別.
|
| 3 |
liveuser |
29 |
備註:
|
|
|
30 |
無.
|
|
|
31 |
*/
|
|
|
32 |
class security{
|
|
|
33 |
|
|
|
34 |
/*
|
|
|
35 |
#函式說明:
|
|
|
36 |
#當前類別被呼叫的靜態方法不存在時,將會執行該函數,回報該方法不存在.
|
|
|
37 |
#回傳結果:
|
|
|
38 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
39 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
40 |
#$result["function"],當前執行的函式名稱.
|
|
|
41 |
#必填參數:
|
|
|
42 |
#$method,物件,為物件實體或類別名稱,會自動置入該參數.
|
|
|
43 |
#$arguments,陣列,為呼叫方法時所用的參數.
|
|
|
44 |
#可省略參數:
|
|
|
45 |
#無.
|
|
|
46 |
#參考資料:
|
|
|
47 |
#__call=>http://php.net/manual/en/language.oop5.overloading.php#object.callstatic
|
|
|
48 |
#備註:
|
|
|
49 |
#無.
|
|
|
50 |
*/
|
|
|
51 |
public function __call($method,$arguments){
|
| 226 |
liveuser |
52 |
|
| 3 |
liveuser |
53 |
#取得當前執行的函式
|
|
|
54 |
$result["function"]=__FUNCTION__;
|
| 226 |
liveuser |
55 |
|
| 3 |
liveuser |
56 |
#設置執行不正常
|
|
|
57 |
$result["status"]="false";
|
| 226 |
liveuser |
58 |
|
| 3 |
liveuser |
59 |
#設置執行錯誤
|
|
|
60 |
$result["error"][]=__NAMESPACE__ ."/".$method."() 不存在!";
|
| 226 |
liveuser |
61 |
|
| 3 |
liveuser |
62 |
#設置所丟入的參數
|
|
|
63 |
$result["error"][]=$arguments;
|
| 226 |
liveuser |
64 |
|
| 3 |
liveuser |
65 |
#回傳結果
|
|
|
66 |
return $result;
|
| 226 |
liveuser |
67 |
|
| 3 |
liveuser |
68 |
}#function __call end
|
| 226 |
liveuser |
69 |
|
| 3 |
liveuser |
70 |
/*
|
|
|
71 |
#函式說明:
|
|
|
72 |
#當前類別被呼叫的靜態方法不存在時,將會執行該函數,回報該方法不存在.
|
|
|
73 |
#回傳結果:
|
|
|
74 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
75 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
76 |
#$result["function"],當前執行的函式名稱.
|
|
|
77 |
#必填參數:
|
|
|
78 |
#$method,物件,為物件實體或類別名稱,會自動置入該參數.
|
|
|
79 |
#$arguments,陣列,為呼叫方法時所用的參數.
|
|
|
80 |
#可省略參數:
|
|
|
81 |
#無.
|
|
|
82 |
#參考資料:
|
|
|
83 |
#__callStatic=>http://php.net/manual/en/language.oop5.overloading.php#object.callstatic
|
|
|
84 |
#備註:
|
|
|
85 |
#無.
|
|
|
86 |
*/
|
|
|
87 |
public static function __callStatic($method,$arguments){
|
| 226 |
liveuser |
88 |
|
| 3 |
liveuser |
89 |
#取得當前執行的函式
|
|
|
90 |
$result["function"]=__FUNCTION__;
|
| 226 |
liveuser |
91 |
|
| 3 |
liveuser |
92 |
#設置執行不正常
|
|
|
93 |
$result["status"]="false";
|
| 226 |
liveuser |
94 |
|
| 3 |
liveuser |
95 |
#設置執行錯誤
|
|
|
96 |
$result["error"][]="欲呼叫的". __NAMESPACE__ ."/".$method."() 不存在!";
|
| 226 |
liveuser |
97 |
|
| 3 |
liveuser |
98 |
#設置所丟入的參數
|
|
|
99 |
$result["error"][]=$arguments;
|
| 226 |
liveuser |
100 |
|
| 3 |
liveuser |
101 |
#回傳結果
|
|
|
102 |
return $result;
|
| 226 |
liveuser |
103 |
|
| 3 |
liveuser |
104 |
}#function __callStatic end
|
| 226 |
liveuser |
105 |
|
| 3 |
liveuser |
106 |
/*
|
| 226 |
liveuser |
107 |
#函式說明:
|
| 3 |
liveuser |
108 |
#禁止特定的angent訪問我們的網站，例如google與百度的搜尋引擎。
|
|
|
109 |
#回傳結果:
|
|
|
110 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
111 |
#$result["error"],錯誤訊息.
|
|
|
112 |
#$result["function"],當前執行的函數名稱.
|
|
|
113 |
#必填參數:
|
|
|
114 |
#$conf["disableAngentName"],字串,要禁止拜訪的用戶端資訊,代表要禁止哪些瀏覽器／搜尋引擎瀏覽，格式爲 /(含有哪些關鍵字，若有多個請用「|」隔開。)/i.
|
|
|
115 |
$conf["disableAngentName"]="/(Chrome|Mozilla|Internet)/i";
|
|
|
116 |
#可省略參數:
|
|
|
117 |
#$conf["transferLocation"],字串,如果是要禁止搜尋引擎，要轉址到那個地方?，若沒設定，則預設爲資安素養網的臉書(https://zh-tw.facebook.com/isafemoe).
|
|
|
118 |
#$conf["transferLocation"]="";
|
|
|
119 |
#參考資料:
|
|
|
120 |
#http://php.net/manual/en/function.preg-match.php
|
|
|
121 |
#備註:
|
|
|
122 |
#無.
|
|
|
123 |
*/
|
|
|
124 |
public static function preventSerchEngine(&$conf){
|
|
|
125 |
|
|
|
126 |
#初始化要回傳的內容
|
|
|
127 |
$result=array();
|
| 226 |
liveuser |
128 |
|
| 3 |
liveuser |
129 |
#取得當前執行的函式
|
|
|
130 |
$result["function"]=__FUNCTION__;
|
| 226 |
liveuser |
131 |
|
| 3 |
liveuser |
132 |
#如果 $conf 不為陣列
|
|
|
133 |
if(gettype($conf)!="array"){
|
| 226 |
liveuser |
134 |
|
| 3 |
liveuser |
135 |
#設置執行失敗
|
|
|
136 |
$result["status"]="false";
|
| 226 |
liveuser |
137 |
|
| 3 |
liveuser |
138 |
#設置執行錯誤訊息
|
|
|
139 |
$result["error"][]="\$conf變數須為陣列形態";
|
|
|
140 |
|
|
|
141 |
#如果傳入的參數為 null
|
|
|
142 |
if($conf==null){
|
| 226 |
liveuser |
143 |
|
| 3 |
liveuser |
144 |
#設置執行錯誤訊息
|
|
|
145 |
$result["error"][]="\$conf變數不得為null,請檢查函數「".$result["function"]."」的參數設置有無正確!";
|
| 226 |
liveuser |
146 |
|
| 3 |
liveuser |
147 |
}#if end
|
|
|
148 |
|
|
|
149 |
#回傳結果
|
|
|
150 |
return $result;
|
| 226 |
liveuser |
151 |
|
| 3 |
liveuser |
152 |
}#if end
|
|
|
153 |
|
|
|
154 |
#debug，檢查 $_SERVER["HTTP_USER_AGENT"] 的內容
|
|
|
155 |
#var_dump($_SERVER['HTTP_USER_AGENT']);
|
| 226 |
liveuser |
156 |
|
| 3 |
liveuser |
157 |
#檢查參數
|
|
|
158 |
#函式說明：
|
|
|
159 |
#檢查必填與可省略的參數，可省略參數可指定預設要給與什麼數值內容。
|
|
|
160 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
161 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
162 |
#$result["function"],當前執行的函式名稱.
|
|
|
163 |
#$result["passed"],識別要檢查的全體變數是否存在以及型態是否正確的變數,"true"代表檢查全部通過;"false"代表檢查不通過
|
|
|
164 |
#$result[$shouldBtCheckedVarName]["varExist"],所檢查的變數是否存在,"false"代表不存在;"true"代表存在
|
|
|
165 |
#$result[$shouldBtCheckedVarName]["varType"],所檢查的變數型態是否正確,"false"代表錯誤;"true"代表正確
|
|
|
166 |
#$result[$shouldBtCheckedVarName]["error"],每個參數設定的錯誤訊息
|
|
|
167 |
#$result["argu"],字串陣列,目前輸入的參數名稱陣列.
|
|
|
168 |
#$result["legalVarName"],字串陣列,合法可用的參數名稱陣列.
|
|
|
169 |
#$result["notNeedVar"],字串陣列,多餘的參數名稱.
|
|
|
170 |
#必填寫的參數：
|
|
|
171 |
#$conf["variableCheck::checkArguments"]["varInput"],陣列變數,要檢查的陣列變數,請在要檢查的參數前面加上&，這樣變動的結果才能被套用。
|
|
|
172 |
$conf["variableCheck::checkArguments"]["varInput"]=&$conf;
|
|
|
173 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"],爲必填參數的變數名稱陣列，形態爲陣列變數，元素數量需要跟"mustBeFilledVariableType"參數的元素數量一致,例如: $conf["mustBeFilledVariableName"] = array("id","account","password");
|
|
|
174 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"]=array("disableAngentName");
|
| 226 |
liveuser |
175 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"],爲必填參數的變數陣列應該爲何種變數形態，形態爲陣列,元素數量需要跟"mustBeFilledVariableName"參數的元素數量一致,例如: $conf["mustBeFilledVariableType"] = array("string",integer,"double","resource","object");
|
| 3 |
liveuser |
176 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"]=array("string");
|
|
|
177 |
#$conf["variableCheck::checkArguments"]["referenceVarKey"],字串,$conf參數後面的key值,用於移除不要的參考陣列.
|
|
|
178 |
$conf["variableCheck::checkArguments"]["referenceVarKey"]="variableCheck::checkArguments";
|
|
|
179 |
#可以省略的參數：
|
|
|
180 |
#$conf["canBeEmptyString"],必填變數內容如果是空字串就不能算是有設置的話，請設為"false",預設爲"true"。
|
|
|
181 |
#$conf["canBeEmptyString"]="false";
|
|
|
182 |
#$conf["variableCheck::checkArguments"]["skipableVariableName"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableName"] = array("id","account","password");
|
|
|
183 |
$conf["variableCheck::checkArguments"]["skipableVariableName"]=array("transferLocation");
|
| 226 |
liveuser |
184 |
#$conf["variableCheck::checkArguments"]["skipableVariableType"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableType"] = array("string",integer,"double");
|
| 3 |
liveuser |
185 |
$conf["variableCheck::checkArguments"]["skipableVariableType"]=array("string");
|
|
|
186 |
#$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"],字串陣列,每個不存在的可省略變數要初始化為什麼,null與代表不指定,若預設值是參數之一，請將$conf["mustBeFilledVar"]改成"\$conf["\mustBeFilledVar\"]".
|
|
|
187 |
$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"]=array("https://zh-tw.facebook.com/isafemoe");
|
|
|
188 |
#$conf["arrayCountEqualCheck"],字串陣列,為檢查哪些陣列參數的元素數量要一樣,$conf["arrayCountEqualCheck"][$i]=array()為第$i組key為哪些的變數其元素數量要相等.
|
|
|
189 |
#$conf["arrayCountEqualCheck"][]=array();
|
|
|
190 |
#參考資料來源:
|
|
|
191 |
#array_keys=>http://php.net/manual/en/function.array-keys.php
|
|
|
192 |
$checkArguments=variableCheck::checkArguments($conf["variableCheck::checkArguments"]);
|
|
|
193 |
unset($conf["variableCheck::checkArguments"]);
|
| 226 |
liveuser |
194 |
|
| 3 |
liveuser |
195 |
#如果檢查失敗
|
|
|
196 |
if($checkArguments["status"]=="false"){
|
| 226 |
liveuser |
197 |
|
| 3 |
liveuser |
198 |
#設置執行失敗
|
|
|
199 |
$result["status"]="false";
|
| 226 |
liveuser |
200 |
|
| 3 |
liveuser |
201 |
#設置執行錯誤訊息
|
|
|
202 |
$result["error"]=$checkArguments;
|
|
|
203 |
|
|
|
204 |
#回傳結果
|
|
|
205 |
return $result;
|
| 226 |
liveuser |
206 |
|
|
|
207 |
}#if end
|
|
|
208 |
|
| 3 |
liveuser |
209 |
#如果檢查不通過
|
|
|
210 |
if($checkArguments["passed"]=="false"){
|
| 226 |
liveuser |
211 |
|
| 3 |
liveuser |
212 |
#設置執行失敗
|
|
|
213 |
$result["status"]="false";
|
| 226 |
liveuser |
214 |
|
| 3 |
liveuser |
215 |
#設置執行錯誤訊息
|
|
|
216 |
$result["error"]=$checkArguments;
|
|
|
217 |
|
|
|
218 |
#回傳結果
|
|
|
219 |
return $result;
|
| 226 |
liveuser |
220 |
|
|
|
221 |
}#if end
|
|
|
222 |
|
| 3 |
liveuser |
223 |
#如果使用者的瀏覽器出現變數 $conf["disableAngentName"] 裡面的關鍵字
|
|
|
224 |
if(preg_match($conf["disableAngentName"],$_SERVER["HTTP_USER_AGENT"])){
|
|
|
225 |
|
|
|
226 |
#則轉址特定頁面
|
|
|
227 |
#函式說明:
|
|
|
228 |
#設定session變數後,立即轉址.
|
|
|
229 |
#回傳結果:
|
|
|
230 |
#$result["status"],執行是否成功,"true"代表成功,"false"代表不成功.
|
|
|
231 |
#$result["function"],當前執行的函數名稱.
|
|
|
232 |
#$result["error"],錯誤訊息陣列.
|
|
|
233 |
#必填的參數:
|
|
|
234 |
#$conf["header::redirectionNow"]["headerLocation"],為要轉址到的地方,若爲 $_SERVER["PHP_SELF"]，則爲回到目前頁面,全民資安素養網爲 https://isafe.moe.edu.tw/.
|
|
|
235 |
$conf["header::redirectionNow"]["headerLocation"]=$conf["transferLocation"];
|
|
|
236 |
#可省略的參數:
|
|
|
237 |
#$conf["sessionName"],字串陣列,可以指派session變數的名稱.
|
|
|
238 |
#$conf["sessionName"]=array("");
|
|
|
239 |
#$conf["sessionValue"]字串陣列,可以指派session變數的內容.
|
|
|
240 |
#$conf["sessionValue"]=array("");
|
|
|
241 |
#參靠資料來源:
|
|
|
242 |
#http://php.net/manual/en/reserved.variables.server.php
|
|
|
243 |
$redirectionNow=header::redirectionNow($conf["header::redirectionNow"]);
|
| 226 |
liveuser |
244 |
unset($conf["header::redirectionNow"]);
|
|
|
245 |
|
| 3 |
liveuser |
246 |
#如果轉址失敗
|
|
|
247 |
if($redirectionNow["status"]=="false"){
|
| 226 |
liveuser |
248 |
|
| 3 |
liveuser |
249 |
#設置執行失敗
|
|
|
250 |
$result["status"]="false";
|
| 226 |
liveuser |
251 |
|
| 3 |
liveuser |
252 |
#設置執行錯誤訊息
|
|
|
253 |
$result["error"]=$redirectionNow;
|
|
|
254 |
|
|
|
255 |
#回傳結果
|
|
|
256 |
return $result;
|
| 226 |
liveuser |
257 |
|
| 3 |
liveuser |
258 |
}#if end
|
| 226 |
liveuser |
259 |
|
|
|
260 |
}#if end
|
|
|
261 |
|
| 3 |
liveuser |
262 |
#執行到這邊代表是可以拜訪的網頁瀏覽器
|
|
|
263 |
$result["status"]="true";
|
| 226 |
liveuser |
264 |
|
| 3 |
liveuser |
265 |
#回傳結果
|
|
|
266 |
return $result;
|
|
|
267 |
|
|
|
268 |
}#function preventSerchEngine end
|
|
|
269 |
|
|
|
270 |
/*
|
|
|
271 |
#函式說明:
|
|
|
272 |
#禁止做任違反版權的事情,禁止在網頁按下滑鼠右鍵，禁止複製圖片,禁止開新分頁(失敗), 版權所有、Power by訊息.
|
|
|
273 |
#回傳的內容：
|
|
|
274 |
#保護版權的語法
|
|
|
275 |
#必填參數:
|
|
|
276 |
#無
|
|
|
277 |
#可省略參數:
|
|
|
278 |
#$conf["name"],字串,公司、組織、單位的名稱,預設不指定.
|
|
|
279 |
#$conf["name"]="";
|
|
|
280 |
#$conf["powerBy"],字串,由誰提供,預設爲QBPWCF.
|
|
|
281 |
#$conf["powerBy"]="";
|
|
|
282 |
#$conf["powerByLink"],字串,power by字串的連結目標,預設爲"https://www.qbpwcf.org".
|
|
|
283 |
#$conf["powerByLink"]="";
|
|
|
284 |
#$conf["bgColor"],字串,背景顏色,預設爲淡藍色.
|
|
|
285 |
#$conf["bgColor"]="";
|
|
|
286 |
#參考資料:
|
|
|
287 |
#http://www.w3schools.com/jsref/dom_obj_event.asp
|
|
|
288 |
#備註:
|
|
|
289 |
#無.
|
|
|
290 |
*/
|
|
|
291 |
public static function copyRight(&$conf){
|
| 226 |
liveuser |
292 |
|
| 3 |
liveuser |
293 |
#初始化要回傳的結果
|
|
|
294 |
$result=array();
|
|
|
295 |
|
|
|
296 |
#取得當前執行的函數名稱
|
|
|
297 |
$result["function"]=__FUNCTION__;
|
|
|
298 |
|
|
|
299 |
#取得參數
|
|
|
300 |
$result["argu"]=$conf;
|
|
|
301 |
|
|
|
302 |
#如果 $conf 不為陣列
|
|
|
303 |
if(gettype($conf)!="array"){
|
|
|
304 |
|
|
|
305 |
#設置執行失敗
|
|
|
306 |
$result["status"]="false";
|
|
|
307 |
|
|
|
308 |
#設置執行錯誤訊息
|
|
|
309 |
$result["error"][]="\$conf變數須為陣列形態";
|
|
|
310 |
|
|
|
311 |
#如果傳入的參數為 null
|
|
|
312 |
if(is_null($conf)){
|
|
|
313 |
|
|
|
314 |
#設置執行錯誤訊息
|
|
|
315 |
$result["error"][]="\$conf變數不得為null,請檢查函數「".$result["function"]."」的參數設置有無正確!";
|
|
|
316 |
|
|
|
317 |
}#if end
|
|
|
318 |
|
|
|
319 |
#回傳結果
|
|
|
320 |
return $result;
|
|
|
321 |
|
|
|
322 |
}#if end
|
| 226 |
liveuser |
323 |
|
| 3 |
liveuser |
324 |
#初始化 content
|
| 226 |
liveuser |
325 |
$result["content"]="";
|
|
|
326 |
|
| 3 |
liveuser |
327 |
#函式說明:
|
|
|
328 |
#檢查必填與可省略的參數，可省略參數可指定預設要給與什麼數值內容。
|
|
|
329 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
330 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
331 |
#$result["function"],當前執行的函式名稱.
|
|
|
332 |
#$result["argu"],設置給予的參數.
|
|
|
333 |
#$result["passed"],識別要檢查的全體變數是否存在以及型態是否正確的變數,"true"代表檢查全部通過;"false"代表檢查不通過
|
|
|
334 |
#$result[$shouldBeCheckedVarName]["varExist"],所檢查的變數是否存在,"false"代表不存在;"true"代表存在
|
|
|
335 |
#$result[$shouldBeCheckedVarName]["varType"],所檢查的變數型態是否正確,"false"代表錯誤;"true"代表正確
|
|
|
336 |
#$result[$shouldBeCheckedVarName]["error"],每個參數設定的錯誤訊息
|
|
|
337 |
#$result["shouldNotBeEmpty"],不應該為空字串或控陣列的變數.
|
|
|
338 |
#$result["argu"],字串陣列,目前輸入的參數名稱陣列.
|
|
|
339 |
#$result["legalVarName"],字串陣列,合法可用的參數名稱陣列.
|
|
|
340 |
#$result["notNeedVar"],字串陣列,多餘的參數名稱.
|
|
|
341 |
#必填寫的參數:
|
|
|
342 |
#$conf["varInput"],陣列變數,要檢查的陣列變數,請在要檢查的參數前面加上&，這樣變動的結果才能被套用。
|
|
|
343 |
$conf["variableCheck::checkArguments"]["varInput"]=&$conf;
|
|
|
344 |
#$conf["referenceVarKey"],字串,$conf參數後面的key值,用於移除不要的參考陣列.
|
|
|
345 |
$conf["variableCheck::checkArguments"]["referenceVarKey"]="variableCheck::checkArguments";
|
|
|
346 |
#可以省略的參數:
|
|
|
347 |
#$conf["mustBeFilledVariableName"],爲必填參數的變數名稱陣列，形態爲陣列變數，元素數量需要跟"mustBeFilledVariableType"參數的元素數量一致,例如: $conf["mustBeFilledVariableName"] = array("id","account","password");
|
|
|
348 |
#$conf["mustBeFilledVariableName"]=array();
|
|
|
349 |
#$conf["mustBeFilledVariableType"],爲必填參數的變數陣列應該爲何種變數形態，形態爲陣列,元素數量需要跟"mustBeFilledVariableName"參數的元素數量一致,例如: $conf["mustBeFilledVariableType"] = array("string",integer,"double","resource","object"); , null代表不指定變數形態.
|
|
|
350 |
#$conf["mustBeFilledVariableType"]=array();
|
|
|
351 |
#$conf["canBeEmptyString"],字串,必填變數內容如果是空字串就不能算是有設置的話，請設為"false",預設爲"true",可以為空字串.
|
|
|
352 |
#$conf["canBeEmptyString"]="false";
|
|
|
353 |
#$conf["canNotBeEmpty"],字串陣列,哪些必填參數的內容不得為空字串或空陣列,僅當$conf["canBeEmptyString"]為"true"時會生效.
|
|
|
354 |
#$conf["canNotBeEmpty"]=array();
|
|
|
355 |
#$conf["canBeEmpty"],字串陣列,哪些必填參數的內容可為空字串或空陣列,僅當$conf["canBeEmptyString"]為"false"時會生效.
|
|
|
356 |
#$conf["canBeEmpty"]=array();
|
|
|
357 |
#$conf["skipableVariableCanNotBeEmpty"],字串陣列,哪些可省略參數不可以為空字串或空陣列.
|
|
|
358 |
$conf["variableCheck::checkArguments"]["skipableVariableCanNotBeEmpty"]=array("powerBy","powerByLink","bgColor");
|
|
|
359 |
#$conf["skipableVariableName"],陣列字串,爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableName"] = array("id","account","password");
|
|
|
360 |
$conf["variableCheck::checkArguments"]["skipableVariableName"]=array("name","powerBy","powerByLink","bgColor");
|
|
|
361 |
#$conf["skipableVariableType"],陣列字串,爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableType"] = array("string",integer,"double");
|
|
|
362 |
$conf["variableCheck::checkArguments"]["skipableVariableType"]=array("string","string","string","string");
|
|
|
363 |
#$conf["skipableVarDefaultValue"],字串陣列,每個不存在的可省略變數要初始化為什麼,null與代表不指定,若預設值是參數之一，請將$conf["mustBeFilledVar"]改成"\$conf["\mustBeFilledVar\"]".
|
|
|
364 |
$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"]=array("","QBPWCF","https://www.qbpwcf.org","#DDDDFF");
|
|
|
365 |
#$conf["disallowAllSkipableVarIsEmpty"],字串,是否允許每個可省略參數都為空字串,預設為"true"允許,反之為"false".
|
|
|
366 |
#$conf["disallowAllSkipableVarIsEmpty"]="";
|
|
|
367 |
#$conf["disallowAllSkipableVarIsEmptyArray"],字串,是否允許每個可省略參數都為空陣列,預設為"true"允許,反之為"false".
|
|
|
368 |
#$conf["disallowAllSkipableVarIsEmptyArray"]="";
|
|
|
369 |
#$conf["arrayCountEqualCheck"],字串陣列,為檢查哪些陣列參數的元素數量要一樣,$conf["arrayCountEqualCheck"][$i]=array()為第$i組key為哪些的變數其元素數量要相等.
|
|
|
370 |
#$conf["arrayCountEqualCheck"][]=array();
|
|
|
371 |
#參考資料來源:
|
|
|
372 |
#array_keys=>http://php.net/manual/en/function.array-keys.php
|
|
|
373 |
$checkArguments=variableCheck::checkArguments($conf["variableCheck::checkArguments"]);
|
|
|
374 |
unset($conf["variableCheck::checkArguments"]);
|
| 226 |
liveuser |
375 |
|
| 3 |
liveuser |
376 |
#如果檢查失敗
|
|
|
377 |
if($checkArguments["status"]=="false"){
|
|
|
378 |
|
|
|
379 |
#設置錯誤狀態
|
|
|
380 |
$result["status"]="false";
|
|
|
381 |
|
|
|
382 |
#設置錯誤提示
|
|
|
383 |
$result["error"]=$checkArguments;
|
|
|
384 |
|
|
|
385 |
#回傳結果
|
|
|
386 |
return $result;
|
|
|
387 |
|
|
|
388 |
}#if end
|
|
|
389 |
|
|
|
390 |
#如果檢查不通過
|
|
|
391 |
if($checkArguments["passed"]=="false"){
|
|
|
392 |
|
|
|
393 |
#設置錯誤狀態
|
|
|
394 |
$result["status"]="false";
|
|
|
395 |
|
|
|
396 |
#設置錯誤提示
|
|
|
397 |
$result["error"]=$checkArguments;
|
|
|
398 |
|
|
|
399 |
#回傳結果
|
|
|
400 |
return $result;
|
|
|
401 |
|
|
|
402 |
}#if end
|
| 226 |
liveuser |
403 |
|
| 3 |
liveuser |
404 |
#函式說明:
|
|
|
405 |
#將要執行的script語法透過該函式執行(會在程式外層用<script></script>包起來).
|
|
|
406 |
#回傳結果:
|
|
|
407 |
#$result["status"],執行是否正常,"true"為正常,"false"為不正常.
|
|
|
408 |
#$result["error"],錯誤訊息陣列
|
|
|
409 |
#$result["function"],當前執行的函數名稱
|
|
|
410 |
#$result["content"],要執行的javaScript語法
|
|
|
411 |
#必填參數:
|
|
|
412 |
#$conf["script"],字串,要執行的javaScript語法.
|
|
|
413 |
$conf["javaScript::toScript"]["script"]="
|
| 226 |
liveuser |
414 |
|
|
|
415 |
|
|
|
416 |
|
| 3 |
liveuser |
417 |
var copyRightSpan=document.createElement('span');
|
|
|
418 |
var copyRightText=document.createTextNode('".$conf["name"]."');
|
|
|
419 |
copyRightSpan.appendChild(copyRightText);
|
| 226 |
liveuser |
420 |
|
| 207 |
liveuser |
421 |
//建立power by span
|
| 3 |
liveuser |
422 |
var powerBySpan=document.createElement('span');
|
|
|
423 |
var powerByA=document.createElement('a');
|
|
|
424 |
powerByA.href='".$conf["powerByLink"]."';
|
|
|
425 |
powerByA.target='_blank';
|
|
|
426 |
var powerByText=document.createTextNode('Powered by '+'".$conf["powerBy"]."');
|
|
|
427 |
powerByA.appendChild(powerByText);
|
|
|
428 |
powerBySpan.appendChild(powerByA);
|
| 226 |
liveuser |
429 |
|
| 207 |
liveuser |
430 |
//建立 copy right div
|
|
|
431 |
var copyRightDiv=document.createElement('div');
|
| 3 |
liveuser |
432 |
copyRightDiv.appendChild(copyRightSpan);
|
|
|
433 |
copyRightDiv.appendChild(powerBySpan);
|
|
|
434 |
copyRightDiv.style.backgroundColor='".$conf["bgColor"]."';
|
|
|
435 |
copyRightDiv.style.textAlign='center';
|
| 226 |
liveuser |
436 |
|
| 207 |
liveuser |
437 |
//顯現 copy right
|
| 3 |
liveuser |
438 |
document.body.appendChild(copyRightDiv);
|
| 226 |
liveuser |
439 |
|
| 3 |
liveuser |
440 |
";
|
|
|
441 |
#可省略參數:
|
|
|
442 |
#$conf["onReady"],字串,是否要在網頁完全載入後再執行,"false"為不等載入完就先執行,預設為"true"要等載入完再執行.
|
|
|
443 |
#$conf["onReady"]="true";
|
|
|
444 |
#$conf["globalJs"],字串陣列,為要放入<script>標籤的js全域變數.
|
|
|
445 |
#$conf["globalJs"]=array();
|
|
|
446 |
#$conf["jsFunciton"],字串陣列,為要放入<script>標籤的js函數.
|
|
|
447 |
#$conf["jsFunciton"]=array();
|
|
|
448 |
#參考資料:
|
|
|
449 |
#http://stackoverflow.com/questions/9899372/pure-javascript-equivalent-to-jquerys-ready-how-to-call-a-function-when-the
|
|
|
450 |
$toScript=javaScript::toScript($conf["javaScript::toScript"]);
|
|
|
451 |
unset($conf["javaScript::toScript"]);
|
| 226 |
liveuser |
452 |
|
| 3 |
liveuser |
453 |
#如果建立 javascript 語法失敗
|
| 226 |
liveuser |
454 |
if($toScript["status"]==="false"){
|
|
|
455 |
|
| 3 |
liveuser |
456 |
#設置執行失敗
|
|
|
457 |
$result["status"]="false";
|
| 226 |
liveuser |
458 |
|
| 3 |
liveuser |
459 |
#設置執行錯誤訊息
|
|
|
460 |
$result["error"]=$toScript;
|
|
|
461 |
|
|
|
462 |
#回傳結果
|
| 226 |
liveuser |
463 |
return $result;
|
|
|
464 |
|
| 3 |
liveuser |
465 |
}#if end
|
| 226 |
liveuser |
466 |
|
|
|
467 |
#傳接 content
|
| 3 |
liveuser |
468 |
$result["content"]=$result["content"].$toScript["content"];
|
| 226 |
liveuser |
469 |
|
| 3 |
liveuser |
470 |
#保護版權的語法
|
|
|
471 |
#oncontextmenu,按下滑鼠右鍵
|
|
|
472 |
#onContextMenu,按下滑鼠右鍵
|
|
|
473 |
#ondragstart,開始拖曳
|
|
|
474 |
#onselsect,選取區塊時
|
|
|
475 |
#onselectstart,開始選取區塊
|
|
|
476 |
#onkeydown='if(event.tKey && event.ctrlKey),按下ctrl+t開分頁時
|
|
|
477 |
$result["content"]=$result["content"]."
|
|
|
478 |
<html
|
| 226 |
liveuser |
479 |
oncontextmenu=\"return false\"
|
| 3 |
liveuser |
480 |
onContextMenu=\"window.event.returnValue=false\"
|
|
|
481 |
onselect=\"return false\"
|
| 226 |
liveuser |
482 |
onselectstart=\"return false\"
|
|
|
483 |
ondragstart=\"return false\"
|
| 3 |
liveuser |
484 |
oncopy=\"return false\"
|
|
|
485 |
onbeforeprint=\"return false\"
|
|
|
486 |
>\r\n";
|
| 226 |
liveuser |
487 |
|
| 3 |
liveuser |
488 |
#設置執行正常
|
|
|
489 |
$result["status"]="true";
|
| 226 |
liveuser |
490 |
|
| 3 |
liveuser |
491 |
#回傳語法
|
|
|
492 |
return $result;
|
| 226 |
liveuser |
493 |
|
| 3 |
liveuser |
494 |
}#函式結束
|
|
|
495 |
|
|
|
496 |
/*
|
| 226 |
liveuser |
497 |
#函式說明:
|
| 3 |
liveuser |
498 |
#放置用空白圖片擋住要呈現的圖片
|
|
|
499 |
#回傳結果:
|
|
|
500 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
501 |
#$result["error"],錯誤訊息.
|
|
|
502 |
#$result["function"],當前執行的函數名稱.
|
|
|
503 |
#$result["content"],語法.
|
|
|
504 |
#必填參數:
|
|
|
505 |
$conf["imgAddress"],字串,要放的圖片位置和名稱.
|
|
|
506 |
$conf["imgAddress"]="";
|
|
|
507 |
$conf["imgWidth"],字串,爲圖片的寬.
|
|
|
508 |
$conf["imgWidth"]="";
|
|
|
509 |
$conf["imgHeight"],字串,爲圖片的高.
|
|
|
510 |
$conf["imgHeight"]="";
|
|
|
511 |
$conf["imgLeft"]=,字串,爲圖片放置的位置距離網頁左邊多少.
|
|
|
512 |
$conf["imgLeft"]="";
|
|
|
513 |
$conf["imgTop"]=,字串,爲圖片放置的位置距離網頁頂端多少.
|
|
|
514 |
$conf["imgTop"]="";
|
|
|
515 |
#可省略參數:
|
|
|
516 |
#$conf["useBase64"],字串,是否要用base64的方式呈現圖片,預設為"true"代表要用base64的方式呈現,反之可用"false".
|
|
|
517 |
#$conf["useBase64"]="true";
|
|
|
518 |
#參考資料:
|
|
|
519 |
#無.
|
|
|
520 |
#備註:
|
|
|
521 |
#無.
|
| 226 |
liveuser |
522 |
*/
|
| 3 |
liveuser |
523 |
public static function imgProtect(&$conf){
|
|
|
524 |
|
|
|
525 |
#初始化要回傳的內容
|
|
|
526 |
$result=array();
|
| 226 |
liveuser |
527 |
|
| 3 |
liveuser |
528 |
#取得當前執行的函式
|
|
|
529 |
$result["function"]=__FUNCTION__;
|
| 226 |
liveuser |
530 |
|
| 3 |
liveuser |
531 |
#如果 $conf 不為陣列
|
|
|
532 |
if(gettype($conf)!="array"){
|
| 226 |
liveuser |
533 |
|
| 3 |
liveuser |
534 |
#設置執行失敗
|
|
|
535 |
$result["status"]="false";
|
| 226 |
liveuser |
536 |
|
| 3 |
liveuser |
537 |
#設置執行錯誤訊息
|
|
|
538 |
$result["error"][]="\$conf變數須為陣列形態";
|
|
|
539 |
|
|
|
540 |
#如果傳入的參數為 null
|
|
|
541 |
if($conf==null){
|
| 226 |
liveuser |
542 |
|
| 3 |
liveuser |
543 |
#設置執行錯誤訊息
|
|
|
544 |
$result["error"][]="\$conf變數不得為null,請檢查函數「".$result["function"]."」的參數設置有無正確!";
|
| 226 |
liveuser |
545 |
|
| 3 |
liveuser |
546 |
}#if end
|
|
|
547 |
|
|
|
548 |
#回傳結果
|
|
|
549 |
return $result;
|
| 226 |
liveuser |
550 |
|
| 3 |
liveuser |
551 |
}#if end
|
|
|
552 |
|
|
|
553 |
#初始化程式碼
|
|
|
554 |
$result["content"]="";
|
| 226 |
liveuser |
555 |
|
| 3 |
liveuser |
556 |
#檢查參數
|
|
|
557 |
#函式說明：
|
|
|
558 |
#檢查必填與可省略的參數，可省略參數可指定預設要給與什麼數值內容。
|
|
|
559 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
560 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
561 |
#$result["function"],當前執行的函式名稱.
|
|
|
562 |
#$result["passed"],識別要檢查的全體變數是否存在以及型態是否正確的變數,"true"代表檢查全部通過;"false"代表檢查不通過
|
|
|
563 |
#$result[$shouldBtCheckedVarName]["varExist"],所檢查的變數是否存在,"false"代表不存在;"true"代表存在
|
|
|
564 |
#$result[$shouldBtCheckedVarName]["varType"],所檢查的變數型態是否正確,"false"代表錯誤;"true"代表正確
|
|
|
565 |
#$result[$shouldBtCheckedVarName]["error"],每個參數設定的錯誤訊息
|
|
|
566 |
#$result["argu"],字串陣列,目前輸入的參數名稱陣列.
|
|
|
567 |
#$result["legalVarName"],字串陣列,合法可用的參數名稱陣列.
|
|
|
568 |
#$result["notNeedVar"],字串陣列,多餘的參數名稱.
|
|
|
569 |
#必填寫的參數：
|
|
|
570 |
#$conf["variableCheck::checkArguments"]["varInput"],陣列變數,要檢查的陣列變數,請在要檢查的參數前面加上&，這樣變動的結果才能被套用。
|
|
|
571 |
$conf["variableCheck::checkArguments"]["varInput"]=&$conf;
|
|
|
572 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"],爲必填參數的變數名稱陣列，形態爲陣列變數，元素數量需要跟"mustBeFilledVariableType"參數的元素數量一致,例如: $conf["mustBeFilledVariableName"] = array("id","account","password");
|
|
|
573 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"]=array("imgAddress","imgWidth","imgHeight","imgLeft","imgTop");
|
| 226 |
liveuser |
574 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"],爲必填參數的變數陣列應該爲何種變數形態，形態爲陣列,元素數量需要跟"mustBeFilledVariableName"參數的元素數量一致,例如: $conf["mustBeFilledVariableType"] = array("string",integer,"double","resource","object");
|
| 3 |
liveuser |
575 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"]=array("string","string","string","string","string");
|
|
|
576 |
#$conf["variableCheck::checkArguments"]["referenceVarKey"],字串,$conf參數後面的key值,用於移除不要的參考陣列.
|
|
|
577 |
$conf["variableCheck::checkArguments"]["referenceVarKey"]="variableCheck::checkArguments";
|
|
|
578 |
#可以省略的參數：
|
|
|
579 |
#$conf["canBeEmptyString"],必填變數內容如果是空字串就不能算是有設置的話，請設為"false",預設爲"true"。
|
|
|
580 |
#$conf["canBeEmptyString"]="false";
|
|
|
581 |
#$conf["variableCheck::checkArguments"]["skipableVariableName"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableName"] = array("id","account","password");
|
|
|
582 |
$conf["variableCheck::checkArguments"]["skipableVariableName"]=array("useBase64");
|
| 226 |
liveuser |
583 |
#$conf["variableCheck::checkArguments"]["skipableVariableType"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableType"] = array("string",integer,"double");
|
| 3 |
liveuser |
584 |
$conf["variableCheck::checkArguments"]["skipableVariableType"]=array("string");
|
|
|
585 |
#$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"],字串陣列,每個不存在的可省略變數要初始化為什麼,null與代表不指定,若預設值是參數之一，請將$conf["mustBeFilledVar"]改成"\$conf["\mustBeFilledVar\"]".
|
|
|
586 |
$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"]=array("true");
|
|
|
587 |
#$conf["arrayCountEqualCheck"],字串陣列,為檢查哪些陣列參數的元素數量要一樣,$conf["arrayCountEqualCheck"][$i]=array()為第$i組key為哪些的變數其元素數量要相等.
|
|
|
588 |
#$conf["arrayCountEqualCheck"][]=array();
|
|
|
589 |
#參考資料來源:
|
|
|
590 |
#array_keys=>http://php.net/manual/en/function.array-keys.php
|
|
|
591 |
$checkArguments=variableCheck::checkArguments($conf["variableCheck::checkArguments"]);
|
|
|
592 |
unset($conf["variableCheck::checkArguments"]);
|
| 226 |
liveuser |
593 |
|
| 3 |
liveuser |
594 |
#如果檢查失敗
|
|
|
595 |
if($checkArguments["status"]=="false"){
|
| 226 |
liveuser |
596 |
|
| 3 |
liveuser |
597 |
#設置執行失敗
|
|
|
598 |
$result["status"]="false";
|
| 226 |
liveuser |
599 |
|
| 3 |
liveuser |
600 |
#設置執行錯誤訊息
|
|
|
601 |
$result["error"]=$checkArguments;
|
|
|
602 |
|
|
|
603 |
#回傳結果
|
|
|
604 |
return $result;
|
| 226 |
liveuser |
605 |
|
|
|
606 |
}#if end
|
|
|
607 |
|
| 3 |
liveuser |
608 |
#如果檢查不通過
|
|
|
609 |
if($checkArguments["passed"]=="false"){
|
| 226 |
liveuser |
610 |
|
| 3 |
liveuser |
611 |
#設置執行失敗
|
|
|
612 |
$result["status"]="false";
|
| 226 |
liveuser |
613 |
|
| 3 |
liveuser |
614 |
#設置執行錯誤訊息
|
|
|
615 |
$result["error"]=$checkArguments;
|
|
|
616 |
|
|
|
617 |
#回傳結果
|
|
|
618 |
return $result;
|
| 226 |
liveuser |
619 |
|
| 3 |
liveuser |
620 |
}#if end
|
|
|
621 |
|
|
|
622 |
#建立要放置的圖片樣式
|
| 226 |
liveuser |
623 |
#函式說明:
|
| 3 |
liveuser |
624 |
#創建 css 樣式
|
|
|
625 |
#回傳結果：
|
|
|
626 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
627 |
#$result["css"],css設定內容
|
|
|
628 |
#$result["function"],當前執行的函數
|
| 226 |
liveuser |
629 |
#$result["error"],涵式錯誤訊息，若爲""則表示沒有錯誤
|
| 3 |
liveuser |
630 |
$conf["css"]["createCssStyle"]["cssStyleName"]="imgStyle-".$conf["imgLeft"].$conf["imgTop"];
|
|
|
631 |
$conf["css"]["createCssStyle"]["attributes"]=array("width","height","position","top","left");
|
|
|
632 |
$conf["css"]["createCssStyle"]["content"]=array($conf["imgWidth"],$conf["imgHeight"],"absolute",$conf["imgTop"],$conf["imgLeft"]);
|
|
|
633 |
$css=css::createCssStyle($conf["css"]["createCssStyle"]);
|
|
|
634 |
unset($conf["css"]["createCssStyle"]);#清空變數避免出錯
|
| 226 |
liveuser |
635 |
|
| 3 |
liveuser |
636 |
#如果建立css樣式失敗
|
|
|
637 |
if($css["status"]=="false"){
|
| 226 |
liveuser |
638 |
|
| 3 |
liveuser |
639 |
#設置執行失敗
|
|
|
640 |
$result["status"]="false";
|
| 226 |
liveuser |
641 |
|
| 3 |
liveuser |
642 |
#設置執行錯誤訊息
|
|
|
643 |
$result["error"]=$css;
|
|
|
644 |
|
|
|
645 |
#回傳結果
|
|
|
646 |
return $result;
|
| 226 |
liveuser |
647 |
|
| 3 |
liveuser |
648 |
}#if end
|
| 226 |
liveuser |
649 |
|
| 3 |
liveuser |
650 |
#串接css語法
|
|
|
651 |
$result["content"]=$result["content"].$css["css"];
|
|
|
652 |
|
|
|
653 |
#如果要用base64顯示圖片
|
|
|
654 |
if($conf["useBase64"]=="true"){
|
| 226 |
liveuser |
655 |
|
| 3 |
liveuser |
656 |
#將圖片用base64加密呈現
|
|
|
657 |
#函數說明:
|
|
|
658 |
#用data:mimeType;base64,imgVar的形式來提供圖片的連結,亦即圖片儲存在變數裡面,本函式包含顯示圖片的語法.
|
|
|
659 |
#回傳結果:
|
|
|
660 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
661 |
#$result["error"],錯誤訊息
|
|
|
662 |
#$result["content"],圖片的連結資訊
|
| 226 |
liveuser |
663 |
#$result["function"],當前執行的函數名稱
|
| 3 |
liveuser |
664 |
#必填參數:
|
|
|
665 |
#$conf["img::data"]["imgPosition"],要轉存成2元碼的圖片檔案位置與名稱
|
|
|
666 |
$conf["img::data"]["imgPosition"]=$conf["imgAddress"];
|
|
|
667 |
#可省略參數:
|
|
|
668 |
#$conf["img::data"]["alt"],若沒有圖片要用什麼文字顯示。
|
|
|
669 |
$conf["img::data"]["alt"]="not found";
|
|
|
670 |
#$conf["img::data"]["class"],圖片要套用的css樣式名稱.
|
|
|
671 |
$conf["img::data"]["class"]="imgStyle-".$conf["imgLeft"].$conf["imgTop"];
|
|
|
672 |
#$conf["mimeType"],2元碼的內容是什麼,預設為"image/*".
|
|
|
673 |
#$conf["mimeType"]="image/*";
|
|
|
674 |
#$conf["compressType"],2元碼壓縮的方式,預設為"base64".
|
|
|
675 |
#$conf["compressType"]="base64";
|
|
|
676 |
#$conf["delImg"],讀取完圖片檔案後,要移除圖片嗎？"true"代表要移除,"false"代表不要移除,預設為"false".
|
|
|
677 |
#$conf["delImg"]="false";
|
|
|
678 |
#參考資料:
|
|
|
679 |
#將檔案用字串變數儲存起來=>http://php.net/manual/en/function.file-get-contents.php
|
|
|
680 |
#壓縮2元碼=>http://php.net/manual/en/function.base64-encode.php
|
|
|
681 |
$data=img::data($conf["img::data"]);
|
|
|
682 |
unset($conf["img::data"]);
|
|
|
683 |
|
|
|
684 |
#將圖片用base64加密呈現失敗
|
|
|
685 |
if($data["status"]=="false"){
|
| 226 |
liveuser |
686 |
|
| 3 |
liveuser |
687 |
#設置執行失敗
|
|
|
688 |
$result["status"]="false";
|
| 226 |
liveuser |
689 |
|
| 3 |
liveuser |
690 |
#設置執行錯誤訊息
|
|
|
691 |
$result["error"]=$data;
|
|
|
692 |
|
|
|
693 |
#回傳結果
|
|
|
694 |
return $result;
|
| 226 |
liveuser |
695 |
|
| 3 |
liveuser |
696 |
}#if end
|
| 226 |
liveuser |
697 |
|
| 3 |
liveuser |
698 |
#取得用base64放置圖片的語法
|
|
|
699 |
$result["content"]=$result["content"].$data["content"];
|
| 226 |
liveuser |
700 |
|
| 3 |
liveuser |
701 |
}#if end
|
|
|
702 |
|
|
|
703 |
#反之為一般放置圖片的方式
|
|
|
704 |
else{
|
| 226 |
liveuser |
705 |
|
| 3 |
liveuser |
706 |
#放置要放的圖片
|
|
|
707 |
#函式說明:
|
|
|
708 |
#放置可以套用css樣式的圖片
|
|
|
709 |
#回傳結果：
|
|
|
710 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
711 |
#$result["error"],錯誤訊息陣列
|
|
|
712 |
#$result["function"],當前函數執行的名稱
|
| 226 |
liveuser |
713 |
#$result["content"],印出圖片的語法。
|
| 3 |
liveuser |
714 |
$conf["img"]["show"]["position"]=$conf["imgAddress"];
|
|
|
715 |
$conf["img"]["show"]["alt"]="not found";
|
|
|
716 |
$conf["img"]["show"]["class"]="imgStyle-".$conf["imgLeft"].$conf["imgTop"];
|
|
|
717 |
$show=img::show($conf["img"]["show"]);
|
|
|
718 |
unset($conf["img"]["show"]);#清空變數避免出錯
|
|
|
719 |
|
|
|
720 |
#如果放置圖片的語法建立失敗
|
|
|
721 |
if($show["status"]=="false"){
|
| 226 |
liveuser |
722 |
|
| 3 |
liveuser |
723 |
#設置執行失敗
|
|
|
724 |
$result["status"]="false";
|
| 226 |
liveuser |
725 |
|
| 3 |
liveuser |
726 |
#設置執行錯誤訊息
|
|
|
727 |
$result["error"]=$show;
|
|
|
728 |
|
|
|
729 |
#回傳結果
|
|
|
730 |
return $result;
|
| 226 |
liveuser |
731 |
|
| 3 |
liveuser |
732 |
}#if end
|
| 226 |
liveuser |
733 |
|
| 3 |
liveuser |
734 |
#串接顯示圖片的語法
|
|
|
735 |
$result["content"]=$result["content"].$show["content"];
|
| 226 |
liveuser |
736 |
|
| 3 |
liveuser |
737 |
}#else end
|
|
|
738 |
|
|
|
739 |
#建立圖片隔離層樣式
|
|
|
740 |
$conf["css"]["createCssStyle"]["cssStyleName"]="imgIsolationLayerStyle".$conf["imgLeft"].$conf["imgTop"];
|
|
|
741 |
$conf["css"]["createCssStyle"]["attributes"]=array("width","height","opacity","position","top","left");
|
|
|
742 |
$conf["css"]["createCssStyle"]["content"]=array($conf["imgWidth"],$conf["imgHeight"],".0","absolute",$conf["imgTop"],$conf["imgLeft"]);
|
|
|
743 |
$css=css::createCssStyle($conf["css"]["createCssStyle"]);
|
|
|
744 |
unset($conf["css"]["createCssStyle"]);#清空變數避免出錯
|
| 226 |
liveuser |
745 |
|
| 3 |
liveuser |
746 |
#如果建立css樣式失敗
|
|
|
747 |
if($css["status"]=="false"){
|
| 226 |
liveuser |
748 |
|
| 3 |
liveuser |
749 |
#設置執行失敗
|
|
|
750 |
$result["status"]="false";
|
| 226 |
liveuser |
751 |
|
| 3 |
liveuser |
752 |
#設置執行錯誤訊息
|
|
|
753 |
$result["error"]=$css;
|
|
|
754 |
|
|
|
755 |
#回傳結果
|
|
|
756 |
return $result;
|
| 226 |
liveuser |
757 |
|
| 3 |
liveuser |
758 |
}#if end
|
| 226 |
liveuser |
759 |
|
| 3 |
liveuser |
760 |
#取得圖片隔離層樣式程式碼
|
|
|
761 |
$result["content"]=$result["content"].$css["css"];
|
|
|
762 |
|
|
|
763 |
#放置隔離層
|
|
|
764 |
#函式說明:
|
|
|
765 |
#放置可以套用css樣式的圖片
|
|
|
766 |
#回傳結果：
|
|
|
767 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
768 |
#$result["error"],錯誤訊息陣列
|
|
|
769 |
#$result["function"],當前函數執行的名稱
|
| 226 |
liveuser |
770 |
#$result["content"],印出圖片的語法。
|
| 3 |
liveuser |
771 |
#必填參數:
|
|
|
772 |
$conf["img"]["show"]["position"]="copyRight.png";#圖片位置
|
|
|
773 |
#可省略參數:
|
|
|
774 |
#$conf["img"]["show"]["alt"]="not found";#若沒有圖片要用什麼文字顯示。
|
|
|
775 |
$conf["img"]["show"]["class"]="imgIsolationLayerStyle".$conf["imgLeft"].$conf["imgTop"];#要套用的css樣式類別名稱。
|
|
|
776 |
$show=img::show($conf["img"]["show"]);
|
|
|
777 |
unset($conf["img"]["show"]);
|
| 226 |
liveuser |
778 |
|
| 3 |
liveuser |
779 |
#如果放置圖片的語法建立失敗
|
|
|
780 |
if($show["status"]=="false"){
|
| 226 |
liveuser |
781 |
|
| 3 |
liveuser |
782 |
#設置執行失敗
|
|
|
783 |
$result["status"]="false";
|
| 226 |
liveuser |
784 |
|
| 3 |
liveuser |
785 |
#設置執行錯誤訊息
|
|
|
786 |
$result["error"]=$show;
|
|
|
787 |
|
|
|
788 |
#回傳結果
|
|
|
789 |
return $result;
|
| 226 |
liveuser |
790 |
|
| 3 |
liveuser |
791 |
}#if end
|
| 226 |
liveuser |
792 |
|
| 3 |
liveuser |
793 |
#串接顯示隔離層圖片的語法
|
|
|
794 |
$result["content"]=$result["content"].$show["content"];
|
|
|
795 |
|
|
|
796 |
#執行到這邊代表執行成功
|
|
|
797 |
$result["status"]="true";
|
| 226 |
liveuser |
798 |
|
| 3 |
liveuser |
799 |
#回傳語法
|
|
|
800 |
return $result;
|
|
|
801 |
|
|
|
802 |
}#function imgProtect end
|
|
|
803 |
|
|
|
804 |
/*
|
|
|
805 |
#函式說明:
|
|
|
806 |
#加密php檔案的內容將結果輸出.
|
|
|
807 |
#回傳結果:
|
|
|
808 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
809 |
#$result["error"],錯誤訊息陣列.
|
|
|
810 |
#$result["function"],當前執行的函式名稱.
|
|
|
811 |
#$result["content"],加密好的php內容字串.
|
|
|
812 |
#必填參數:
|
|
|
813 |
#$conf["phpFile"],字串,要加密的php檔案位置與名稱.
|
|
|
814 |
$conf["phpFile"]="";
|
|
|
815 |
#$conf["fileArgu"],字串,php變數__FILE__的內容,亦即該檔案在檔案系統的絕對路徑
|
|
|
816 |
$conf["fileArgu"]=__FILE__;
|
|
|
817 |
#可省略參數:
|
|
|
818 |
#無.
|
|
|
819 |
#參考資料:
|
|
|
820 |
#無.
|
|
|
821 |
#備註:
|
|
|
822 |
#僅支援單行只出現<?php、?>、其他內容的PHP檔案格式內容.
|
|
|
823 |
*/
|
|
|
824 |
public static function encodePHP(&$conf){
|
| 226 |
liveuser |
825 |
|
| 3 |
liveuser |
826 |
#初始化要回傳的內容
|
|
|
827 |
$result=array();
|
| 226 |
liveuser |
828 |
|
| 3 |
liveuser |
829 |
#取得當前執行的函式
|
|
|
830 |
$result["function"]=__FUNCTION__;
|
| 226 |
liveuser |
831 |
|
| 3 |
liveuser |
832 |
#如果 $conf 不為陣列
|
|
|
833 |
if(gettype($conf)!="array"){
|
| 226 |
liveuser |
834 |
|
| 3 |
liveuser |
835 |
#設置執行失敗
|
|
|
836 |
$result["status"]="false";
|
| 226 |
liveuser |
837 |
|
| 3 |
liveuser |
838 |
#設置執行錯誤訊息
|
|
|
839 |
$result["error"][]="\$conf變數須為陣列形態";
|
|
|
840 |
|
|
|
841 |
#如果傳入的參數為 null
|
|
|
842 |
if($conf==null){
|
| 226 |
liveuser |
843 |
|
| 3 |
liveuser |
844 |
#設置執行錯誤訊息
|
|
|
845 |
$result["error"][]="\$conf變數不得為null,請檢查函數「".$result["function"]."」的參數設置有無正確!";
|
| 226 |
liveuser |
846 |
|
| 3 |
liveuser |
847 |
}#if end
|
|
|
848 |
|
|
|
849 |
#回傳結果
|
|
|
850 |
return $result;
|
| 226 |
liveuser |
851 |
|
| 3 |
liveuser |
852 |
}#if end
|
|
|
853 |
|
|
|
854 |
#初始加密好的php程式內容
|
|
|
855 |
$result["content"]="";
|
| 226 |
liveuser |
856 |
|
| 3 |
liveuser |
857 |
#檢查參數
|
|
|
858 |
#函式說明：
|
|
|
859 |
#檢查必填與可省略的參數，可省略參數可指定預設要給與什麼數值內容。
|
|
|
860 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
861 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
862 |
#$result["function"],當前執行的函式名稱.
|
|
|
863 |
#$result["passed"],識別要檢查的全體變數是否存在以及型態是否正確的變數,"true"代表檢查全部通過;"false"代表檢查不通過
|
|
|
864 |
#$result[$shouldBtCheckedVarName]["varExist"],所檢查的變數是否存在,"false"代表不存在;"true"代表存在
|
|
|
865 |
#$result[$shouldBtCheckedVarName]["varType"],所檢查的變數型態是否正確,"false"代表錯誤;"true"代表正確
|
|
|
866 |
#$result[$shouldBtCheckedVarName]["error"],每個參數設定的錯誤訊息
|
|
|
867 |
#$result["argu"],字串陣列,目前輸入的參數名稱陣列.
|
|
|
868 |
#$result["legalVarName"],字串陣列,合法可用的參數名稱陣列.
|
|
|
869 |
#$result["notNeedVar"],字串陣列,多餘的參數名稱.
|
|
|
870 |
#必填寫的參數：
|
|
|
871 |
#$conf["variableCheck::checkArguments"]["varInput"],陣列變數,要檢查的陣列變數,請在要檢查的參數前面加上&，這樣變動的結果才能被套用。
|
|
|
872 |
$conf["variableCheck::checkArguments"]["varInput"]=&$conf;
|
|
|
873 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"],爲必填參數的變數名稱陣列，形態爲陣列變數，元素數量需要跟"mustBeFilledVariableType"參數的元素數量一致,例如: $conf["mustBeFilledVariableName"] = array("id","account","password");
|
|
|
874 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableName"]=array("phpFile","fileArgu");
|
| 226 |
liveuser |
875 |
#$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"],爲必填參數的變數陣列應該爲何種變數形態，形態爲陣列,元素數量需要跟"mustBeFilledVariableName"參數的元素數量一致,例如: $conf["mustBeFilledVariableType"] = array("string",integer,"double","resource","object");
|
| 3 |
liveuser |
876 |
$conf["variableCheck::checkArguments"]["mustBeFilledVariableType"]=array("string","string");
|
|
|
877 |
#$conf["variableCheck::checkArguments"]["referenceVarKey"],字串,$conf參數後面的key值,用於移除不要的參考陣列.
|
|
|
878 |
$conf["variableCheck::checkArguments"]["referenceVarKey"]="variableCheck::checkArguments";
|
|
|
879 |
#可以省略的參數：
|
|
|
880 |
#$conf["canBeEmptyString"],必填變數內容如果是空字串就不能算是有設置的話，請設為"false",預設爲"true"。
|
|
|
881 |
#$conf["canBeEmptyString"]="false";
|
|
|
882 |
#$conf["variableCheck::checkArguments"]["skipableVariableName"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableName"] = array("id","account","password");
|
|
|
883 |
#$conf["variableCheck::checkArguments"]["skipableVariableName"]=array("useBase64");
|
| 226 |
liveuser |
884 |
#$conf["variableCheck::checkArguments"]["skipableVariableType"],爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableType"] = array("string",integer,"double");
|
| 3 |
liveuser |
885 |
#$conf["variableCheck::checkArguments"]["skipableVariableType"]=array("string");
|
|
|
886 |
#$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"],字串陣列,每個不存在的可省略變數要初始化為什麼,null與代表不指定,若預設值是參數之一，請將$conf["mustBeFilledVar"]改成"\$conf["\mustBeFilledVar\"]".
|
|
|
887 |
#$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"]=array("true");
|
|
|
888 |
#$conf["arrayCountEqualCheck"],字串陣列,為檢查哪些陣列參數的元素數量要一樣,$conf["arrayCountEqualCheck"][$i]=array()為第$i組key為哪些的變數其元素數量要相等.
|
|
|
889 |
#$conf["arrayCountEqualCheck"][]=array();
|
|
|
890 |
#參考資料來源:
|
|
|
891 |
#array_keys=>http://php.net/manual/en/function.array-keys.php
|
|
|
892 |
$checkArguments=variableCheck::checkArguments($conf["variableCheck::checkArguments"]);
|
|
|
893 |
unset($conf["variableCheck::checkArguments"]);
|
| 226 |
liveuser |
894 |
|
| 3 |
liveuser |
895 |
#如果檢查失敗
|
|
|
896 |
if($checkArguments["status"]=="false"){
|
| 226 |
liveuser |
897 |
|
| 3 |
liveuser |
898 |
#設置執行失敗
|
|
|
899 |
$result["status"]="false";
|
| 226 |
liveuser |
900 |
|
| 3 |
liveuser |
901 |
#設置執行錯誤訊息
|
|
|
902 |
$result["error"]=$checkArguments;
|
|
|
903 |
|
|
|
904 |
#回傳結果
|
|
|
905 |
return $result;
|
| 226 |
liveuser |
906 |
|
|
|
907 |
}#if end
|
|
|
908 |
|
| 3 |
liveuser |
909 |
#如果檢查不通過
|
|
|
910 |
if($checkArguments["passed"]=="false"){
|
| 226 |
liveuser |
911 |
|
| 3 |
liveuser |
912 |
#設置執行失敗
|
|
|
913 |
$result["status"]="false";
|
| 226 |
liveuser |
914 |
|
| 3 |
liveuser |
915 |
#設置執行錯誤訊息
|
|
|
916 |
$result["error"]=$checkArguments;
|
|
|
917 |
|
|
|
918 |
#回傳結果
|
|
|
919 |
return $result;
|
| 226 |
liveuser |
920 |
|
| 3 |
liveuser |
921 |
}#if end
|
| 226 |
liveuser |
922 |
|
| 3 |
liveuser |
923 |
#函式說明：
|
|
|
924 |
#依據行號分隔抓取檔案的內容,結果會回傳一個陣列
|
|
|
925 |
#回傳的變數說明:
|
|
|
926 |
#$result["status"],執行是否成功，"true"代表成功；"fasle"代表失敗.
|
|
|
927 |
#$result["error"],錯誤訊息提示.
|
|
|
928 |
#$result["warning"],警告訊息.
|
|
|
929 |
#$result["function"],當前執行的函數名稱.
|
|
|
930 |
#$result["fileContent"],爲檔案的內容陣列.
|
|
|
931 |
#$result["lineCount"],爲檔案內容總共的行數.
|
|
|
932 |
#$result["fullContent"],為檔案的完整內容.
|
|
|
933 |
#$result["base64data"],為檔案的base64內容.
|
|
|
934 |
#$result["mimeType"],為檔案的mime type.
|
|
|
935 |
#必填參數:
|
|
|
936 |
#$conf["filePositionAndName"],字串,爲檔案的位置以及名稱.
|
|
|
937 |
$conf["fileAccess::getFileContent"]["filePositionAndName"]=$conf["phpFile"];
|
|
|
938 |
#$conf["fileArgu"],字串,php變數__FILE__的內容,亦即該檔案在檔案系統的絕對路徑
|
|
|
939 |
$conf["fileAccess::getFileContent"]["fileArgu"]=$conf["fileArgu"];
|
|
|
940 |
#可省略參數:
|
|
|
941 |
#$conf["web"],是要取得網路上的檔案則為"true";反之則為"false".
|
|
|
942 |
$conf["fileAccess::getFileContent"]["web"]="false";
|
|
|
943 |
#參考資料：
|
|
|
944 |
#file(),取得檔案內容的行數.
|
|
|
945 |
#file=>http:#php.net/manual/en/function.file.php
|
|
|
946 |
#rtrim(),剔除透過file()取得每行內容結尾的換行符號.
|
|
|
947 |
#filesize=>http://php.net/manual/en/function.filesize.php
|
|
|
948 |
$getFileContent=fileAccess::getFileContent($conf["fileAccess::getFileContent"]);
|
|
|
949 |
unset($conf["fileAccess::getFileContent"]);
|
| 226 |
liveuser |
950 |
|
| 3 |
liveuser |
951 |
#如果讀取檔案內容失敗
|
|
|
952 |
if($getFileContent["status"]==="false"){
|
| 226 |
liveuser |
953 |
|
| 3 |
liveuser |
954 |
#設置執行失敗
|
|
|
955 |
$result["status"]="false";
|
| 226 |
liveuser |
956 |
|
| 3 |
liveuser |
957 |
#設置執行錯誤訊息
|
|
|
958 |
$result["error"]=$getFileContent;
|
|
|
959 |
|
|
|
960 |
#回傳結果
|
|
|
961 |
return $result;
|
| 226 |
liveuser |
962 |
|
| 3 |
liveuser |
963 |
}#if end
|
| 226 |
liveuser |
964 |
|
| 3 |
liveuser |
965 |
#加密過後的php內容
|
|
|
966 |
$contentWithoutPhpTagArray=array();
|
| 226 |
liveuser |
967 |
|
| 3 |
liveuser |
968 |
#識別是否開始php語法了.
|
|
|
969 |
$isPHP=false;
|
| 226 |
liveuser |
970 |
|
| 3 |
liveuser |
971 |
#識別是否讀取到php tag開頭
|
|
|
972 |
$phpStart=false;
|
| 226 |
liveuser |
973 |
|
| 3 |
liveuser |
974 |
#識別是否讀取到php tag結尾
|
|
|
975 |
$phpEed=true;
|
| 226 |
liveuser |
976 |
|
| 3 |
liveuser |
977 |
#針對每行內容
|
|
|
978 |
foreach($getFileContent["fileContent"] as $index=>$line){
|
| 226 |
liveuser |
979 |
|
| 3 |
liveuser |
980 |
#debug
|
|
|
981 |
#echo "處理第".($index+1)."行".PHP_EOL;
|
| 226 |
liveuser |
982 |
|
| 3 |
liveuser |
983 |
#函式說明:
|
|
|
984 |
#將固定格式的字串分開，並回傳分開的結果。
|
|
|
985 |
#回傳結果:
|
|
|
986 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
987 |
#$result["error"],錯誤訊息陣列
|
|
|
988 |
#$result["function"],當前執行的函數名稱.
|
|
|
989 |
#$result["argu"],使用的參數.
|
|
|
990 |
#$result["oriStr"],要分割的原始字串內容
|
|
|
991 |
#$result["dataArray"],爲分割好字串的陣列內容,$result["dataArray"][$i]爲第($i+1)段的內容。
|
|
|
992 |
#$result["dataCounts"],爲總共分成幾段
|
|
|
993 |
#$result["found"],是否有在$conf["stringIn"]找到$conf["spiltSymbol"],"true"代表有找到,"false"代表沒有找到.
|
|
|
994 |
#必填的參數:
|
|
|
995 |
#$conf["stringIn"],字串,要處理的字串.
|
|
|
996 |
$conf["stringProcess::spiltString"]["stringIn"]=$line;
|
|
|
997 |
#$conf["spiltSymbol"],字串,爲以哪個符號作爲分割.
|
|
|
998 |
$conf["stringProcess::spiltString"]["spiltSymbol"]="<?php";
|
|
|
999 |
#可省略參數:
|
|
|
1000 |
#$conf["allowEmptyStr"],是否允許分割出來空字串,預設為"false"不允許;"true"代表允許.
|
|
|
1001 |
$conf["stringProcess::spiltString"]["allowEmptyStr"]="false";
|
|
|
1002 |
$spiltString=stringProcess::spiltString($conf["stringProcess::spiltString"]);
|
|
|
1003 |
unset($conf["stringProcess::spiltString"]);
|
|
|
1004 |
|
|
|
1005 |
#如果執行失敗
|
|
|
1006 |
if($spiltString["status"]==="false"){
|
| 226 |
liveuser |
1007 |
|
| 3 |
liveuser |
1008 |
#設置執行失敗
|
|
|
1009 |
$result["status"]="false";
|
| 226 |
liveuser |
1010 |
|
| 3 |
liveuser |
1011 |
#設置執行錯誤訊息
|
|
|
1012 |
$result["error"]=$spiltString;
|
|
|
1013 |
|
|
|
1014 |
#回傳結果
|
|
|
1015 |
return $result;
|
| 226 |
liveuser |
1016 |
|
| 3 |
liveuser |
1017 |
}#if end
|
| 226 |
liveuser |
1018 |
|
| 3 |
liveuser |
1019 |
#初始化該行的資訊描述
|
|
|
1020 |
$lineInfo=array();
|
| 226 |
liveuser |
1021 |
|
| 3 |
liveuser |
1022 |
#如果沒有關鍵字
|
|
|
1023 |
if($spiltString["found"]==="false" && $isPHP===false){
|
| 226 |
liveuser |
1024 |
|
| 3 |
liveuser |
1025 |
#初始化暫存的資訊
|
|
|
1026 |
$tempLineInfo=array();
|
| 226 |
liveuser |
1027 |
|
| 3 |
liveuser |
1028 |
#預設該行不是php的內容
|
|
|
1029 |
$tempLineInfo["isPHP"]=false;
|
| 226 |
liveuser |
1030 |
|
| 3 |
liveuser |
1031 |
#放置內容
|
|
|
1032 |
$tempLineInfo["content"]=$line;
|
| 226 |
liveuser |
1033 |
|
| 3 |
liveuser |
1034 |
#儲存一行資訊描述
|
|
|
1035 |
$lineInfo[]=$tempLineInfo;
|
| 226 |
liveuser |
1036 |
|
| 3 |
liveuser |
1037 |
}#if end
|
|
|
1038 |
|
|
|
1039 |
#反之有關鍵字且 現在是屬於 php 的範圍
|
|
|
1040 |
else if($spiltString["found"]==="false" && $isPHP===true){
|
| 226 |
liveuser |
1041 |
|
| 3 |
liveuser |
1042 |
#確認該段目前沒有 "?".">" 結尾
|
| 226 |
liveuser |
1043 |
|
| 3 |
liveuser |
1044 |
#函式說明:
|
|
|
1045 |
#將固定格式的字串分開，並回傳分開的結果。
|
|
|
1046 |
#回傳結果:
|
|
|
1047 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1048 |
#$result["error"],錯誤訊息陣列
|
|
|
1049 |
#$result["function"],當前執行的函數名稱.
|
|
|
1050 |
#$result["argu"],使用的參數.
|
|
|
1051 |
#$result["oriStr"],要分割的原始字串內容
|
|
|
1052 |
#$result["dataArray"],爲分割好字串的陣列內容,$result["dataArray"][$i]爲第($i+1)段的內容。
|
|
|
1053 |
#$result["dataCounts"],爲總共分成幾段
|
|
|
1054 |
#$result["found"],是否有在$conf["stringIn"]找到$conf["spiltSymbol"],"true"代表有找到,"false"代表沒有找到.
|
|
|
1055 |
#必填的參數:
|
|
|
1056 |
#$conf["stringIn"],字串,要處理的字串.
|
|
|
1057 |
$conf["stringProcess::spiltString"]["stringIn"]=$line;
|
|
|
1058 |
#$conf["spiltSymbol"],字串,爲以哪個符號作爲分割.
|
|
|
1059 |
$conf["stringProcess::spiltString"]["spiltSymbol"]="?>";
|
|
|
1060 |
#可省略參數:
|
|
|
1061 |
#$conf["allowEmptyStr"],是否允許分割出來空字串,預設為"false"不允許;"true"代表允許.
|
|
|
1062 |
$conf["stringProcess::spiltString"]["allowEmptyStr"]="false";
|
|
|
1063 |
$spiltString=stringProcess::spiltString($conf["stringProcess::spiltString"]);
|
|
|
1064 |
unset($conf["stringProcess::spiltString"]);
|
|
|
1065 |
|
|
|
1066 |
#如果執行失敗
|
|
|
1067 |
if($spiltString["status"]==="false"){
|
| 226 |
liveuser |
1068 |
|
| 3 |
liveuser |
1069 |
#設置執行失敗
|
|
|
1070 |
$result["status"]="false";
|
| 226 |
liveuser |
1071 |
|
| 3 |
liveuser |
1072 |
#設置執行錯誤訊息
|
|
|
1073 |
$result["error"]=$spiltString;
|
|
|
1074 |
|
|
|
1075 |
#回傳結果
|
|
|
1076 |
return $result;
|
| 226 |
liveuser |
1077 |
|
| 3 |
liveuser |
1078 |
}#if end
|
| 226 |
liveuser |
1079 |
|
| 3 |
liveuser |
1080 |
#反之有關鍵字且 現在是屬於 php 的範圍
|
|
|
1081 |
if($spiltString["found"]==="false" && $isPHP===true){
|
| 226 |
liveuser |
1082 |
|
| 3 |
liveuser |
1083 |
#初始化暫存的資訊
|
|
|
1084 |
$tempLineInfo=array();
|
| 226 |
liveuser |
1085 |
|
| 3 |
liveuser |
1086 |
#預設該行不是php的內容
|
|
|
1087 |
$tempLineInfo["isPHP"]=true;
|
| 226 |
liveuser |
1088 |
|
| 3 |
liveuser |
1089 |
#放置內容
|
|
|
1090 |
$tempLineInfo["content"]=$line;
|
| 226 |
liveuser |
1091 |
|
| 3 |
liveuser |
1092 |
#儲存一行資訊描述
|
|
|
1093 |
$lineInfo[]=$tempLineInfo;
|
| 226 |
liveuser |
1094 |
|
| 3 |
liveuser |
1095 |
}#if end
|
| 226 |
liveuser |
1096 |
|
| 3 |
liveuser |
1097 |
#反之有找到關鍵字,且現在屬於 php 的範圍
|
|
|
1098 |
else if($spiltString["found"]==="true" && $isPHP===true){
|
|
|
1099 |
|
|
|
1100 |
#如果分割成0段
|
|
|
1101 |
if($spiltString["dataCounts"]===0){
|
| 226 |
liveuser |
1102 |
|
| 3 |
liveuser |
1103 |
#識別是否開始php語法了.
|
|
|
1104 |
$isPHP=false;
|
| 226 |
liveuser |
1105 |
|
| 3 |
liveuser |
1106 |
#識別是否讀取到php tag開頭
|
|
|
1107 |
$phpStart=false;
|
| 226 |
liveuser |
1108 |
|
| 3 |
liveuser |
1109 |
#識別是否讀取到php tag結尾
|
|
|
1110 |
$phpEed=true;
|
| 226 |
liveuser |
1111 |
|
| 3 |
liveuser |
1112 |
}#if end
|
| 226 |
liveuser |
1113 |
|
| 3 |
liveuser |
1114 |
#如果分割成其他段落
|
|
|
1115 |
else{
|
| 226 |
liveuser |
1116 |
|
| 3 |
liveuser |
1117 |
#設置執行錯誤訊息
|
|
|
1118 |
$result["error"][]="not supported now";
|
| 226 |
liveuser |
1119 |
|
| 3 |
liveuser |
1120 |
}#else end
|
| 226 |
liveuser |
1121 |
|
| 3 |
liveuser |
1122 |
}#if end
|
| 226 |
liveuser |
1123 |
|
| 3 |
liveuser |
1124 |
}#if end
|
|
|
1125 |
|
|
|
1126 |
#反之有關鍵字
|
|
|
1127 |
else if($spiltString["found"]==="true"){
|
| 226 |
liveuser |
1128 |
|
| 3 |
liveuser |
1129 |
#識別是否開始php語法了.
|
|
|
1130 |
$isPHP=true;
|
| 226 |
liveuser |
1131 |
|
| 3 |
liveuser |
1132 |
#識別是否讀取到php tag開頭
|
|
|
1133 |
$phpStart=true;
|
| 226 |
liveuser |
1134 |
|
| 3 |
liveuser |
1135 |
#識別是否讀取到php tag結尾
|
|
|
1136 |
$phpEed=false;
|
| 226 |
liveuser |
1137 |
|
| 3 |
liveuser |
1138 |
#如果切成兩段
|
|
|
1139 |
if($spiltString["dataCounts"]===2){
|
| 226 |
liveuser |
1140 |
|
| 3 |
liveuser |
1141 |
#儲存非 php 的字串
|
|
|
1142 |
$noPHPstr=$spiltString["dataArray"][0];
|
| 226 |
liveuser |
1143 |
|
| 3 |
liveuser |
1144 |
#初始化暫存的資訊
|
|
|
1145 |
$tempLineInfo=array();
|
| 226 |
liveuser |
1146 |
|
| 3 |
liveuser |
1147 |
#預設該行不是php的內容
|
|
|
1148 |
$tempLineInfo["isPHP"]=false;
|
| 226 |
liveuser |
1149 |
|
| 3 |
liveuser |
1150 |
#放置內容
|
|
|
1151 |
$tempLineInfo["content"]=$noPHPstr;
|
| 226 |
liveuser |
1152 |
|
| 3 |
liveuser |
1153 |
#儲存屬於 php 的字串
|
|
|
1154 |
$phpStr=$spiltString["dataArray"][1];
|
| 226 |
liveuser |
1155 |
|
| 3 |
liveuser |
1156 |
#初始化暫存的資訊
|
|
|
1157 |
$tempLineInfo=array();
|
| 226 |
liveuser |
1158 |
|
| 3 |
liveuser |
1159 |
#預設該行不是php的內容
|
|
|
1160 |
$tempLineInfo["isPHP"]=true;
|
| 226 |
liveuser |
1161 |
|
| 3 |
liveuser |
1162 |
#放置內容
|
|
|
1163 |
$tempLineInfo["content"]=$noPHPstr;
|
| 226 |
liveuser |
1164 |
|
| 3 |
liveuser |
1165 |
}#if end
|
| 226 |
liveuser |
1166 |
|
| 3 |
liveuser |
1167 |
#反之切成一段
|
|
|
1168 |
else if($spiltString["dataCounts"]===1){
|
| 226 |
liveuser |
1169 |
|
| 3 |
liveuser |
1170 |
#設置執行失敗
|
|
|
1171 |
$result["status"]="false";
|
| 226 |
liveuser |
1172 |
|
| 3 |
liveuser |
1173 |
#設置執行錯誤訊息
|
|
|
1174 |
$result["error"][]="not supported now";
|
|
|
1175 |
|
|
|
1176 |
#回傳結果
|
|
|
1177 |
return $result;
|
| 226 |
liveuser |
1178 |
|
| 3 |
liveuser |
1179 |
}#else end
|
| 226 |
liveuser |
1180 |
|
| 3 |
liveuser |
1181 |
#反之切成0段
|
|
|
1182 |
else if($spiltString["dataCounts"]===0){
|
| 226 |
liveuser |
1183 |
|
| 3 |
liveuser |
1184 |
#do nothing
|
| 226 |
liveuser |
1185 |
|
| 3 |
liveuser |
1186 |
}#else end
|
| 226 |
liveuser |
1187 |
|
| 3 |
liveuser |
1188 |
#反之
|
|
|
1189 |
else{
|
|
|
1190 |
#設置執行失敗
|
|
|
1191 |
$result["status"]="false";
|
| 226 |
liveuser |
1192 |
|
| 3 |
liveuser |
1193 |
#設置執行錯誤訊息
|
|
|
1194 |
$result["error"][]="not supported now";
|
|
|
1195 |
|
|
|
1196 |
#回傳結果
|
|
|
1197 |
return $result;
|
| 226 |
liveuser |
1198 |
|
| 3 |
liveuser |
1199 |
}#else end
|
| 226 |
liveuser |
1200 |
|
| 3 |
liveuser |
1201 |
}#else end
|
|
|
1202 |
|
|
|
1203 |
#真對每個字串
|
|
|
1204 |
foreach($lineInfo as $linfo){
|
| 226 |
liveuser |
1205 |
|
|
|
1206 |
#記錄起來
|
| 3 |
liveuser |
1207 |
$contentWithoutPhpTagArray[]=$linfo;
|
| 226 |
liveuser |
1208 |
|
| 3 |
liveuser |
1209 |
}#foreach end
|
| 226 |
liveuser |
1210 |
|
| 3 |
liveuser |
1211 |
}#foreach end
|
| 226 |
liveuser |
1212 |
|
| 3 |
liveuser |
1213 |
#debug
|
|
|
1214 |
#var_dump($contentWithoutPhpTagArray);
|
| 226 |
liveuser |
1215 |
|
| 3 |
liveuser |
1216 |
#儲存每行的檔案內容
|
|
|
1217 |
$res=array();
|
| 226 |
liveuser |
1218 |
|
| 3 |
liveuser |
1219 |
#php段落
|
|
|
1220 |
$phpSection="";
|
| 226 |
liveuser |
1221 |
|
| 3 |
liveuser |
1222 |
#針對每行程式
|
|
|
1223 |
foreach($contentWithoutPhpTagArray as $lineInfo){
|
| 226 |
liveuser |
1224 |
|
| 3 |
liveuser |
1225 |
#如果不是 php
|
|
|
1226 |
if($lineInfo["isPHP"]===false){
|
| 226 |
liveuser |
1227 |
|
| 3 |
liveuser |
1228 |
#如果有php段落
|
|
|
1229 |
if(!empty($phpSection)){
|
| 226 |
liveuser |
1230 |
|
|
|
1231 |
#加密php程式
|
| 3 |
liveuser |
1232 |
$encodedPHP=base64_encode($phpSection);
|
| 226 |
liveuser |
1233 |
|
| 3 |
liveuser |
1234 |
#串接內容
|
|
|
1235 |
$res[]="<?php eval(base64_decode(\"".$encodedPHP."\")); ?>";
|
| 226 |
liveuser |
1236 |
|
| 3 |
liveuser |
1237 |
}#if end
|
| 226 |
liveuser |
1238 |
|
| 3 |
liveuser |
1239 |
#清空php段落
|
|
|
1240 |
$phpSection="";
|
| 226 |
liveuser |
1241 |
|
| 3 |
liveuser |
1242 |
#串接內容
|
|
|
1243 |
$res[]=$lineInfo["content"].PHP_EOL;
|
| 226 |
liveuser |
1244 |
|
| 3 |
liveuser |
1245 |
}#if end
|
| 226 |
liveuser |
1246 |
|
| 3 |
liveuser |
1247 |
#反之是 PHP 內容
|
|
|
1248 |
else{
|
|
|
1249 |
#有內容才處理
|
|
|
1250 |
if(!empty($lineInfo["content"])){
|
| 226 |
liveuser |
1251 |
|
| 3 |
liveuser |
1252 |
#串接php語法
|
|
|
1253 |
$phpSection=$phpSection.$lineInfo["content"].PHP_EOL;
|
| 226 |
liveuser |
1254 |
|
| 3 |
liveuser |
1255 |
}#if end
|
| 226 |
liveuser |
1256 |
|
| 3 |
liveuser |
1257 |
}#else end
|
| 226 |
liveuser |
1258 |
|
| 3 |
liveuser |
1259 |
}#foreach end
|
| 226 |
liveuser |
1260 |
|
| 3 |
liveuser |
1261 |
#如果有php段落
|
|
|
1262 |
if(!empty($phpSection)){
|
| 226 |
liveuser |
1263 |
|
|
|
1264 |
#加密php程式
|
| 3 |
liveuser |
1265 |
$encodedPHP=base64_encode($phpSection);
|
| 226 |
liveuser |
1266 |
|
| 3 |
liveuser |
1267 |
#串接內容
|
|
|
1268 |
$res[]="<?php eval(base64_decode(\"".$encodedPHP."\")); ?>";
|
| 226 |
liveuser |
1269 |
|
| 3 |
liveuser |
1270 |
}#if end
|
| 226 |
liveuser |
1271 |
|
| 3 |
liveuser |
1272 |
#var_dump($res);exit;
|
| 226 |
liveuser |
1273 |
|
| 3 |
liveuser |
1274 |
#針對每個要寫入的行內容
|
|
|
1275 |
foreach($res as $line){
|
| 226 |
liveuser |
1276 |
|
| 3 |
liveuser |
1277 |
$result["content"]=$result["content"].$line;
|
| 226 |
liveuser |
1278 |
|
| 3 |
liveuser |
1279 |
}#foreach end
|
| 226 |
liveuser |
1280 |
|
| 3 |
liveuser |
1281 |
#設置執行正常
|
|
|
1282 |
$result["status"]="true";
|
| 226 |
liveuser |
1283 |
|
| 3 |
liveuser |
1284 |
#回傳結果
|
|
|
1285 |
return $result;
|
| 226 |
liveuser |
1286 |
|
| 3 |
liveuser |
1287 |
}#function encodePHP end
|
| 368 |
liveuser |
1288 |
|
|
|
1289 |
/*
|
|
|
1290 |
#函式說明:
|
|
|
1291 |
#檢查 apache http(s) log 中疑似攻擊的記錄.
|
|
|
1292 |
#回傳結果:
|
|
|
1293 |
#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1294 |
#$result["error"],錯誤訊息陣列.
|
|
|
1295 |
#$result["function"],字串,當前執行的函式名稱.
|
|
|
1296 |
#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
|
|
|
1297 |
#必填參數:
|
|
|
1298 |
#無.
|
|
|
1299 |
#可省略參數:
|
|
|
1300 |
#$conf["logPath"],http log的路徑,預設為"/var/log/httpd".
|
|
|
1301 |
#$conf["logPath"]="/var/log/httpd";
|
|
|
1302 |
#$conf["https"],字串,是否為要查https的log,預設為"false"，代表為http.
|
|
|
1303 |
#$conf["https"]="false";
|
|
|
1304 |
#參考資料:
|
|
|
1305 |
#無.
|
|
|
1306 |
#備註:
|
|
|
1307 |
#目前僅支援 apache 提供的 http(s) 服務.
|
|
|
1308 |
#攻擊者的定義包含http回應的code為4開頭或用戶使用 HTTP/1.0 協定或用戶使用 CONNECT method,且時間間隔不超過1秒鐘,次數達到3次.
|
|
|
1309 |
*/
|
|
|
1310 |
public static function checkHttpAttackLog(&$conf){
|
|
|
1311 |
|
|
|
1312 |
#初始化要回傳的結果
|
|
|
1313 |
$result=array();
|
| 3 |
liveuser |
1314 |
|
| 368 |
liveuser |
1315 |
#取得當前執行的函數名稱
|
|
|
1316 |
$result["function"]=__FUNCTION__;
|
|
|
1317 |
|
|
|
1318 |
#取得參數
|
|
|
1319 |
$result["argu"]=$conf;
|
|
|
1320 |
|
|
|
1321 |
#如果 $conf 不為陣列
|
|
|
1322 |
if(gettype($conf)!="array"){
|
|
|
1323 |
|
|
|
1324 |
#設置執行失敗
|
|
|
1325 |
$result["status"]="false";
|
|
|
1326 |
|
|
|
1327 |
#設置執行錯誤訊息
|
|
|
1328 |
$result["error"][]="\$conf變數須為陣列形態";
|
|
|
1329 |
|
|
|
1330 |
#如果傳入的參數為 null
|
|
|
1331 |
if(is_null($conf)){
|
|
|
1332 |
|
|
|
1333 |
#設置執行錯誤訊息
|
|
|
1334 |
$result["error"][]="\$conf變數不得為null,請檢查函數「".$result["function"]."」的參數設置有無正確!";
|
|
|
1335 |
|
|
|
1336 |
}#if end
|
|
|
1337 |
|
|
|
1338 |
#回傳結果
|
|
|
1339 |
return $result;
|
|
|
1340 |
|
|
|
1341 |
}#if end
|
|
|
1342 |
|
|
|
1343 |
#函式說明:
|
|
|
1344 |
#檢查必填與可省略的參數，可省略參數可指定預設要給與什麼數值內容.
|
|
|
1345 |
#回傳結果:
|
|
|
1346 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1347 |
#$result["error"],執行不正常結束的錯訊息陣列.
|
|
|
1348 |
#$result["simpleError"],簡單表示的錯誤訊息.
|
|
|
1349 |
#$result["function"],當前執行的函式名稱.
|
|
|
1350 |
#$result["argu"],設置給予的參數.
|
|
|
1351 |
#$result["passed"],識別要檢查的全體變數是否存在以及型態是否正確的變數,"true"代表檢查全部通過;"false"代表檢查不通過
|
|
|
1352 |
#$result[$shouldBeCheckedVarName]["varExist"],所檢查的變數是否存在,"false"代表不存在;"true"代表存在
|
|
|
1353 |
#$result[$shouldBeCheckedVarName]["varType"],所檢查的變數型態是否正確,"false"代表錯誤;"true"代表正確
|
|
|
1354 |
#$result[$shouldBeCheckedVarName]["error"],每個參數設定的錯誤訊息
|
|
|
1355 |
#$result["shouldNotBeEmpty"],不應該為空字串或控陣列的變數.
|
|
|
1356 |
#$result["argu"],字串陣列,目前輸入的參數名稱陣列.
|
|
|
1357 |
#$result["legalVarName"],字串陣列,合法可用的參數名稱陣列.
|
|
|
1358 |
#$result["notNeedVar"],字串陣列,多餘的參數名稱.
|
|
|
1359 |
#必填參數:
|
|
|
1360 |
#$conf["varInput"],陣列變數,要檢查的陣列變數,請在要檢查的參數前面加上&，這樣變動的結果才能被套用。
|
|
|
1361 |
$conf["variableCheck::checkArguments"]["varInput"]=&$conf;
|
|
|
1362 |
#$conf["referenceVarKey"],字串,$conf參數後面的key值,用於移除不要的參考陣列.
|
|
|
1363 |
$conf["variableCheck::checkArguments"]["referenceVarKey"]="variableCheck::checkArguments";
|
|
|
1364 |
#可省略參數:
|
|
|
1365 |
#$conf["mustBeFilledVariableName"],爲必填參數的變數名稱陣列，形態爲陣列變數，元素數量需要跟"mustBeFilledVariableType"參數的元素數量一致,例如: $conf["mustBeFilledVariableName"] = array("id","account","password");
|
|
|
1366 |
#$conf["mustBeFilledVariableName"]=array();
|
|
|
1367 |
#$conf["mustBeFilledVariableType"],爲必填參數的變數陣列應該爲何種變數形態，形態爲陣列,元素數量需要跟"mustBeFilledVariableName"參數的元素數量一致,例如: $conf["mustBeFilledVariableType"] = array("string",integer,"double","resource","object"); , null、any代表不指定變數形態.其中 resource也包含"resource (closed)".
|
|
|
1368 |
#$conf["mustBeFilledVariableType"]=array();
|
|
|
1369 |
#$conf["canBeEmptyString"],字串,必填變數內容如果是空字串就不能算是有設置的話，請設為"false",預設爲"true",可以為空字串.
|
|
|
1370 |
#$conf["canBeEmptyString"]="false";
|
|
|
1371 |
#$conf["canNotBeEmpty"],字串陣列,哪些必填參數的內容不得為空字串或空陣列,僅當$conf["canBeEmptyString"]為"true"時會生效.
|
|
|
1372 |
#$conf["canNotBeEmpty"]=array();
|
|
|
1373 |
#$conf["canBeEmpty"],字串陣列,哪些必填參數的內容可為空字串或空陣列,僅當$conf["canBeEmptyString"]為"false"時會生效.
|
|
|
1374 |
#$conf["canBeEmpty"]=array();
|
|
|
1375 |
#$conf["skipableVariableCanNotBeEmpty"],字串陣列,哪些可省略參數不可以為空字串或空陣列.
|
|
|
1376 |
$conf["variableCheck::checkArguments"]["skipableVariableCanNotBeEmpty"]=array("logPath","https");
|
|
|
1377 |
#$conf["skipableVariableName"],陣列字串,爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableName"] = array("id","account","password");
|
|
|
1378 |
$conf["variableCheck::checkArguments"]["skipableVariableName"]=array("logPath","https");
|
|
|
1379 |
#$conf["skipableVariableType"],陣列字串,爲可省略參數的變數名稱陣列，形態爲陣列變數，例如: $conf["skipableVariableType"] = array("string",integer,"double");
|
|
|
1380 |
$conf["variableCheck::checkArguments"]["skipableVariableType"]=array("string","string");
|
|
|
1381 |
#$conf["skipableVarDefaultValue"],字串陣列,每個不存在的可省略變數要初始化為什麼,null與代表不指定,若預設值是參數之一，請將$conf["mustBeFilledVar"]改成"\$conf["\mustBeFilledVar\"]".
|
|
|
1382 |
$conf["variableCheck::checkArguments"]["skipableVarDefaultValue"]=array("/var/log/httpd","false");
|
|
|
1383 |
#$conf["disallowAllSkipableVarIsEmpty"],字串,是否允許每個可省略參數都為空字串,預設為"true"允許,反之為"false".
|
|
|
1384 |
#$conf["disallowAllSkipableVarIsEmpty"]="";
|
|
|
1385 |
#$conf["disallowAllSkipableVarIsEmptyArray"],字串,是否允許每個可省略參數都為空陣列,預設為"true"允許,反之為"false".
|
|
|
1386 |
#$conf["disallowAllSkipableVarIsEmptyArray"]="";
|
|
|
1387 |
#$conf["disallowAllSkipableVarNotExist"],字串,是否不允許每個可省略參數都不存在,預設為"false"代表允許,反之為"true".
|
|
|
1388 |
#$conf["disallowAllSkipableVarNotExist"]="";
|
|
|
1389 |
#$conf["arrayCountEqualCheck"],字串陣列,為檢查哪些陣列參數的元素數量要一樣,$conf["arrayCountEqualCheck"][$i]=array()為第$i組key為哪些的變數其元素數量要相等.
|
|
|
1390 |
#$conf["arrayCountEqualCheck"][]=array();
|
|
|
1391 |
#參考資料:
|
|
|
1392 |
#array_keys=>http://php.net/manual/en/function.array-keys.php
|
|
|
1393 |
#備註:
|
|
|
1394 |
#無.
|
|
|
1395 |
$checkArguments=variableCheck::checkArguments($conf["variableCheck::checkArguments"]);
|
|
|
1396 |
unset($conf["variableCheck::checkArguments"]);
|
|
|
1397 |
|
|
|
1398 |
#預設為http的log
|
|
|
1399 |
$logFile="access_log";
|
|
|
1400 |
|
|
|
1401 |
#如果 https 為 "true"
|
|
|
1402 |
if($conf["https"]==="true"){
|
|
|
1403 |
|
|
|
1404 |
#設置為 https 的 log
|
|
|
1405 |
$logFile="ssl_access_log";
|
|
|
1406 |
|
|
|
1407 |
}#if end
|
|
|
1408 |
|
|
|
1409 |
#取得 http 存取記錄的 log
|
|
|
1410 |
#函式說明:
|
|
|
1411 |
#依據行號分隔抓取檔案的內容,結果會回傳一個陣列
|
|
|
1412 |
#回傳的變數說明:
|
|
|
1413 |
#$result["status"],執行是否成功，"true"代表成功；"fasle"代表失敗.
|
|
|
1414 |
#$result["error"],錯誤訊息提示.
|
|
|
1415 |
#$result["warning"],警告訊息.
|
|
|
1416 |
#$result["function"],當前執行的函數名稱.
|
|
|
1417 |
#$result["fileContent"],爲檔案的內容陣列.
|
|
|
1418 |
#$result["lineCount"],爲檔案內容總共的行數.
|
|
|
1419 |
#$result["fullContent"],為檔案的完整內容.
|
|
|
1420 |
#$result["base64dataOnly"],檔案的base64data.
|
|
|
1421 |
#$result["base64data"],為在網頁上給予src參數的數值.
|
|
|
1422 |
#$result["mimeType"],為檔案的mime type.
|
|
|
1423 |
#必填參數:
|
|
|
1424 |
#$conf["filePositionAndName"],字串,爲檔案的位置以及名稱.
|
|
|
1425 |
$conf["fileAccess::getFileContent"]["filePositionAndName"]=$conf["logPath"]."/".$logFile;
|
|
|
1426 |
#$conf["fileArgu"],字串,php變數__FILE__的內容,亦即該檔案在檔案系統的絕對路徑
|
|
|
1427 |
$conf["fileAccess::getFileContent"]["fileArgu"]=__FILE__;
|
|
|
1428 |
#可省略參數:
|
|
|
1429 |
#$conf["web"],是要取得網路上的檔案則為"true";反之預設為"false".
|
|
|
1430 |
#$conf["web"]="true";
|
|
|
1431 |
#$conf["createIfnotExist"],字串,預設為"false"代表檔案不存在也不需要建立;反之為"true".
|
|
|
1432 |
#$conf["createIfnotExist"]="false";
|
|
|
1433 |
#$conf["autoDeleteSpaceOnEachLineStart"],字串,預設為"false",不做額外處理;反之為"true"
|
|
|
1434 |
#$conf["autoDeleteSpaceOnEachLineStart"]="false";
|
|
|
1435 |
#參考資料：
|
|
|
1436 |
#file(),取得檔案內容的行數.
|
|
|
1437 |
#file=>http:#php.net/manual/en/function.file.php
|
|
|
1438 |
#rtrim(),剔除透過file()取得每行內容結尾的換行符號.
|
|
|
1439 |
#filesize=>http://php.net/manual/en/function.filesize.php
|
|
|
1440 |
#參考資料:
|
|
|
1441 |
#無.
|
|
|
1442 |
#備註:
|
|
|
1443 |
#無.
|
|
|
1444 |
$getFileContent=fileAccess::getFileContent($conf["fileAccess::getFileContent"]);
|
|
|
1445 |
unset($conf["fileAccess::getFileContent"]);
|
|
|
1446 |
|
|
|
1447 |
#如果執行失敗
|
|
|
1448 |
if($getFileContent["status"]==="false"){
|
|
|
1449 |
|
|
|
1450 |
#設置執行失敗
|
|
|
1451 |
$result["status"]="false";
|
|
|
1452 |
|
|
|
1453 |
#設置錯誤訊息
|
|
|
1454 |
$result["error"]=$getFileContent;
|
|
|
1455 |
|
|
|
1456 |
#回傳結果
|
|
|
1457 |
return $result;
|
|
|
1458 |
|
|
|
1459 |
}#if end
|
|
|
1460 |
|
|
|
1461 |
/*
|
|
|
1462 |
http log 範例:
|
|
|
1463 |
36.149.205.198 - - [22/Jun/2026:15:49:21 +0800] "CONNECT api.ipapi.is:443 HTTP/1.1" 200 -
|
|
|
1464 |
36.149.205.198 - - [22/Jun/2026:15:49:24 +0800] "CONNECT ipwho.is:443 HTTP/1.1" 200 -
|
|
|
1465 |
36.149.205.198 - - [22/Jun/2026:15:49:18 +0800] "CONNECT push.services.mozilla.com:443 HTTP/1.1" 200 -
|
|
|
1466 |
120.48.6.159 - - [22/Jun/2026:15:49:20 +0800] "CONNECT ifconfig.me:443 HTTP/1.1" 200 -
|
|
|
1467 |
36.149.205.198 - - [22/Jun/2026:15:49:24 +0800] "CONNECT ipwho.is:443 HTTP/1.1" 200 -
|
|
|
1468 |
36.149.205.198 - - [22/Jun/2026:15:49:25 +0800] "CONNECT api.ipapi.is:443 HTTP/1.1" 200 -
|
|
|
1469 |
36.149.205.198 - - [22/Jun/2026:15:49:28 +0800] "CONNECT ipwho.is:443 HTTP/1.1" 200 -
|
|
|
1470 |
36.149.205.198 - - [22/Jun/2026:15:49:30 +0800] "CONNECT nexus.officeapps.live.com:443 HTTP/1.1" 200 -
|
|
|
1471 |
172.238.244.28 - - [22/Jun/2026:15:49:31 +0800] "GET / HTTP/1.0" 400 402
|
|
|
1472 |
36.149.205.198 - - [22/Jun/2026:15:49:29 +0800] "CONNECT api.ipapi.is:443 HTTP/1.1" 200 -
|
|
|
1473 |
36.149.205.198 - - [22/Jun/2026:15:49:33 +0800] "CONNECT qaz23.com:2869 HTTP/1.1" 403 353
|
|
|
1474 |
36.149.205.198 - - [22/Jun/2026:15:49:34 +0800] "CONNECT qaz23.com:2869 HTTP/1.1" 403 353
|
|
|
1475 |
*/
|
|
|
1476 |
|
|
|
1477 |
#初始化給予 search::getMatchFormatsStrings 使用的 formats 參數
|
|
|
1478 |
$formatsParamsOfsearchGetMatchFormatsStrings=array();
|
|
|
1479 |
$formatsParamsOfsearchGetMatchFormatsStrings[]="\${ip} \${doNotNeed} [\${day}/\${month}/\${year}:\${hour}:\${min}:\${sec} \${timezone}] \${method} \${path} \${protocol} \${responseCode} \${bytesSend}";
|
|
|
1480 |
|
|
|
1481 |
#尋找 http code 為 4xx 的內容行
|
|
|
1482 |
#函式說明：
|
|
|
1483 |
#尋找多個字串中是否含有符合多個格式之一的內容,且回傳解析好的變數數值.
|
|
|
1484 |
#回傳結果:
|
|
|
1485 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1486 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
1487 |
#$result["function"],當前執行的函式名稱.
|
|
|
1488 |
#$result["argu"],所使用的參數.
|
|
|
1489 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
1490 |
#$result["content"],陣列,第一維為對應formats參數的索引,第二維的key為lineNo者為inputs參數的索引;第二維的key為content者為符合的資訊,若為n個${*},則當found為"true"時,就會回傳n個元素;第二維的key為parsedVar者為符合的資訊,其數值以變數名稱作為索引,元素的索引為0~N，代表有幾個符合的同名變數.
|
|
|
1491 |
#必填參數:
|
|
|
1492 |
#$conf["inputs"],字串陣列,要檢查的字串集合.
|
|
|
1493 |
$conf["search::getMatchFormatsStrings"]["inputs"]=$getFileContent["fileContent"];
|
|
|
1494 |
#$conf["format"],格式字串陣列,要尋找的可能格式字串集合.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
1495 |
$conf["search::getMatchFormatsStrings"]["formats"]=$formatsParamsOfsearchGetMatchFormatsStrings;
|
|
|
1496 |
#可省略參數:
|
|
|
1497 |
#無.
|
|
|
1498 |
#參考資料:
|
|
|
1499 |
#無.
|
|
|
1500 |
#備註:
|
|
|
1501 |
#無.
|
|
|
1502 |
$getMatchFormatsStrings=search::getMatchFormatsStrings($conf["search::getMatchFormatsStrings"]);
|
|
|
1503 |
unset($conf["search::getMatchFormatsStrings"]);
|
|
|
1504 |
|
|
|
1505 |
#如果執行異常
|
|
|
1506 |
if($getMatchFormatsStrings["status"]==="false"){
|
|
|
1507 |
|
|
|
1508 |
#設置執行失敗
|
|
|
1509 |
$result["status"]="false";
|
|
|
1510 |
|
|
|
1511 |
#設置錯誤訊息
|
|
|
1512 |
$result["error"]=$getMatchFormatsStrings;
|
|
|
1513 |
|
|
|
1514 |
#回傳結果
|
|
|
1515 |
return $result;
|
|
|
1516 |
|
|
|
1517 |
}#if end
|
|
|
1518 |
|
|
|
1519 |
#如果沒有符合的項目
|
|
|
1520 |
if($getMatchFormatsStrings["found"]==="false"){
|
|
|
1521 |
|
|
|
1522 |
#設置結果
|
|
|
1523 |
$result["content"]=array();
|
|
|
1524 |
|
|
|
1525 |
#設置執行正常
|
|
|
1526 |
$result["status"]="true";
|
|
|
1527 |
|
|
|
1528 |
#回傳結果
|
|
|
1529 |
return $result;
|
|
|
1530 |
|
|
|
1531 |
}#if end
|
|
|
1532 |
|
|
|
1533 |
#初始化要處理的ip資訊
|
|
|
1534 |
$ips=array();
|
|
|
1535 |
|
|
|
1536 |
#初始化用 ip 為索引來儲存資料行
|
|
|
1537 |
$ips_byIp=array();
|
|
|
1538 |
|
|
|
1539 |
#針對每個符合的規則
|
|
|
1540 |
foreach($getMatchFormatsStrings["content"] as $matchInfo){
|
|
|
1541 |
|
|
|
1542 |
#取得符合條件的行索引
|
|
|
1543 |
$index=$matchInfo["lineNo"];
|
|
|
1544 |
|
|
|
1545 |
#取得用戶要求的method
|
|
|
1546 |
$method=$matchInfo["parsedVar"][0]["method"][0];
|
|
|
1547 |
|
|
|
1548 |
#取得用戶要求的protocal
|
|
|
1549 |
$protocol=$matchInfo["parsedVar"][0]["protocol"][0];
|
|
|
1550 |
|
|
|
1551 |
#取得回應的code
|
|
|
1552 |
$responseCode=$matchInfo["parsedVar"][0]["responseCode"][0];
|
|
|
1553 |
|
|
|
1554 |
#如果 method 為 "CONNECT"
|
|
|
1555 |
if($method==="CONNECT"){
|
|
|
1556 |
|
|
|
1557 |
#這裡不做事情,但後面繼續執行
|
|
|
1558 |
|
|
|
1559 |
}#if end
|
|
|
1560 |
|
|
|
1561 |
#如果 protocol 為 "HTTP/1.0"
|
|
|
1562 |
else if($protocol==="HTTP/1.0"){
|
|
|
1563 |
|
|
|
1564 |
#這裡不做事情,但後面繼續執行
|
|
|
1565 |
|
|
|
1566 |
}#if end
|
|
|
1567 |
|
|
|
1568 |
#如果回應的 code 不為 4 開頭
|
|
|
1569 |
else if($responseCode[0]!=="4"){
|
|
|
1570 |
|
|
|
1571 |
#略過,看下一行
|
|
|
1572 |
continue;
|
|
|
1573 |
|
|
|
1574 |
}#if end
|
|
|
1575 |
|
|
|
1576 |
#取得用戶要求的路徑
|
|
|
1577 |
$path=$matchInfo["parsedVar"][0]["path"][0];
|
|
|
1578 |
|
|
|
1579 |
#剔除要求的資源名稱結尾為 ".css" ".js" "favicon.ico" ".jpg" ".png" 者. - start
|
|
|
1580 |
|
|
|
1581 |
#函式說明：
|
|
|
1582 |
#尋找字串中是否含有符合多個格式之一的內容,且回傳解析好的變數數值.
|
|
|
1583 |
#回傳結果:
|
|
|
1584 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1585 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
1586 |
#$result["function"],當前執行的函式名稱.
|
|
|
1587 |
#$result["argu"],所使用的參數.
|
|
|
1588 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
1589 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
1590 |
#必填參數:
|
|
|
1591 |
#$conf["input"],字串,要檢查的字串.
|
|
|
1592 |
$conf["search::findSpecifyStrFormats"]["input"]=$getFileContent["fileContent"][$index];
|
|
|
1593 |
#$conf["format"],格式字串陣列,要尋找的可能格式字串集合.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
1594 |
$conf["search::findSpecifyStrFormats"]["formats"]=array("\${str}.css","\${str}.js","\${str}.favicon.ico","\${str}.jpg","\${str}.jpeg","\${str}.png","\${str}.webp");
|
|
|
1595 |
#可省略參數:
|
|
|
1596 |
#無.
|
|
|
1597 |
#參考資料:
|
|
|
1598 |
#無.
|
|
|
1599 |
#備註:
|
|
|
1600 |
#無.
|
|
|
1601 |
$findSpecifyStrFormats=search::findSpecifyStrFormats($conf["search::findSpecifyStrFormats"]);
|
|
|
1602 |
unset($conf["search::findSpecifyStrFormats"]);
|
|
|
1603 |
|
|
|
1604 |
#如果執行異常
|
|
|
1605 |
if($findSpecifyStrFormats["status"]==="false"){
|
|
|
1606 |
|
|
|
1607 |
#設置執行失敗
|
|
|
1608 |
$result["status"]="false";
|
|
|
1609 |
|
|
|
1610 |
#設置錯誤訊息
|
|
|
1611 |
$result["error"]=$findSpecifyStrFormats;
|
|
|
1612 |
|
|
|
1613 |
#回傳結果
|
|
|
1614 |
return $result;
|
|
|
1615 |
|
|
|
1616 |
}#if end
|
|
|
1617 |
|
|
|
1618 |
#如果有符合的項目
|
|
|
1619 |
if($findSpecifyStrFormats["found"]==="true"){
|
|
|
1620 |
|
|
|
1621 |
#略過,看下一行
|
|
|
1622 |
continue;
|
|
|
1623 |
|
|
|
1624 |
}#if end
|
|
|
1625 |
|
|
|
1626 |
#剔除要求的資源名稱結尾為 ".css" ".js" "favicon.ico" ".jpg" ".jpeg" ".png" ".webp" 者. - end
|
|
|
1627 |
|
|
|
1628 |
#時間格式的參考
|
|
|
1629 |
# [\${day}/\${month}/\${year}:\${hour}:\${min}:\${sec} \${timezone}]
|
|
|
1630 |
|
|
|
1631 |
#取得 log 的時間點
|
|
|
1632 |
$time=$matchInfo["parsedVar"][0]["day"][0]."/".$matchInfo["parsedVar"][0]["month"][0]."/".$matchInfo["parsedVar"][0]["year"][0].":".$matchInfo["parsedVar"][0]["hour"][0].":".$matchInfo["parsedVar"][0]["min"][0].":".$matchInfo["parsedVar"][0]["sec"][0]." ".$matchInfo["parsedVar"][0]["timezone"][0];
|
|
|
1633 |
|
|
|
1634 |
#以 ip 為索引來儲存資料行
|
|
|
1635 |
$ips_byIp[$matchInfo["parsedVar"][0]["ip"][0]][]=array("log"=>$getFileContent["fileContent"][$index],"time"=>$time,"ip"=>$matchInfo["parsedVar"][0]["ip"][0]);
|
|
|
1636 |
|
|
|
1637 |
}#foreach end
|
|
|
1638 |
|
|
|
1639 |
#針對每個可能有問題的IP
|
|
|
1640 |
foreach($ips_byIp as $ip => $infos){
|
|
|
1641 |
|
|
|
1642 |
#計數 ip 於同時間前來的計數
|
|
|
1643 |
$ipSameTimeCount=0;
|
|
|
1644 |
|
|
|
1645 |
#用來存放來存取的同一時間
|
|
|
1646 |
$ipSameTime="";
|
|
|
1647 |
|
|
|
1648 |
#看來拜訪的時間點
|
|
|
1649 |
foreach($infos as $info){
|
|
|
1650 |
|
|
|
1651 |
#如果是初次
|
|
|
1652 |
if($ipSameTime===""){
|
|
|
1653 |
|
|
|
1654 |
#記錄時間點
|
|
|
1655 |
$ipSameTime=$info["time"];
|
|
|
1656 |
|
|
|
1657 |
#同時間點計數加1
|
|
|
1658 |
$ipSameTimeCount++;
|
|
|
1659 |
|
|
|
1660 |
}#if end
|
|
|
1661 |
|
|
|
1662 |
#反之如果時間點相同
|
|
|
1663 |
else if($ipSameTime===$info["time"]){
|
|
|
1664 |
|
|
|
1665 |
#同時間點計數加1
|
|
|
1666 |
$ipSameTimeCount++;
|
|
|
1667 |
|
|
|
1668 |
}#if end
|
|
|
1669 |
|
|
|
1670 |
#反之時間點不相同
|
|
|
1671 |
else{
|
|
|
1672 |
|
|
|
1673 |
#記錄時間點
|
|
|
1674 |
$ipSameTime=$info["time"];
|
|
|
1675 |
|
|
|
1676 |
#同時間點計數重設為1
|
|
|
1677 |
$ipSameTimeCount=1;
|
|
|
1678 |
|
|
|
1679 |
}#else end
|
|
|
1680 |
|
|
|
1681 |
#如果同時間的計數達到3
|
|
|
1682 |
if($ipSameTimeCount===3){
|
|
|
1683 |
|
|
|
1684 |
#初始化暫存的陣列
|
|
|
1685 |
$tmp=array();
|
|
|
1686 |
|
|
|
1687 |
#儲存資訊
|
|
|
1688 |
$tmp["info"]=$infos;
|
|
|
1689 |
|
|
|
1690 |
#儲存ip
|
|
|
1691 |
$tmp["ip"]=$info["ip"];
|
|
|
1692 |
|
|
|
1693 |
#取得有問題的IP
|
|
|
1694 |
$ips[]=$tmp;
|
|
|
1695 |
|
|
|
1696 |
#換檢查下一個IP
|
|
|
1697 |
continue 2;
|
|
|
1698 |
|
|
|
1699 |
}#if end
|
|
|
1700 |
|
|
|
1701 |
}#foreach end
|
|
|
1702 |
|
|
|
1703 |
}#foreach end
|
|
|
1704 |
|
|
|
1705 |
#設置結果
|
|
|
1706 |
$result["content"]=$ips;
|
|
|
1707 |
|
|
|
1708 |
#設置執行正常
|
|
|
1709 |
$result["status"]="true";
|
|
|
1710 |
|
|
|
1711 |
#回傳結果
|
|
|
1712 |
return $result;
|
|
|
1713 |
|
|
|
1714 |
}#funcion checkHttpAttackLog end
|
|
|
1715 |
|
|
|
1716 |
/*
|
|
|
1717 |
#函式說明:
|
|
|
1718 |
#檢查 postfixv log 中疑似攻擊的記錄.
|
|
|
1719 |
#回傳結果:
|
|
|
1720 |
#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1721 |
#$result["error"],錯誤訊息陣列.
|
|
|
1722 |
#$result["function"],字串,當前執行的函式名稱.
|
|
|
1723 |
#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
|
|
|
1724 |
#必填參數:
|
|
|
1725 |
#無.
|
|
|
1726 |
#可省略參數:
|
|
|
1727 |
#無
|
|
|
1728 |
#參考資料:
|
|
|
1729 |
#無.
|
|
|
1730 |
#備註:
|
|
|
1731 |
#無.
|
|
|
1732 |
*/
|
|
|
1733 |
public static function checkPostfixAttackLog(){
|
|
|
1734 |
|
|
|
1735 |
#初始化要回傳的結果
|
|
|
1736 |
$result=array();
|
|
|
1737 |
|
|
|
1738 |
#取得當前執行的函數名稱
|
|
|
1739 |
$result["function"]=__FUNCTION__;
|
|
|
1740 |
|
|
|
1741 |
#透過 journalctl -a -e -f --unit=postfix.service | grep "authentication failed" 來取得認證失敗的 ip
|
|
|
1742 |
#函式說明:
|
|
|
1743 |
#呼叫shell執行系統命令,並取得回傳的內容.
|
|
|
1744 |
#回傳的結果:
|
|
|
1745 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1746 |
#$result["error"],錯誤訊息陣列.
|
|
|
1747 |
#$result["function"],當前執行的函式名稱.
|
|
|
1748 |
#$result["argu"],使用的參數.
|
|
|
1749 |
#$result["cmd"],執行的指令內容.
|
|
|
1750 |
#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
1751 |
#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
|
|
|
1752 |
#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
1753 |
#$result["running"],是否還在執行.
|
|
|
1754 |
#$result["pid"],pid.
|
|
|
1755 |
#$result["statusCode"],執行結束後的代碼.
|
|
|
1756 |
#必填參數:
|
|
|
1757 |
#$conf["command"],字串,要執行的指令與.
|
|
|
1758 |
$conf["external::callShell"]["command"]="journalctl";
|
|
|
1759 |
#$conf["fileArgu"],字串,變數__FILE__的內容.
|
|
|
1760 |
$conf["external::callShell"]["fileArgu"]=__FILE__;
|
|
|
1761 |
#可省略參數:
|
|
|
1762 |
#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
|
|
|
1763 |
$conf["external::callShell"]["argu"]=array("-a","-e","--unit=postfix.service","|","grep","authentication failed","|","cat");
|
|
|
1764 |
#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
|
|
|
1765 |
#$conf["arguIsAddr"]=array();
|
|
|
1766 |
#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
|
|
|
1767 |
#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
|
|
|
1768 |
#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
|
|
|
1769 |
#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
|
|
|
1770 |
#$conf["enablePrintDescription"]="true";
|
|
|
1771 |
#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
|
|
|
1772 |
#$conf["printDescription"]="";
|
|
|
1773 |
#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
|
|
|
1774 |
$conf["external::callShell"]["escapeshellarg"]="true";
|
|
|
1775 |
#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
|
|
|
1776 |
#$conf["username"]="";
|
|
|
1777 |
#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
|
|
|
1778 |
#$conf["password"]="";
|
|
|
1779 |
#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
|
|
|
1780 |
#$conf["useScript"]="";
|
|
|
1781 |
#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
|
|
|
1782 |
#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
|
|
|
1783 |
#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
|
|
|
1784 |
#$conf["inBackGround"]="";
|
|
|
1785 |
#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
|
|
|
1786 |
#$conf["getErr"]="false";
|
|
|
1787 |
#備註:
|
|
|
1788 |
#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
|
|
|
1789 |
#參考資料：
|
|
|
1790 |
#exec=>http://php.net/manual/en/function.exec.php
|
|
|
1791 |
#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
|
|
|
1792 |
#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
|
|
|
1793 |
$callShell=external::callShell($conf["external::callShell"]);
|
|
|
1794 |
unset($conf["external::callShell"]);
|
|
|
1795 |
|
|
|
1796 |
if($callShell["status"]==="false"){
|
|
|
1797 |
|
|
|
1798 |
#如果有 statusCode
|
|
|
1799 |
if(isset($callShell["statusCode"])){
|
|
|
1800 |
|
|
|
1801 |
#如果shell回傳不為0也不為1
|
|
|
1802 |
if($callShell["statusCode"]!==0 && $callShell["statusCode"]!==1){
|
|
|
1803 |
|
|
|
1804 |
#設置執行失敗
|
|
|
1805 |
$result["status"]="false";
|
|
|
1806 |
|
|
|
1807 |
#設置錯誤訊息
|
|
|
1808 |
$result["error"]=$callShell;
|
|
|
1809 |
|
|
|
1810 |
#回傳結果
|
|
|
1811 |
return $result;
|
|
|
1812 |
|
|
|
1813 |
}#if end
|
|
|
1814 |
|
|
|
1815 |
}#if end
|
|
|
1816 |
|
|
|
1817 |
#設置執行失敗
|
|
|
1818 |
$result["status"]="false";
|
|
|
1819 |
|
|
|
1820 |
#設置錯誤訊息
|
|
|
1821 |
$result["error"]=$callShell;
|
|
|
1822 |
|
|
|
1823 |
#回傳結果
|
|
|
1824 |
return $result;
|
|
|
1825 |
|
|
|
1826 |
}#if end
|
|
|
1827 |
|
|
|
1828 |
#儲存有問題的smtp IP
|
|
|
1829 |
$ips_smtp=array();
|
|
|
1830 |
|
|
|
1831 |
#狀態碼不為1才執行
|
|
|
1832 |
if($callShell["statusCode"]!==1){
|
|
|
1833 |
|
|
|
1834 |
#初始化記錄每行log的時間點
|
|
|
1835 |
$occurTime=array();
|
|
|
1836 |
|
|
|
1837 |
#初始化儲存log行資訊的變數
|
|
|
1838 |
$oriLog=array();
|
|
|
1839 |
|
|
|
1840 |
#根據每筆記錄
|
|
|
1841 |
foreach($callShell["output"] as $index => $line){
|
|
|
1842 |
|
|
|
1843 |
#截取出的格式
|
|
|
1844 |
#Sep 28 07:54:16 qbpwcf.org postfix/smtpd[2766456]: warning: unknown[158.94.208.72]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=1q2w
|
|
|
1845 |
#Sep 28 07:57:15 qbpwcf.org postfix/smtpd[2768441]: warning: unknown[213.209.157.249]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=sybase
|
|
|
1846 |
#Sep 28 08:01:09 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[213.209.157.165]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=spam
|
|
|
1847 |
#Sep 28 08:01:51 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[103.109.20.174]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=print@qbpwcf.org
|
|
|
1848 |
#Sep 28 08:03:14 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[62.60.130.148]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin2
|
|
|
1849 |
#Sep 28 08:16:06 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[103.109.20.174]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=user@qbpwcf.org
|
|
|
1850 |
#Sep 28 08:16:44 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
|
|
|
1851 |
#Sep 28 08:16:53 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
|
|
|
1852 |
#Sep 28 08:17:06 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
|
|
|
1853 |
#Sep 28 08:17:16 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: Connection lost to authentication server, sasl_username=hualing@qbpwcf.org
|
|
|
1854 |
#Sep 28 08:20:28 qbpwcf.org postfix/smtpd[2784204]: warning: unknown[158.94.208.72]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=1q2w1q2w
|
|
|
1855 |
#Sep 28 08:23:09 qbpwcf.org postfix/smtpd[2785986]: warning: unknown[213.209.157.249]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=informix
|
|
|
1856 |
#Sep 28 08:23:39 qbpwcf.org postfix/smtpd[2785986]: warning: unknown[62.60.130.148]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin3
|
|
|
1857 |
#May 22 12:58:54 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: Invalid authentication mechanism: 'LOGIN', sasl_username=(unavailable)
|
|
|
1858 |
#May 22 12:58:59 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=nonexistent_user_26@qbpwcf.org
|
|
|
1859 |
#May 22 12:59:07 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=finance@qbpwcf.org#"${doNotNeed} postfix/smtpd[${pid}]${doNotNeed}[${ip}]"
|
|
|
1860 |
|
|
|
1861 |
#用 " " 分割 以取得 月日時分秒
|
|
|
1862 |
#函式說明:
|
|
|
1863 |
#將固定格式的字串分開,並回傳分開的結果.
|
|
|
1864 |
#回傳結果:
|
|
|
1865 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1866 |
#$result["error"],錯誤訊息陣列
|
|
|
1867 |
#$result["function"],當前執行的函數名稱.
|
|
|
1868 |
#$result["argu"],使用的參數.
|
|
|
1869 |
#$result["oriStr"],要分割的原始字串內容
|
|
|
1870 |
#$result["dataArray"],爲分割好字串的陣列內容,$result["dataArray"][$i]爲第($i+1)段的內容。
|
|
|
1871 |
#$result["dataCounts"],爲總共分成幾段
|
|
|
1872 |
#$result["found"],是否有在$conf["stringIn"]找到$conf["spiltSymbol"],"true"代表有找到,"false"代表沒有找到.
|
|
|
1873 |
#必填參數:
|
|
|
1874 |
#$conf["stringIn"],字串,要處理的字串.
|
|
|
1875 |
$conf["stringProcess::spiltString"]["stringIn"]=$line;
|
|
|
1876 |
#$conf["spiltSymbol"],字串,爲以哪個符號作爲分割.
|
|
|
1877 |
$conf["stringProcess::spiltString"]["spiltSymbol"]=" ";
|
|
|
1878 |
#可省略參數:
|
|
|
1879 |
#$conf["allowEmptyStr"],是否允許分割出來空字串,預設為"false"不允許;"true"代表允許.
|
|
|
1880 |
#$conf["allowEmptyStr"]="false";
|
|
|
1881 |
#參考資料:
|
|
|
1882 |
#無.
|
|
|
1883 |
#備註:
|
|
|
1884 |
#無.
|
|
|
1885 |
$spiltString=stringProcess::spiltString($conf["stringProcess::spiltString"]);
|
|
|
1886 |
unset($conf["stringProcess::spiltString"]);
|
|
|
1887 |
|
|
|
1888 |
#如果分割失敗
|
|
|
1889 |
if($spiltString["status"]==="false"){
|
|
|
1890 |
|
|
|
1891 |
#設置執行失敗
|
|
|
1892 |
$result["status"]="false";
|
|
|
1893 |
|
|
|
1894 |
#設置錯誤訊息
|
|
|
1895 |
$result["error"]=$spiltString;
|
|
|
1896 |
|
|
|
1897 |
#回傳結果
|
|
|
1898 |
return $result;
|
|
|
1899 |
|
|
|
1900 |
}#if end
|
|
|
1901 |
|
|
|
1902 |
#如果分割失敗
|
|
|
1903 |
if($spiltString["dataCounts"]<3){
|
|
|
1904 |
|
|
|
1905 |
#設置執行失敗
|
|
|
1906 |
$result["status"]="false";
|
|
|
1907 |
|
|
|
1908 |
#設置錯誤訊息
|
|
|
1909 |
$result["error"]=$spiltString;
|
|
|
1910 |
|
|
|
1911 |
#回傳結果
|
|
|
1912 |
return $result;
|
|
|
1913 |
|
|
|
1914 |
}#if end
|
|
|
1915 |
|
|
|
1916 |
#儲存時間
|
|
|
1917 |
$occurTime[$index]=strtotime($spiltString["dataArray"][0]." ".$spiltString["dataArray"][1]." ".$spiltString["dataArray"][2]);
|
|
|
1918 |
|
|
|
1919 |
#取得 ip
|
|
|
1920 |
#函式說明：
|
|
|
1921 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
1922 |
#回傳結果:
|
|
|
1923 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
1924 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
1925 |
#$result["function"],當前執行的函式名稱.
|
|
|
1926 |
#$result["argu"],所使用的參數.
|
|
|
1927 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
1928 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
1929 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
1930 |
#必填參數:
|
|
|
1931 |
#$conf["input"],字串,要檢查的字串.
|
|
|
1932 |
$conf["search::findSpecifyStrFormat"]["input"]=$line;
|
|
|
1933 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
1934 |
$conf["search::findSpecifyStrFormat"]["format"]="\${doNotNeed} postfix/smtpd[\${pid}]\${doNotNeed}[\${ip}]:[\${reason}]";
|
|
|
1935 |
#可省略參數:
|
|
|
1936 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
1937 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
1938 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
1939 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
1940 |
#參考資料:
|
|
|
1941 |
#無.
|
|
|
1942 |
#備註:
|
|
|
1943 |
#無.
|
|
|
1944 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
1945 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
1946 |
|
|
|
1947 |
#如果分割失敗
|
|
|
1948 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
1949 |
|
|
|
1950 |
#設置執行失敗
|
|
|
1951 |
$result["status"]="false";
|
|
|
1952 |
|
|
|
1953 |
#設置錯誤訊息
|
|
|
1954 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
1955 |
|
|
|
1956 |
#回傳結果
|
|
|
1957 |
return $result;
|
|
|
1958 |
|
|
|
1959 |
}#if end
|
|
|
1960 |
|
|
|
1961 |
#如果沒有符合格式
|
|
|
1962 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
1963 |
|
|
|
1964 |
#剔除時間點 記錄
|
|
|
1965 |
array_pop($occurTime);
|
|
|
1966 |
|
|
|
1967 |
#跳過該行
|
|
|
1968 |
continue;
|
|
|
1969 |
|
|
|
1970 |
}#if end
|
|
|
1971 |
|
|
|
1972 |
#取得解析好的ip
|
|
|
1973 |
$ip=$findSpecifyStrFormat["parsedVar"]["ip"];
|
|
|
1974 |
|
|
|
1975 |
#儲存原始的log行內容
|
|
|
1976 |
$oriLog[$index]=$spiltMutiString["spiltString"][$index ]["oriStr"];
|
|
|
1977 |
|
|
|
1978 |
#初始化暫存的陣列
|
|
|
1979 |
$tmp=array();
|
|
|
1980 |
|
|
|
1981 |
#設置log、time
|
|
|
1982 |
$tmp["info"][]=array("log"=>$oriLog[$index],"time"=>$occurTime[$index]);
|
|
|
1983 |
|
|
|
1984 |
#設置問題ip
|
|
|
1985 |
$tmp["ip"]=$ip;
|
|
|
1986 |
|
|
|
1987 |
#取得所需的有問題的IP
|
|
|
1988 |
$ips_smtp[]=$tmp;
|
|
|
1989 |
|
|
|
1990 |
}#foreach end
|
|
|
1991 |
|
|
|
1992 |
}#if end
|
|
|
1993 |
|
|
|
1994 |
#設置結果
|
|
|
1995 |
$result["content"]=$ips_smtp;
|
|
|
1996 |
|
|
|
1997 |
#設置執行正常
|
|
|
1998 |
$result["status"]="true";
|
|
|
1999 |
|
|
|
2000 |
#回傳結果
|
|
|
2001 |
return $result;
|
|
|
2002 |
|
|
|
2003 |
}#function checkPostfixAttackLog end
|
|
|
2004 |
|
|
|
2005 |
/*
|
|
|
2006 |
#函式說明:
|
|
|
2007 |
#檢查 named log 中疑似攻擊的記錄.
|
|
|
2008 |
#回傳結果:
|
|
|
2009 |
#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2010 |
#$result["error"],錯誤訊息陣列.
|
|
|
2011 |
#$result["function"],字串,當前執行的函式名稱.
|
|
|
2012 |
#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
|
|
|
2013 |
#必填參數:
|
|
|
2014 |
#無.
|
|
|
2015 |
#可省略參數:
|
|
|
2016 |
#無
|
|
|
2017 |
#參考資料:
|
|
|
2018 |
#無.
|
|
|
2019 |
#備註:
|
|
|
2020 |
#無.
|
|
|
2021 |
*/
|
|
|
2022 |
public static function checkNamedAttackLog(){
|
|
|
2023 |
|
|
|
2024 |
#初始化要回傳的結果
|
|
|
2025 |
$result=array();
|
|
|
2026 |
|
|
|
2027 |
#取得當前執行的函數名稱
|
|
|
2028 |
$result["function"]=__FUNCTION__;
|
|
|
2029 |
|
|
|
2030 |
#透過 journalctl -a -e -f --unit=named.service | grep ' query ' 來取得 IP
|
|
|
2031 |
#函式說明:
|
|
|
2032 |
#呼叫shell執行系統命令,並取得回傳的內容.
|
|
|
2033 |
#回傳的結果:
|
|
|
2034 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2035 |
#$result["error"],錯誤訊息陣列.
|
|
|
2036 |
#$result["function"],當前執行的函式名稱.
|
|
|
2037 |
#$result["argu"],使用的參數.
|
|
|
2038 |
#$result["cmd"],執行的指令內容.
|
|
|
2039 |
#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2040 |
#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
|
|
|
2041 |
#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2042 |
#$result["running"],是否還在執行.
|
|
|
2043 |
#$result["pid"],pid.
|
|
|
2044 |
#$result["statusCode"],執行結束後的代碼.
|
|
|
2045 |
#必填參數:
|
|
|
2046 |
#$conf["command"],字串,要執行的指令與.
|
|
|
2047 |
$conf["external::callShell"]["command"]="journalctl";
|
|
|
2048 |
#$conf["fileArgu"],字串,變數__FILE__的內容.
|
|
|
2049 |
$conf["external::callShell"]["fileArgu"]=__FILE__;
|
|
|
2050 |
#可省略參數:
|
|
|
2051 |
#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
|
|
|
2052 |
$conf["external::callShell"]["argu"]=array("-a","-e","--unit=named.service","|","grep"," query ","|","cat");
|
|
|
2053 |
#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
|
|
|
2054 |
#$conf["arguIsAddr"]=array();
|
|
|
2055 |
#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
|
|
|
2056 |
#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
|
|
|
2057 |
#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
|
|
|
2058 |
#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
|
|
|
2059 |
#$conf["enablePrintDescription"]="true";
|
|
|
2060 |
#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
|
|
|
2061 |
#$conf["printDescription"]="";
|
|
|
2062 |
#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
|
|
|
2063 |
$conf["external::callShell"]["escapeshellarg"]="true";
|
|
|
2064 |
#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
|
|
|
2065 |
#$conf["username"]="";
|
|
|
2066 |
#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
|
|
|
2067 |
#$conf["password"]="";
|
|
|
2068 |
#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
|
|
|
2069 |
#$conf["useScript"]="";
|
|
|
2070 |
#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
|
|
|
2071 |
#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
|
|
|
2072 |
#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
|
|
|
2073 |
#$conf["inBackGround"]="";
|
|
|
2074 |
#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
|
|
|
2075 |
#$conf["getErr"]="false";
|
|
|
2076 |
#備註:
|
|
|
2077 |
#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
|
|
|
2078 |
#參考資料：
|
|
|
2079 |
#exec=>http://php.net/manual/en/function.exec.php
|
|
|
2080 |
#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
|
|
|
2081 |
#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
|
|
|
2082 |
$callShell=external::callShell($conf["external::callShell"]);
|
|
|
2083 |
unset($conf["external::callShell"]);
|
|
|
2084 |
|
|
|
2085 |
#如果執行失敗
|
|
|
2086 |
if($callShell["status"]==="false"){
|
|
|
2087 |
|
|
|
2088 |
#如果有 statusCode
|
|
|
2089 |
if(isset($callShell["statusCode"])){
|
|
|
2090 |
|
|
|
2091 |
#如果shell回傳不為0也不為1
|
|
|
2092 |
if($callShell["statusCode"]!==0 && $callShell["statusCode"]!==1){
|
|
|
2093 |
|
|
|
2094 |
#設置執行失敗
|
|
|
2095 |
$result["status"]="false";
|
|
|
2096 |
|
|
|
2097 |
#設置錯誤訊息
|
|
|
2098 |
$result["error"]=$callShell;
|
|
|
2099 |
|
|
|
2100 |
#回傳結果
|
|
|
2101 |
return $result;
|
|
|
2102 |
|
|
|
2103 |
}#if end
|
|
|
2104 |
|
|
|
2105 |
}#if end
|
|
|
2106 |
|
|
|
2107 |
#設置執行失敗
|
|
|
2108 |
$result["status"]="false";
|
|
|
2109 |
|
|
|
2110 |
#設置錯誤訊息
|
|
|
2111 |
$result["error"]=$callShell;
|
|
|
2112 |
|
|
|
2113 |
#回傳結果
|
|
|
2114 |
return $result;
|
|
|
2115 |
|
|
|
2116 |
}#if end
|
|
|
2117 |
|
|
|
2118 |
#記錄攻擊者的IP
|
|
|
2119 |
$attacker_ips_namd=array();
|
|
|
2120 |
|
|
|
2121 |
#狀態碼不為1才執行
|
|
|
2122 |
if($callShell["statusCode"]!==1){
|
|
|
2123 |
|
|
|
2124 |
#截取出的格式
|
|
|
2125 |
#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2126 |
#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2127 |
#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2128 |
#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2129 |
#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2130 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2131 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2132 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2133 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f77180297c0 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2134 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2135 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2136 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2137 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2138 |
#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2139 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f770c077bf0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2140 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f770c077bf0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2141 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2142 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f77180297c0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2143 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2144 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f77180297c0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2145 |
#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2146 |
#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2147 |
#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2148 |
#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
|
|
|
2149 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#40052 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
|
|
|
2150 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#48628 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
|
|
|
2151 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#52460 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
|
|
|
2152 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#60457 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
|
|
|
2153 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#10213 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
|
|
|
2154 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#44377 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
|
|
|
2155 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#4481 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
|
|
|
2156 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#53061 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
|
|
|
2157 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#31654 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
|
|
|
2158 |
#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc802a410 61.220.11.198#57701 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
|
|
|
2159 |
#Sep 29 03:37:20 dns.qbpwcf.org named[94]: client @0x7f60e00734e8 61.166.210.84#49954 (twitter.com): query failed (REFUSED) for twitter.com/IN/AAAA at ../../../lib/ns/query.c:5691
|
|
|
2160 |
#Sep 29 03:37:20 dns.qbpwcf.org named[94]: client @0x7f60e006f428 61.166.210.84#49954 (twitter.com): query failed (REFUSED) for twitter.com/IN/A at ../../../lib/ns/query.c:5691
|
|
|
2161 |
#Sep 29 03:37:21 dns.qbpwcf.org named[94]: client @0x7f60e80889a8 61.166.210.84#50057 (astrill4u.com): query failed (REFUSED) for astrill4u.com/IN/AAAA at ../../../lib/ns/query.c:5691
|
|
|
2162 |
#Sep 29 03:37:21 dns.qbpwcf.org named[94]: client @0x7f60e805ed08 61.166.210.84#50057 (astrill4u.com): query failed (REFUSED) for astrill4u.com/IN/A at ../../../lib/ns/query.c:5691
|
|
|
2163 |
#Sep 29 03:46:33 dns.qbpwcf.org named[94]: client @0x7f60d402b618 165.22.223.147#16200 (tool.lu): query failed (REFUSED) for tool.lu/IN/A at ../../../lib/ns/query.c:5691
|
|
|
2164 |
#Sep 29 03:49:16 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2165 |
#Sep 29 04:19:10 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2166 |
#Sep 29 04:20:28 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2167 |
#Sep 29 04:24:20 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2168 |
#Sep 29 04:24:59 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2169 |
#Sep 29 04:40:48 dns.qbpwcf.org named[94]: client @0x7f60f9377888 174.96.56.126#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
|
|
|
2170 |
#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} client ${doNotNeed} ${ip}#${remoteRevPort} (${$queryTarget}): ${doNotNeed}
|
|
|
2171 |
|
|
|
2172 |
#函式說明:
|
|
|
2173 |
#檢查多個字串中的每個字串是否有多個關鍵字
|
|
|
2174 |
#回傳結果:
|
|
|
2175 |
#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
|
|
|
2176 |
#$result["function"],當前執行的函數名稱.
|
|
|
2177 |
#$result["error"],錯誤訊息.
|
|
|
2178 |
#$result["argu"],使用的參數.
|
|
|
2179 |
#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
|
|
|
2180 |
#$result["foundedKeyWords"],找到的關鍵字陣列.
|
|
|
2181 |
#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
|
|
|
2182 |
#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
|
|
|
2183 |
#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
|
|
|
2184 |
#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
|
|
|
2185 |
#必填參數:
|
|
|
2186 |
#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
|
|
|
2187 |
$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array("(REFUSED)"," denied");
|
|
|
2188 |
#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
|
|
|
2189 |
$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
|
|
|
2190 |
#可省略參數:
|
|
|
2191 |
#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
|
|
|
2192 |
#$conf["completeEqual"]="true";
|
|
|
2193 |
#參考資料:
|
|
|
2194 |
#無.
|
|
|
2195 |
#備註:
|
|
|
2196 |
#無.
|
|
|
2197 |
$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
2198 |
unset($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
2199 |
|
|
|
2200 |
#如果執行失敗
|
|
|
2201 |
if($findManyKeyWordsFromManyString["status"]==="false"){
|
|
|
2202 |
|
|
|
2203 |
#設置執行失敗
|
|
|
2204 |
$result["status"]="false";
|
|
|
2205 |
|
|
|
2206 |
#設置錯誤訊息
|
|
|
2207 |
$result["error"]=$findManyKeyWordsFromManyString;
|
|
|
2208 |
|
|
|
2209 |
#回傳結果
|
|
|
2210 |
return $result;
|
|
|
2211 |
|
|
|
2212 |
}#if end
|
|
|
2213 |
|
|
|
2214 |
#初始化儲存原始log行內容
|
|
|
2215 |
#$oriLog=array();
|
|
|
2216 |
|
|
|
2217 |
#儲存疑似有問題的IP
|
|
|
2218 |
$ips_named=array();
|
|
|
2219 |
|
|
|
2220 |
#初始化儲存確定有問題的ip
|
|
|
2221 |
$attacker_ips_namd=array();
|
|
|
2222 |
|
|
|
2223 |
#針對每個符合的行
|
|
|
2224 |
foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $oriLog){
|
|
|
2225 |
|
|
|
2226 |
#初始化儲存資訊的暫存陣列
|
|
|
2227 |
$info=array();
|
|
|
2228 |
|
|
|
2229 |
#解析時間與來源ip
|
|
|
2230 |
#函式說明：
|
|
|
2231 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
2232 |
#回傳結果:
|
|
|
2233 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2234 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
2235 |
#$result["function"],當前執行的函式名稱.
|
|
|
2236 |
#$result["argu"],所使用的參數.
|
|
|
2237 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
2238 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
2239 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
2240 |
#必填參數:
|
|
|
2241 |
#$conf["input"],字串,要檢查的字串.
|
|
|
2242 |
$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
|
|
|
2243 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
2244 |
$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} client \${doNotNeed} \${ip}#\${remoteRevPort} (\${queryTarget}): \${doNotNeed}";
|
|
|
2245 |
#可省略參數:
|
|
|
2246 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
2247 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
2248 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
2249 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
2250 |
#參考資料:
|
|
|
2251 |
#無.
|
|
|
2252 |
#備註:
|
|
|
2253 |
#無.
|
|
|
2254 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
2255 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
2256 |
|
|
|
2257 |
#如果分割失敗
|
|
|
2258 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
2259 |
|
|
|
2260 |
#設置執行失敗
|
|
|
2261 |
$result["status"]="false";
|
|
|
2262 |
|
|
|
2263 |
#設置錯誤訊息
|
|
|
2264 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
2265 |
|
|
|
2266 |
#回傳結果
|
|
|
2267 |
return $result;
|
|
|
2268 |
|
|
|
2269 |
}#if end
|
|
|
2270 |
|
|
|
2271 |
#如果沒有符合格式
|
|
|
2272 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
2273 |
|
|
|
2274 |
#跳過該行
|
|
|
2275 |
continue;
|
|
|
2276 |
|
|
|
2277 |
}#if end
|
|
|
2278 |
|
|
|
2279 |
#儲存時間點
|
|
|
2280 |
$info["time"]=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
|
|
|
2281 |
|
|
|
2282 |
#儲存ip
|
|
|
2283 |
$info["ip"]=$findSpecifyStrFormat["parsedVar"]["ip"][0];
|
|
|
2284 |
|
|
|
2285 |
#儲存log
|
|
|
2286 |
$info["log"]=$oriLog;
|
|
|
2287 |
|
|
|
2288 |
#儲存查詢的目標
|
|
|
2289 |
$info["queryTarget"]=$findSpecifyStrFormat["parsedVar"]["queryTarget"][0];
|
|
|
2290 |
|
|
|
2291 |
#儲存疑似有問題的ip
|
|
|
2292 |
$ips_named[$info["ip"]][]=$info;
|
|
|
2293 |
|
|
|
2294 |
}#foreach end
|
|
|
2295 |
|
|
|
2296 |
#針對每個可能有問題ip的每個log行
|
|
|
2297 |
foreach($ips_named as $ip => $infos){
|
|
|
2298 |
|
|
|
2299 |
#初始化記錄ip來訪不大於1分鐘的計數
|
|
|
2300 |
$count=0;
|
|
|
2301 |
|
|
|
2302 |
#初始化記錄歷史log跟time
|
|
|
2303 |
$history=array();
|
|
|
2304 |
|
|
|
2305 |
#針對每個log行資訊
|
|
|
2306 |
foreach($infos as $index => $info){
|
|
|
2307 |
|
|
|
2308 |
#unixtime
|
|
|
2309 |
$time=strtotime($info["time"]);
|
|
|
2310 |
|
|
|
2311 |
#如果沒有下筆記錄
|
|
|
2312 |
if(!isset($infos[$index+1])){
|
|
|
2313 |
|
|
|
2314 |
#結束 foreach
|
|
|
2315 |
break;
|
|
|
2316 |
|
|
|
2317 |
}#if end
|
|
|
2318 |
|
|
|
2319 |
#取得unixtime
|
|
|
2320 |
$next_time=strtotime($infos[$index+1]["time"]);
|
|
|
2321 |
|
|
|
2322 |
#如果時間間隔大於60秒
|
|
|
2323 |
if($next_time-$time>60){
|
|
|
2324 |
|
|
|
2325 |
#跳過,看下筆記錄
|
|
|
2326 |
continue;
|
|
|
2327 |
|
|
|
2328 |
}#if end
|
|
|
2329 |
|
|
|
2330 |
#計數+1
|
|
|
2331 |
$count++;
|
|
|
2332 |
|
|
|
2333 |
#記錄歷史資訊
|
|
|
2334 |
$history[]=array("time"=>$time,"log"=>$info["log"]);
|
|
|
2335 |
|
|
|
2336 |
}#foreach end
|
|
|
2337 |
|
|
|
2338 |
#如果有達到3次
|
|
|
2339 |
if($count>=3){
|
|
|
2340 |
|
|
|
2341 |
#初始化暫存的陣列
|
|
|
2342 |
$tmp=array();
|
|
|
2343 |
|
|
|
2344 |
#設置ip
|
|
|
2345 |
$tmp["ip"]=$ip;
|
|
|
2346 |
|
|
|
2347 |
#設置info
|
|
|
2348 |
$tmp["info"]=$history;
|
|
|
2349 |
|
|
|
2350 |
#記錄攻擊者的IP
|
|
|
2351 |
$attacker_ips_namd[]=$tmp;
|
|
|
2352 |
|
|
|
2353 |
}#if end
|
|
|
2354 |
|
|
|
2355 |
}#foreach end
|
|
|
2356 |
|
|
|
2357 |
}#if end
|
|
|
2358 |
|
|
|
2359 |
#設置結果
|
|
|
2360 |
$result["content"]=$attacker_ips_namd;
|
|
|
2361 |
|
|
|
2362 |
#設置執行正常
|
|
|
2363 |
$result["status"]="true";
|
|
|
2364 |
|
|
|
2365 |
#回傳結果
|
|
|
2366 |
return $result;
|
|
|
2367 |
|
|
|
2368 |
}#function checkNamedAttackLog end
|
|
|
2369 |
|
|
|
2370 |
/*
|
|
|
2371 |
#函式說明:
|
|
|
2372 |
#檢查 dovecot log 中疑似攻擊的記錄.
|
|
|
2373 |
#回傳結果:
|
|
|
2374 |
#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2375 |
#$result["error"],錯誤訊息陣列.
|
|
|
2376 |
#$result["function"],字串,當前執行的函式名稱.
|
|
|
2377 |
#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
|
|
|
2378 |
#必填參數:
|
|
|
2379 |
#無.
|
|
|
2380 |
#可省略參數:
|
|
|
2381 |
#無
|
|
|
2382 |
#參考資料:
|
|
|
2383 |
#無.
|
|
|
2384 |
#備註:
|
|
|
2385 |
#無.
|
|
|
2386 |
*/
|
|
|
2387 |
public static function checkDovecotAttackLog(){
|
|
|
2388 |
|
|
|
2389 |
#初始化要回傳的結果
|
|
|
2390 |
$result=array();
|
|
|
2391 |
|
|
|
2392 |
#取得當前執行的函數名稱
|
|
|
2393 |
$result["function"]=__FUNCTION__;
|
|
|
2394 |
|
|
|
2395 |
#透過 journalctl -a -e --unit=dovecot.service 來取得 IP
|
|
|
2396 |
#函式說明:
|
|
|
2397 |
#呼叫shell執行系統命令,並取得回傳的內容.
|
|
|
2398 |
#回傳的結果:
|
|
|
2399 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2400 |
#$result["error"],錯誤訊息陣列.
|
|
|
2401 |
#$result["function"],當前執行的函式名稱.
|
|
|
2402 |
#$result["argu"],使用的參數.
|
|
|
2403 |
#$result["cmd"],執行的指令內容.
|
|
|
2404 |
#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2405 |
#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
|
|
|
2406 |
#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2407 |
#$result["running"],是否還在執行.
|
|
|
2408 |
#$result["pid"],pid.
|
|
|
2409 |
#$result["statusCode"],執行結束後的代碼.
|
|
|
2410 |
#必填參數:
|
|
|
2411 |
#$conf["command"],字串,要執行的指令與.
|
|
|
2412 |
$conf["external::callShell"]["command"]="journalctl";
|
|
|
2413 |
#$conf["fileArgu"],字串,變數__FILE__的內容.
|
|
|
2414 |
$conf["external::callShell"]["fileArgu"]=__FILE__;
|
|
|
2415 |
#可省略參數:
|
|
|
2416 |
#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
|
|
|
2417 |
$conf["external::callShell"]["argu"]=array("-a","-e","--unit=dovecot.service");
|
|
|
2418 |
#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
|
|
|
2419 |
#$conf["arguIsAddr"]=array();
|
|
|
2420 |
#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
|
|
|
2421 |
#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
|
|
|
2422 |
#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
|
|
|
2423 |
#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
|
|
|
2424 |
#$conf["enablePrintDescription"]="true";
|
|
|
2425 |
#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
|
|
|
2426 |
#$conf["printDescription"]="";
|
|
|
2427 |
#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
|
|
|
2428 |
$conf["external::callShell"]["escapeshellarg"]="true";
|
|
|
2429 |
#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
|
|
|
2430 |
#$conf["username"]="";
|
|
|
2431 |
#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
|
|
|
2432 |
#$conf["password"]="";
|
|
|
2433 |
#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
|
|
|
2434 |
#$conf["useScript"]="";
|
|
|
2435 |
#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
|
|
|
2436 |
#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
|
|
|
2437 |
#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
|
|
|
2438 |
#$conf["inBackGround"]="";
|
|
|
2439 |
#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
|
|
|
2440 |
#$conf["getErr"]="false";
|
|
|
2441 |
#備註:
|
|
|
2442 |
#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
|
|
|
2443 |
#參考資料：
|
|
|
2444 |
#exec=>http://php.net/manual/en/function.exec.php
|
|
|
2445 |
#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
|
|
|
2446 |
#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
|
|
|
2447 |
$callShell=external::callShell($conf["external::callShell"]);
|
|
|
2448 |
unset($conf["external::callShell"]);
|
|
|
2449 |
|
|
|
2450 |
#如果執行失敗
|
|
|
2451 |
if($callShell["status"]==="false"){
|
|
|
2452 |
|
|
|
2453 |
#如果有 statusCode
|
|
|
2454 |
if(isset($callShell["statusCode"])){
|
|
|
2455 |
|
|
|
2456 |
#如果shell回傳不為0也不為1
|
|
|
2457 |
if($callShell["statusCode"]!==0 && $callShell["statusCode"]!==1){
|
|
|
2458 |
|
|
|
2459 |
#設置執行失敗
|
|
|
2460 |
$result["status"]="false";
|
|
|
2461 |
|
|
|
2462 |
#設置錯誤訊息
|
|
|
2463 |
$result["error"]=$callShell;
|
|
|
2464 |
|
|
|
2465 |
#回傳結果
|
|
|
2466 |
return $result;
|
|
|
2467 |
|
|
|
2468 |
}#if end
|
|
|
2469 |
|
|
|
2470 |
}#if end
|
|
|
2471 |
|
|
|
2472 |
#設置執行失敗
|
|
|
2473 |
$result["status"]="false";
|
|
|
2474 |
|
|
|
2475 |
#設置錯誤訊息
|
|
|
2476 |
$result["error"]=$callShell;
|
|
|
2477 |
|
|
|
2478 |
#回傳結果
|
|
|
2479 |
return $result;
|
|
|
2480 |
|
|
|
2481 |
}#if end
|
|
|
2482 |
|
|
|
2483 |
#記錄攻擊者的IP
|
|
|
2484 |
$attacker_ips_imap=array();
|
|
|
2485 |
|
|
|
2486 |
/* $callShell["output"] 範例截取結果
|
|
|
2487 |
Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MxQuPu+73xpliNc9>
|
|
|
2488 |
Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hH8xPu+7dBtliNc9>
|
|
|
2489 |
Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<nmI0Pu+7zhtliNc9>
|
|
|
2490 |
Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<1GU2Pu+7NBhliNc9>
|
|
|
2491 |
Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0Io5Pu+7sRhliNc9>
|
|
|
2492 |
Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zbQ+Pu+7rhlliNc9>
|
|
|
2493 |
Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0P5APu+7/BlliNc9>
|
|
|
2494 |
Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<gKRDPu+7XhpliNc9>
|
|
|
2495 |
Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<4hNHPu+77hpliNc9>
|
|
|
2496 |
Feb 23 00:25:00 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<belIPu+7bBtliNc9>
|
|
|
2497 |
Feb 23 00:25:00 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<VhRLPu+7xBtliNc9>
|
|
|
2498 |
Feb 23 00:46:19 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<loiMiu+7cxhliNc9>
|
|
|
2499 |
Feb 23 00:46:19 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<RNCQiu+7/xhliNc9>
|
|
|
2500 |
Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NWCTiu+7PBlliNc9>
|
|
|
2501 |
Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<2tiViu+7hBlliNc9>
|
|
|
2502 |
Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<w6Sbiu+7/xlliNc9>
|
|
|
2503 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SkWkiu+7gBtliNc9>
|
|
|
2504 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<bGCmiu+7qBtliNc9>
|
|
|
2505 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0E+oiu+76RtliNc9>
|
|
|
2506 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FBGriu+7UhhliNc9>
|
|
|
2507 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<AeSsiu+7iBhliNc9>
|
|
|
2508 |
Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<gpSuiu+70hhliNc9>
|
|
|
2509 |
Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zYfITPC7RBlliNc9>
|
|
|
2510 |
Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<GULMTPC7zhlliNc9>
|
|
|
2511 |
Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3jjOTPC7CBpliNc9>
|
|
|
2512 |
Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vhHQTPC7UBpliNc9>
|
|
|
2513 |
Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vArTTPC7rxpliNc9>
|
|
|
2514 |
Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hDTXTPC7GhtliNc9>
|
|
|
2515 |
Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<c6vZTPC7SRtliNc9>
|
|
|
2516 |
Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<rQzcTPC7jBtliNc9>
|
|
|
2517 |
Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<LSffTPC78htliNc9>
|
|
|
2518 |
Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<XLThTPC7KBhliNc9>
|
|
|
2519 |
Feb 23 01:40:40 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<tZfjTPC7dxhliNc9>
|
|
|
2520 |
Feb 23 03:27:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<i3bIyfG7AxtliNc9>
|
|
|
2521 |
Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0sLVyfG7uxtliNc9>
|
|
|
2522 |
Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<BJXZyfG7BhhliNc9>
|
|
|
2523 |
Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<xK3cyfG7SxhliNc9>
|
|
|
2524 |
Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<q43gyfG7aRhliNc9>
|
|
|
2525 |
Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Oj3syfG7FBlliNc9>
|
|
|
2526 |
Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SF7uyfG7RhlliNc9>
|
|
|
2527 |
Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<IM/wyfG7ZRlliNc9>
|
|
|
2528 |
Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<pXv1yfG7vBlliNc9>
|
|
|
2529 |
Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8ub4yfG7/xlliNc9>
|
|
|
2530 |
Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<H0j7yfG7NRpliNc9>
|
|
|
2531 |
Feb 23 06:10:07 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Zw6FEPS7WxhliNc9>
|
|
|
2532 |
Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vmKTEPS7cRpliNc9>
|
|
|
2533 |
Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SkOXEPS7BxtliNc9>
|
|
|
2534 |
Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<H42bEPS7WRtliNc9>
|
|
|
2535 |
Feb 23 06:10:09 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<jFqoEPS7SRhliNc9>
|
|
|
2536 |
Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<TNy4EPS7DhpliNc9>
|
|
|
2537 |
Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JYW7EPS7mBpliNc9>
|
|
|
2538 |
Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=</Ve+EPS76hpliNc9>
|
|
|
2539 |
Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<StLGEPS7qhtliNc9>
|
|
|
2540 |
Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<7RnLEPS7DBhliNc9>
|
|
|
2541 |
Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<6xTOEPS7eBhliNc9>
|
|
|
2542 |
Feb 23 06:29:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<YHy0VfS7uBhliNc9>
|
|
|
2543 |
Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<WLW4VfS7fxlliNc9>
|
|
|
2544 |
Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<lM66VfS73BlliNc9>
|
|
|
2545 |
Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Q4K9VfS7NxpliNc9>
|
|
|
2546 |
Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JiLBVfS7rRpliNc9>
|
|
|
2547 |
Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<DETIVfS7qxtliNc9>
|
|
|
2548 |
Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<UlLLVfS7GhhliNc9>
|
|
|
2549 |
Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<safNVfS7txhliNc9>
|
|
|
2550 |
Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<M/DQVfS7LxlliNc9>
|
|
|
2551 |
Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<+zPTVfS7eRlliNc9>
|
|
|
2552 |
Feb 23 06:29:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<dxXWVfS72hlliNc9>
|
|
|
2553 |
Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<S0pci/S7SxhliNc9>
|
|
|
2554 |
Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zThji/S78RhliNc9>
|
|
|
2555 |
Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8PJoi/S7ixlliNc9>
|
|
|
2556 |
Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Qkhui/S7PBpliNc9>
|
|
|
2557 |
Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SXVzi/S7hhtliNc9>
|
|
|
2558 |
Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=</X55i/S7uhhliNc9>
|
|
|
2559 |
Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MHJ9i/S74hlliNc9>
|
|
|
2560 |
Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<RBWBi/S7pRpliNc9>
|
|
|
2561 |
Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NJeGi/S7yhtliNc9>
|
|
|
2562 |
Feb 23 06:44:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<QsaMi/S7rxhliNc9>
|
|
|
2563 |
Feb 23 06:44:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8fiPi/S7uBlliNc9>
|
|
|
2564 |
Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<dt04yPS7KBlliNc9>
|
|
|
2565 |
Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<ZMI9yPS7WxpliNc9>
|
|
|
2566 |
Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<nTVAyPS7ARtliNc9>
|
|
|
2567 |
Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<wj1CyPS7lxtliNc9>
|
|
|
2568 |
Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<u7RFyPS7YRhliNc9>
|
|
|
2569 |
Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<tpBLyPS7ZhlliNc9>
|
|
|
2570 |
Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<CRdOyPS7wxlliNc9>
|
|
|
2571 |
Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<v9NQyPS7JxpliNc9>
|
|
|
2572 |
Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<81lUyPS73hpliNc9>
|
|
|
2573 |
Feb 23 07:01:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<PCZXyPS7TRtliNc9>
|
|
|
2574 |
Feb 23 07:01:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<VnNZyPS7qxtliNc9>
|
|
|
2575 |
Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<op+l9vS7ZxhliNc9>
|
|
|
2576 |
Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<aBCr9vS7CBlliNc9>
|
|
|
2577 |
Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0sOt9vS7dRlliNc9>
|
|
|
2578 |
Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NFaw9vS7xhlliNc9>
|
|
|
2579 |
Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<QS609vS7SRpliNc9>
|
|
|
2580 |
Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<4FW79vS76htliNc9>
|
|
|
2581 |
Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Fxu+9vS7gBhliNc9>
|
|
|
2582 |
Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3djA9vS75RhliNc9>
|
|
|
2583 |
Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hgzE9vS7mxlliNc9>
|
|
|
2584 |
Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<J8TG9vS7GBpliNc9>
|
|
|
2585 |
Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<t87I9vS7mBpliNc9>
|
|
|
2586 |
Feb 23 07:29:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<1xBILPW7MRtliNc9>
|
|
|
2587 |
Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<IXZNLPW79htliNc9>
|
|
|
2588 |
Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<6OdPLPW7chhliNc9>
|
|
|
2589 |
Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<M5BSLPW78hhliNc9>
|
|
|
2590 |
Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Nv9VLPW7UxlliNc9>
|
|
|
2591 |
Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<foJbLPW7KRpliNc9>
|
|
|
2592 |
Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<EoVeLPW7nxpliNc9>
|
|
|
2593 |
Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<DwNhLPW7JRtliNc9>
|
|
|
2594 |
Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<mKhkLPW7ohtliNc9>
|
|
|
2595 |
Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3nhnLPW7/htliNc9>
|
|
|
2596 |
Feb 23 07:29:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<e+lpLPW7XRhliNc9>
|
|
|
2597 |
Feb 23 07:44:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<KtTtYfW7dBhliNc9>
|
|
|
2598 |
Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MLTxYfW77BhliNc9>
|
|
|
2599 |
Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<9GL0YfW7KBlliNc9>
|
|
|
2600 |
Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JNT2YfW7fRlliNc9>
|
|
|
2601 |
Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8Zv5YfW72RlliNc9>
|
|
|
2602 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<lbv/YfW73BpliNc9>
|
|
|
2603 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<5zsCYvW7EBtliNc9>
|
|
|
2604 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<aE8EYvW7bRtliNc9>
|
|
|
2605 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<LEIHYvW75RtliNc9>
|
|
|
2606 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<rLsJYvW7MRhliNc9>
|
|
|
2607 |
Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<9oMMYvW7ihhliNc9>
|
|
|
2608 |
Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<x7SUl/W7mBpliNc9>
|
|
|
2609 |
Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<k1KZl/W73xtliNc9>
|
|
|
2610 |
Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Veabl/W7PxhliNc9>
|
|
|
2611 |
Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Yamel/W7sxhliNc9>
|
|
|
2612 |
Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<wpGil/W7OBlliNc9>
|
|
|
2613 |
Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<+VCol/W7aBpliNc9>
|
|
|
2614 |
Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<TMaql/W7zhpliNc9>
|
|
|
2615 |
Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<KnKtl/W7GBtliNc9>
|
|
|
2616 |
Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Lkixl/W7ixtliNc9>
|
|
|
2617 |
Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8bWzl/W7ARhliNc9>
|
|
|
2618 |
Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<70q2l/W7PBhliNc9>
|
|
|
2619 |
Sep 29 06:53:42 qbpwcf.org dovecot[98]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.231.151.171, lip=169.254.2.1, TLS, session=<MaKQGOs/wIMD55er>
|
|
|
2620 |
Sep 29 07:42:58 qbpwcf.org auth[3737748]: pam_unix(dovecot:auth): check pass; user unknown
|
|
|
2621 |
Sep 29 07:42:58 qbpwcf.org auth[3737748]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=account@qbpwcf.org rhost=62.60.131.29
|
|
|
2622 |
Sep 29 08:10:02 qbpwcf.org dovecot[98]: imap(liveuser)<3755807><SvyIKew/xLpyIuFn>: Disconnected: Connection closed (UID SEARCH finished 0.039 secs ago) in=119 out=1504 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
|
|
|
2623 |
Sep 29 08:12:02 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=149.102.158.38, lip=169.254.2.1, mpid=3757116, TLS, session=<B2O9MOw/TrmVZp4m>
|
|
|
2624 |
Sep 29 08:12:04 qbpwcf.org dovecot[98]: imap(liveuser)<3757116><B2O9MOw/TrmVZp4m>: Disconnected: Logged out in=240 out=21891 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
|
|
|
2625 |
Sep 29 08:12:06 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=149.102.158.38, lip=169.254.2.1, mpid=3757144, TLS, session=<S0rwMOw/XLmVZp4m>
|
|
|
2626 |
Sep 29 08:12:09 qbpwcf.org dovecot[98]: imap(liveuser)<3757144><S0rwMOw/XLmVZp4m>: Disconnected: Logged out in=885 out=25454 deleted=0 expunged=0 trashed=0 hdr_count=2 hdr_bytes=21658 body_count=0 body_bytes=0
|
|
|
2627 |
Sep 29 08:28:48 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768144, TLS, session=<Gk6ybOw/nNpyIuFn>
|
|
|
2628 |
Sep 29 08:28:51 qbpwcf.org dovecot[98]: imap(liveuser)<3768144><Gk6ybOw/nNpyIuFn>: Disconnected: Connection closed (LIST finished 1.939 secs ago) in=50 out=17609 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
|
|
|
2629 |
Sep 29 08:28:51 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768149, TLS, session=<ct7bbOw/qtpyIuFn>
|
|
|
2630 |
Sep 29 08:28:52 qbpwcf.org dovecot[98]: imap(liveuser)<3768149><ct7bbOw/qtpyIuFn>: Disconnected: Connection closed (UID FETCH finished 0.045 secs ago) in=196 out=2381 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
|
|
|
2631 |
Sep 29 08:28:53 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768155, TLS, session=<DvP1bOw/tNpyIuFn>
|
|
|
2632 |
Sep 29 08:28:55 qbpwcf.org dovecot[98]: imap(liveuser)<3768155><DvP1bOw/tNpyIuFn>: Disconnected: Connection closed (UID SEARCH finished 0.180 secs ago) in=119 out=1504 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
|
|
|
2633 |
Sep 29 08:39:24 qbpwcf.org auth[3775219]: pam_unix(dovecot:auth): check pass; user unknown
|
|
|
2634 |
Sep 29 08:39:24 qbpwcf.org auth[3775219]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=test rhost=196.251.92.78
|
|
|
2635 |
Sep 29 08:40:44 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): check pass; user unknown
|
|
|
2636 |
Sep 29 08:40:44 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=1q2w3e4r5t4567 rhost=158.94.208.72
|
|
|
2637 |
Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): check pass; user unknown
|
|
|
2638 |
Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=spam rhost=62.60.130.148
|
|
|
2639 |
*/
|
|
|
2640 |
|
|
|
2641 |
#認證失敗的關鍵字
|
|
|
2642 |
$keyWordAF="authentication failure";
|
|
|
2643 |
|
|
|
2644 |
#未認證或SSL錯誤
|
|
|
2645 |
$keyWordNAA="no auth attempts";
|
|
|
2646 |
|
|
|
2647 |
#搜尋符合關鍵字的log行
|
|
|
2648 |
#函式說明:
|
|
|
2649 |
#檢查多個字串中的每個字串是否有多個關鍵字
|
|
|
2650 |
#回傳結果:
|
|
|
2651 |
#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
|
|
|
2652 |
#$result["function"],當前執行的函數名稱.
|
|
|
2653 |
#$result["error"],錯誤訊息.
|
|
|
2654 |
#$result["argu"],使用的參數.
|
|
|
2655 |
#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
|
|
|
2656 |
#$result["foundedKeyWords"],找到的關鍵字陣列.
|
|
|
2657 |
#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
|
|
|
2658 |
#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
|
|
|
2659 |
#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
|
|
|
2660 |
#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
|
|
|
2661 |
#必填參數:
|
|
|
2662 |
#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
|
|
|
2663 |
$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array($keyWordAF,$keyWordNAA);
|
|
|
2664 |
#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
|
|
|
2665 |
$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
|
|
|
2666 |
#可省略參數:
|
|
|
2667 |
#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
|
|
|
2668 |
#$conf["completeEqual"]="true";
|
|
|
2669 |
#參考資料:
|
|
|
2670 |
#無.
|
|
|
2671 |
#備註:
|
|
|
2672 |
#無.
|
|
|
2673 |
$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
2674 |
unset($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
2675 |
|
|
|
2676 |
#如果執行失敗
|
|
|
2677 |
if($findManyKeyWordsFromManyString["status"]==="false"){
|
|
|
2678 |
|
|
|
2679 |
#設置執行失敗
|
|
|
2680 |
$result["status"]="false";
|
|
|
2681 |
|
|
|
2682 |
#設置錯誤訊息
|
|
|
2683 |
$result["error"]=$findManyKeyWordsFromManyString;
|
|
|
2684 |
|
|
|
2685 |
#回傳結果
|
|
|
2686 |
return $result;
|
|
|
2687 |
|
|
|
2688 |
}#if end
|
|
|
2689 |
|
|
|
2690 |
#初始化儲存可能有問題的存取Dovecot服務遠端ip
|
|
|
2691 |
$rickyIpsOfDocecot=array();
|
|
|
2692 |
|
|
|
2693 |
#針對每個符合的log行
|
|
|
2694 |
foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $index => $oriLog){
|
|
|
2695 |
|
|
|
2696 |
#找到的關鍵字
|
|
|
2697 |
$foundKeyWord=$findManyKeyWordsFromManyString["foundedTrueKeyWords"][$index][0];
|
|
|
2698 |
|
|
|
2699 |
#依照符合的關鍵字
|
|
|
2700 |
switch($foundKeyWord){
|
|
|
2701 |
|
|
|
2702 |
#如果是認證失敗
|
|
|
2703 |
case $keyWordAF:
|
|
|
2704 |
|
|
|
2705 |
#範例
|
|
|
2706 |
#Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=spam rhost=62.60.130.148
|
|
|
2707 |
#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} : authentication failure; logname=${account} ${doNotNeed} rhost=${ip}
|
|
|
2708 |
|
|
|
2709 |
#取得時間點跟遠端IP
|
|
|
2710 |
#函式說明：
|
|
|
2711 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
2712 |
#回傳結果:
|
|
|
2713 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2714 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
2715 |
#$result["function"],當前執行的函式名稱.
|
|
|
2716 |
#$result["argu"],所使用的參數.
|
|
|
2717 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
2718 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
2719 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
2720 |
#必填參數:
|
|
|
2721 |
#$conf["input"],字串,要檢查的字串.
|
|
|
2722 |
$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
|
|
|
2723 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
2724 |
$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} : authentication failure; logname=\${account} \${doNotNeed} rhost=\${ip}";
|
|
|
2725 |
#可省略參數:
|
|
|
2726 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
2727 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
2728 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
2729 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
2730 |
#參考資料:
|
|
|
2731 |
#無.
|
|
|
2732 |
#備註:
|
|
|
2733 |
#無.
|
|
|
2734 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
2735 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
2736 |
|
|
|
2737 |
#如果分割失敗
|
|
|
2738 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
2739 |
|
|
|
2740 |
#設置執行失敗
|
|
|
2741 |
$result["status"]="false";
|
|
|
2742 |
|
|
|
2743 |
#設置錯誤訊息
|
|
|
2744 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
2745 |
|
|
|
2746 |
#回傳結果
|
|
|
2747 |
return $result;
|
|
|
2748 |
|
|
|
2749 |
}#if end
|
|
|
2750 |
|
|
|
2751 |
#如果沒有符合格式
|
|
|
2752 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
2753 |
|
|
|
2754 |
#跳過該行
|
|
|
2755 |
continue 2;
|
|
|
2756 |
|
|
|
2757 |
}#if end
|
|
|
2758 |
|
|
|
2759 |
#取得時間點
|
|
|
2760 |
$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
|
|
|
2761 |
|
|
|
2762 |
#取得ip
|
|
|
2763 |
$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
|
|
|
2764 |
|
|
|
2765 |
#儲存其資訊
|
|
|
2766 |
$rickyIpsOfDocecot[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
|
|
|
2767 |
|
|
|
2768 |
#跳出 switch
|
|
|
2769 |
break;
|
|
|
2770 |
|
|
|
2771 |
#如果是未認證或SSL錯誤
|
|
|
2772 |
case $keyWordNAA:
|
|
|
2773 |
|
|
|
2774 |
#範例
|
|
|
2775 |
#Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<70q2l/W7PBhliNc9>
|
|
|
2776 |
#Sep 29 06:53:42 qbpwcf.org dovecot[98]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.231.151.171, lip=169.254.2.1, TLS, session=<MaKQGOs/wIMD55er>
|
|
|
2777 |
#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} ( no auth attempts in ${doNotNeed} user=<${account}>, rip=${ip}, ${doNotNeed}
|
|
|
2778 |
|
|
|
2779 |
#取得時間點跟遠端IP
|
|
|
2780 |
#函式說明：
|
|
|
2781 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
2782 |
#回傳結果:
|
|
|
2783 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2784 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
2785 |
#$result["function"],當前執行的函式名稱.
|
|
|
2786 |
#$result["argu"],所使用的參數.
|
|
|
2787 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
2788 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
2789 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
2790 |
#必填參數:
|
|
|
2791 |
#$conf["input"],字串,要檢查的字串.
|
|
|
2792 |
$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
|
|
|
2793 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
2794 |
$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} ( no auth attempts in \${doNotNeed} user=<\${account}>, rip=\${ip}, \${doNotNeed}";
|
|
|
2795 |
#可省略參數:
|
|
|
2796 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
2797 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
2798 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
2799 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
2800 |
#參考資料:
|
|
|
2801 |
#無.
|
|
|
2802 |
#備註:
|
|
|
2803 |
#無.
|
|
|
2804 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
2805 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
2806 |
|
|
|
2807 |
#如果分割失敗
|
|
|
2808 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
2809 |
|
|
|
2810 |
#設置執行失敗
|
|
|
2811 |
$result["status"]="false";
|
|
|
2812 |
|
|
|
2813 |
#設置錯誤訊息
|
|
|
2814 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
2815 |
|
|
|
2816 |
#回傳結果
|
|
|
2817 |
return $result;
|
|
|
2818 |
|
|
|
2819 |
}#if end
|
|
|
2820 |
|
|
|
2821 |
#如果沒有符合格式
|
|
|
2822 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
2823 |
|
|
|
2824 |
#跳過該行
|
|
|
2825 |
continue 2;
|
|
|
2826 |
|
|
|
2827 |
}#if end
|
|
|
2828 |
|
|
|
2829 |
#取得時間點
|
|
|
2830 |
$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
|
|
|
2831 |
|
|
|
2832 |
#取得ip
|
|
|
2833 |
$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
|
|
|
2834 |
|
|
|
2835 |
#儲存其資訊
|
|
|
2836 |
$rickyIpsOfDocecot[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
|
|
|
2837 |
|
|
|
2838 |
#跳出 switch
|
|
|
2839 |
break;
|
|
|
2840 |
|
|
|
2841 |
#不應該執行到這邊
|
|
|
2842 |
default:
|
|
|
2843 |
|
|
|
2844 |
#設置執行失敗
|
|
|
2845 |
$result["status"]="false";
|
|
|
2846 |
|
|
|
2847 |
#設置錯誤訊息
|
|
|
2848 |
$result["error"][]="unexpected error";
|
|
|
2849 |
|
|
|
2850 |
#設置錯誤訊息
|
|
|
2851 |
$result["error"][]=$findManyKeyWordsFromManyString;
|
|
|
2852 |
|
|
|
2853 |
#回傳結果
|
|
|
2854 |
return $result;
|
|
|
2855 |
|
|
|
2856 |
}#switch end
|
|
|
2857 |
|
|
|
2858 |
}#foreach end
|
|
|
2859 |
|
|
|
2860 |
#初始化儲存可能有問題的ip資訊
|
|
|
2861 |
$risky_ips=array();
|
|
|
2862 |
|
|
|
2863 |
#針對每個ip
|
|
|
2864 |
foreach($rickyIpsOfDocecot as $ip => $info){
|
|
|
2865 |
|
|
|
2866 |
#如果同樣ip不到3次
|
|
|
2867 |
if(count($rickyIpsOfDocecot[$ip])<3){
|
|
|
2868 |
|
|
|
2869 |
#換看下個ip
|
|
|
2870 |
continue;
|
|
|
2871 |
|
|
|
2872 |
}#if end
|
|
|
2873 |
|
|
|
2874 |
#儲存可能有問題的ip資訊
|
|
|
2875 |
$risky_ips[]=$rickyIpsOfDocecot[$ip];
|
|
|
2876 |
|
|
|
2877 |
}#foreach end
|
|
|
2878 |
|
|
|
2879 |
#針對每個可能有問題ip的每個log行
|
|
|
2880 |
foreach($risky_ips as $ip => $infos){
|
|
|
2881 |
|
|
|
2882 |
#初始化暫存歷史資訊的陣列
|
|
|
2883 |
$history=array();
|
|
|
2884 |
|
|
|
2885 |
#初始化記錄ip來訪不大於1分鐘的計數
|
|
|
2886 |
$count=0;
|
|
|
2887 |
|
|
|
2888 |
#針對每個log行資訊
|
|
|
2889 |
foreach($infos as $index => $info){
|
|
|
2890 |
|
|
|
2891 |
#unixtime
|
|
|
2892 |
$time=strtotime($info["time"]);
|
|
|
2893 |
|
|
|
2894 |
#如果沒有下筆記錄
|
|
|
2895 |
if(!isset($infos[$index+1])){
|
|
|
2896 |
|
|
|
2897 |
#結束 foreach
|
|
|
2898 |
break;
|
|
|
2899 |
|
|
|
2900 |
}#if end
|
|
|
2901 |
|
|
|
2902 |
#取得unixtime
|
|
|
2903 |
$next_time=strtotime($infos[$index+1]["time"]);
|
|
|
2904 |
|
|
|
2905 |
#如果時間間隔大於60秒
|
|
|
2906 |
if($next_time-$time>60){
|
|
|
2907 |
|
|
|
2908 |
#跳過,看下筆記錄
|
|
|
2909 |
continue;
|
|
|
2910 |
|
|
|
2911 |
}#if end
|
|
|
2912 |
|
|
|
2913 |
#計數+1
|
|
|
2914 |
$count++;
|
|
|
2915 |
|
|
|
2916 |
#記錄該次事件資訊
|
|
|
2917 |
$history[]=array("time"=>$time,"log"=>$info["log"]);
|
|
|
2918 |
|
|
|
2919 |
}#foreach end
|
|
|
2920 |
|
|
|
2921 |
#如果有達到3次
|
|
|
2922 |
if($count>=3){
|
|
|
2923 |
|
|
|
2924 |
#初始化陣列
|
|
|
2925 |
$tmp=array();
|
|
|
2926 |
|
|
|
2927 |
#記錄ip
|
|
|
2928 |
$tmp["ip"]=$ip;
|
|
|
2929 |
|
|
|
2930 |
#記錄歷史資訊
|
|
|
2931 |
$tmp["info"]=$history;
|
|
|
2932 |
|
|
|
2933 |
#記錄攻擊者的IP
|
|
|
2934 |
$attacker_ips_imap[]=$ip;
|
|
|
2935 |
|
|
|
2936 |
}#if end
|
|
|
2937 |
|
|
|
2938 |
}#foreach end
|
|
|
2939 |
|
|
|
2940 |
#設置結果
|
|
|
2941 |
$result["content"]=$attacker_ips_imap;
|
|
|
2942 |
|
|
|
2943 |
#設置執行正常
|
|
|
2944 |
$result["status"]="true";
|
|
|
2945 |
|
|
|
2946 |
#回傳結果
|
|
|
2947 |
return $result;
|
|
|
2948 |
|
|
|
2949 |
}#function checkDovecotAttackLog end
|
|
|
2950 |
|
|
|
2951 |
/*
|
|
|
2952 |
#函式說明:
|
|
|
2953 |
#檢查 ssh log 中疑似攻擊的記錄.
|
|
|
2954 |
#回傳結果:
|
|
|
2955 |
#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2956 |
#$result["error"],錯誤訊息陣列.
|
|
|
2957 |
#$result["function"],字串,當前執行的函式名稱.
|
|
|
2958 |
#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
|
|
|
2959 |
#必填參數:
|
|
|
2960 |
#無.
|
|
|
2961 |
#可省略參數:
|
|
|
2962 |
#無
|
|
|
2963 |
#參考資料:
|
|
|
2964 |
#無.
|
|
|
2965 |
#備註:
|
|
|
2966 |
#無.
|
|
|
2967 |
*/
|
|
|
2968 |
public static function checkSshAttackLog(){
|
|
|
2969 |
|
|
|
2970 |
#初始化要回傳的結果
|
|
|
2971 |
$result=array();
|
|
|
2972 |
|
|
|
2973 |
#取得當前執行的函數名稱
|
|
|
2974 |
$result["function"]=__FUNCTION__;
|
|
|
2975 |
|
|
|
2976 |
#記錄ssh攻擊者的IP
|
|
|
2977 |
$attacker_ips_ssh=array();
|
|
|
2978 |
|
|
|
2979 |
#透過 journalctl -a -e --unit=sshd.service來取得 ssh 攻擊者的 IP
|
|
|
2980 |
#函式說明:
|
|
|
2981 |
#呼叫shell執行系統命令,並取得回傳的內容.
|
|
|
2982 |
#回傳的結果:
|
|
|
2983 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
2984 |
#$result["error"],錯誤訊息陣列.
|
|
|
2985 |
#$result["function"],當前執行的函式名稱.
|
|
|
2986 |
#$result["argu"],使用的參數.
|
|
|
2987 |
#$result["cmd"],執行的指令內容.
|
|
|
2988 |
#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2989 |
#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
|
|
|
2990 |
#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
|
|
|
2991 |
#$result["running"],是否還在執行.
|
|
|
2992 |
#$result["pid"],pid.
|
|
|
2993 |
#$result["statusCode"],執行結束後的代碼.
|
|
|
2994 |
#必填參數:
|
|
|
2995 |
#$conf["command"],字串,要執行的指令與.
|
|
|
2996 |
$conf["external::callShell"]["command"]="journalctl";
|
|
|
2997 |
#$conf["fileArgu"],字串,變數__FILE__的內容.
|
|
|
2998 |
$conf["external::callShell"]["fileArgu"]=__FILE__;
|
|
|
2999 |
#可省略參數:
|
|
|
3000 |
#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
|
|
|
3001 |
$conf["external::callShell"]["argu"]=array("-a","-e","--unit=sshd.service");
|
|
|
3002 |
#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
|
|
|
3003 |
#$conf["arguIsAddr"]=array();
|
|
|
3004 |
#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
|
|
|
3005 |
#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
|
|
|
3006 |
#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
|
|
|
3007 |
#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
|
|
|
3008 |
#$conf["enablePrintDescription"]="true";
|
|
|
3009 |
#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
|
|
|
3010 |
#$conf["printDescription"]="";
|
|
|
3011 |
#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
|
|
|
3012 |
$conf["external::callShell"]["escapeshellarg"]="true";
|
|
|
3013 |
#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
|
|
|
3014 |
#$conf["username"]="";
|
|
|
3015 |
#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
|
|
|
3016 |
#$conf["password"]="";
|
|
|
3017 |
#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
|
|
|
3018 |
#$conf["useScript"]="";
|
|
|
3019 |
#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
|
|
|
3020 |
#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
|
|
|
3021 |
#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
|
|
|
3022 |
#$conf["inBackGround"]="";
|
|
|
3023 |
#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
|
|
|
3024 |
#$conf["getErr"]="false";
|
|
|
3025 |
#備註:
|
|
|
3026 |
#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
|
|
|
3027 |
#參考資料：
|
|
|
3028 |
#exec=>http://php.net/manual/en/function.exec.php
|
|
|
3029 |
#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
|
|
|
3030 |
#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
|
|
|
3031 |
$callShell=external::callShell($conf["external::callShell"]);
|
|
|
3032 |
unset($conf["external::callShell"]);
|
|
|
3033 |
|
|
|
3034 |
#如果執行失敗
|
|
|
3035 |
if($callShell["status"]==="false"){
|
|
|
3036 |
|
|
|
3037 |
#如果有 statusCode
|
|
|
3038 |
if(isset($callShell["statusCode"])){
|
|
|
3039 |
|
|
|
3040 |
#如果shell回傳不為0也不為1
|
|
|
3041 |
if($callShell["statusCode"]!==0 && $callShell["statusCode"]!==1){
|
|
|
3042 |
|
|
|
3043 |
#設置執行失敗
|
|
|
3044 |
$result["status"]="false";
|
|
|
3045 |
|
|
|
3046 |
#設置錯誤訊息
|
|
|
3047 |
$result["error"]=$callShell;
|
|
|
3048 |
|
|
|
3049 |
#回傳結果
|
|
|
3050 |
return $result;
|
|
|
3051 |
|
|
|
3052 |
}#if end
|
|
|
3053 |
|
|
|
3054 |
}#if end
|
|
|
3055 |
|
|
|
3056 |
#設置執行失敗
|
|
|
3057 |
$result["status"]="false";
|
|
|
3058 |
|
|
|
3059 |
#設置錯誤訊息
|
|
|
3060 |
$result["error"]=$callShell;
|
|
|
3061 |
|
|
|
3062 |
#回傳結果
|
|
|
3063 |
return $result;
|
|
|
3064 |
|
|
|
3065 |
}#if end
|
|
|
3066 |
|
|
|
3067 |
/*
|
|
|
3068 |
得到的範例輸出
|
|
|
3069 |
Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: Invalid user lizepeng from 60.213.10.69 port 39156
|
|
|
3070 |
Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: pam_unix(sshd:auth): check pass; user unknown
|
|
|
3071 |
Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.69
|
|
|
3072 |
Sep 30 00:36:38 silverblue-guest.qbpwcf.org sshd-session[1607010]: Failed password for invalid user lizepeng from 60.213.10.69 port 39156 ssh2
|
|
|
3073 |
Sep 30 00:36:40 silverblue-guest.qbpwcf.org sshd-session[1607010]: Connection closed by invalid user lizepeng 60.213.10.69 port 39156 [preauth]
|
|
|
3074 |
Sep 30 05:54:01 silverblue-guest.qbpwcf.org sshd-session[2346022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.81 user=root
|
|
|
3075 |
Sep 30 05:54:03 silverblue-guest.qbpwcf.org sshd-session[2346022]: Failed password for root from 60.213.10.81 port 41644 ssh2
|
|
|
3076 |
Sep 30 05:54:04 silverblue-guest.qbpwcf.org sshd-session[2346022]: Connection closed by authenticating user root 60.213.10.81 port 41644 [preauth]
|
|
|
3077 |
Sep 30 05:54:20 silverblue-guest.qbpwcf.org sshd-session[2346860]: Invalid user qy from 60.213.10.81 port 42960
|
|
|
3078 |
Sep 30 05:54:21 silverblue-guest.qbpwcf.org sshd-session[2346860]: pam_unix(sshd:auth): check pass; user unknown
|
|
|
3079 |
Sep 30 05:54:21 silverblue-guest.qbpwcf.org sshd-session[2346860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.81
|
|
|
3080 |
Sep 30 05:54:22 silverblue-guest.qbpwcf.org sshd-session[2346860]: Failed password for invalid user qy from 60.213.10.81 port 42960 ssh2
|
|
|
3081 |
Sep 30 05:54:23 silverblue-guest.qbpwcf.org sshd-session[2346860]: Connection closed by invalid user qy 60.213.10.81 port 42960 [preauth]
|
|
|
3082 |
Sep 30 06:08:06 silverblue-guest.qbpwcf.org sshd-session[2378295]: Connection closed by 167.94.145.105 port 55712 [preauth]
|
|
|
3083 |
Sep 30 08:09:51 silverblue-guest.qbpwcf.org sshd-session[2662907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.13.207.69 user=root
|
|
|
3084 |
Sep 30 08:09:54 silverblue-guest.qbpwcf.org sshd-session[2662907]: Failed password for root from 183.13.207.69 port 18258 ssh2
|
|
|
3085 |
Sep 30 08:09:54 silverblue-guest.qbpwcf.org sshd-session[2662907]: Connection closed by authenticating user root 183.13.207.69 port 18258 [preauth]
|
|
|
3086 |
Sep 30 08:10:11 silverblue-guest.qbpwcf.org sshd-session[2663658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.13.207.69 user=root
|
|
|
3087 |
Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Failed password for root from 183.13.207.69 port 17293 ssh2
|
|
|
3088 |
Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Connection closed by authenticating user root 183.13.207.69 port 17293 [preauth]
|
|
|
3089 |
*/
|
|
|
3090 |
|
|
|
3091 |
#認證失敗的關鍵字
|
|
|
3092 |
$keyWordFP=" Failed password ";
|
|
|
3093 |
|
|
|
3094 |
#不存在使用者的關鍵字
|
|
|
3095 |
$keyWordIU=" Invalid user ";
|
|
|
3096 |
|
|
|
3097 |
#搜尋符合關鍵字的log行
|
|
|
3098 |
#函式說明:
|
|
|
3099 |
#檢查多個字串中的每個字串是否有多個關鍵字
|
|
|
3100 |
#回傳結果:
|
|
|
3101 |
#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
|
|
|
3102 |
#$result["function"],當前執行的函數名稱.
|
|
|
3103 |
#$result["error"],錯誤訊息.
|
|
|
3104 |
#$result["argu"],使用的參數.
|
|
|
3105 |
#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
|
|
|
3106 |
#$result["foundedKeyWords"],找到的關鍵字陣列.
|
|
|
3107 |
#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
|
|
|
3108 |
#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
|
|
|
3109 |
#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
|
|
|
3110 |
#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
|
|
|
3111 |
#必填參數:
|
|
|
3112 |
#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
|
|
|
3113 |
$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array($keyWordFP,$keyWordIU);
|
|
|
3114 |
#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
|
|
|
3115 |
$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
|
|
|
3116 |
#可省略參數:
|
|
|
3117 |
#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
|
|
|
3118 |
#$conf["completeEqual"]="true";
|
|
|
3119 |
#參考資料:
|
|
|
3120 |
#無.
|
|
|
3121 |
#備註:
|
|
|
3122 |
#無.
|
|
|
3123 |
$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
3124 |
unset($conf["search::findManyKeyWordsFromManyString"]);
|
|
|
3125 |
|
|
|
3126 |
#如果執行失敗
|
|
|
3127 |
if($findManyKeyWordsFromManyString["status"]==="false"){
|
|
|
3128 |
|
|
|
3129 |
#設置執行失敗
|
|
|
3130 |
$result["status"]="false";
|
|
|
3131 |
|
|
|
3132 |
#設置錯誤訊息
|
|
|
3133 |
$result["error"]=$findManyKeyWordsFromManyString;
|
|
|
3134 |
|
|
|
3135 |
#回傳結果
|
|
|
3136 |
return $result;
|
|
|
3137 |
|
|
|
3138 |
}#if end
|
|
|
3139 |
|
|
|
3140 |
#初始化儲存可能有問題的存取ssh服務遠端ip
|
|
|
3141 |
$risky_ips=array();
|
|
|
3142 |
|
|
|
3143 |
#針對每個符合的log行
|
|
|
3144 |
foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $index => $oriLog){
|
|
|
3145 |
|
|
|
3146 |
#找到的關鍵字
|
|
|
3147 |
$foundKeyWord=$findManyKeyWordsFromManyString["foundedTrueKeyWords"][$index][0];
|
|
|
3148 |
|
|
|
3149 |
#依照符合的關鍵字
|
|
|
3150 |
switch($foundKeyWord){
|
|
|
3151 |
|
|
|
3152 |
#如果是秘密碼錯誤
|
|
|
3153 |
case $keyWordFP:
|
|
|
3154 |
|
|
|
3155 |
#範例
|
|
|
3156 |
#Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Failed password for root from 183.13.207.69 port 17293 ssh2
|
|
|
3157 |
#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} Failed password for ${account} from ${ip} ${doNotNeed}
|
|
|
3158 |
|
|
|
3159 |
#取得時間點跟遠端IP
|
|
|
3160 |
#函式說明：
|
|
|
3161 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
3162 |
#回傳結果:
|
|
|
3163 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
3164 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
3165 |
#$result["function"],當前執行的函式名稱.
|
|
|
3166 |
#$result["argu"],所使用的參數.
|
|
|
3167 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
3168 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
3169 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
3170 |
#必填參數:
|
|
|
3171 |
#$conf["input"],字串,要檢查的字串.
|
|
|
3172 |
$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
|
|
|
3173 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
3174 |
$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} Failed password for \${account} from \${ip} \${doNotNeed}";
|
|
|
3175 |
#可省略參數:
|
|
|
3176 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
3177 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
3178 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
3179 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
3180 |
#參考資料:
|
|
|
3181 |
#無.
|
|
|
3182 |
#備註:
|
|
|
3183 |
#無.
|
|
|
3184 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
3185 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
3186 |
|
|
|
3187 |
#如果分割失敗
|
|
|
3188 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
3189 |
|
|
|
3190 |
#設置執行失敗
|
|
|
3191 |
$result["status"]="false";
|
|
|
3192 |
|
|
|
3193 |
#設置錯誤訊息
|
|
|
3194 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
3195 |
|
|
|
3196 |
#回傳結果
|
|
|
3197 |
return $result;
|
|
|
3198 |
|
|
|
3199 |
}#if end
|
|
|
3200 |
|
|
|
3201 |
#如果沒有符合格式
|
|
|
3202 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
3203 |
|
|
|
3204 |
#跳過該行
|
|
|
3205 |
continue 2;
|
|
|
3206 |
|
|
|
3207 |
}#if end
|
|
|
3208 |
|
|
|
3209 |
#取得時間點
|
|
|
3210 |
$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
|
|
|
3211 |
|
|
|
3212 |
#取得ip
|
|
|
3213 |
$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
|
|
|
3214 |
|
|
|
3215 |
#儲存其資訊
|
|
|
3216 |
$risky_ips[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
|
|
|
3217 |
|
|
|
3218 |
#跳出 switch
|
|
|
3219 |
break;
|
|
|
3220 |
|
|
|
3221 |
#如果是不存在的使用者
|
|
|
3222 |
case $keyWordIU:
|
|
|
3223 |
|
|
|
3224 |
#範例
|
|
|
3225 |
#Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: Invalid user lizepeng from 60.213.10.69 port 39156
|
|
|
3226 |
#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} Invalid user ${account} from ${ip} port ${doNotNeed}
|
|
|
3227 |
|
|
|
3228 |
#取得時間點跟遠端IP
|
|
|
3229 |
#函式說明：
|
|
|
3230 |
#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
|
|
|
3231 |
#回傳結果:
|
|
|
3232 |
#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
|
|
|
3233 |
#$reuslt["error"],執行不正常結束的錯訊息陣列.
|
|
|
3234 |
#$result["function"],當前執行的函式名稱.
|
|
|
3235 |
#$result["argu"],所使用的參數.
|
|
|
3236 |
#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
|
|
|
3237 |
#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
|
|
|
3238 |
#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
|
|
|
3239 |
#必填參數:
|
|
|
3240 |
#$conf["input"],字串,要檢查的字串.
|
|
|
3241 |
$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
|
|
|
3242 |
#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
|
|
|
3243 |
$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} Invalid user \${account} from \${ip} port \${doNotNeed}";
|
|
|
3244 |
#可省略參數:
|
|
|
3245 |
#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
|
|
|
3246 |
#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
|
|
|
3247 |
#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
|
|
|
3248 |
#$conf["varCon"]=array("no_tail"=>" not");
|
|
|
3249 |
#參考資料:
|
|
|
3250 |
#無.
|
|
|
3251 |
#備註:
|
|
|
3252 |
#無.
|
|
|
3253 |
$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
|
|
|
3254 |
unset($conf["search::findSpecifyStrFormat"]);
|
|
|
3255 |
|
|
|
3256 |
#如果分割失敗
|
|
|
3257 |
if($findSpecifyStrFormat["status"]==="false"){
|
|
|
3258 |
|
|
|
3259 |
#設置執行失敗
|
|
|
3260 |
$result["status"]="false";
|
|
|
3261 |
|
|
|
3262 |
#設置錯誤訊息
|
|
|
3263 |
$result["error"]=$findSpecifyStrFormat;
|
|
|
3264 |
|
|
|
3265 |
#回傳結果
|
|
|
3266 |
return $result;
|
|
|
3267 |
|
|
|
3268 |
}#if end
|
|
|
3269 |
|
|
|
3270 |
#如果沒有符合格式
|
|
|
3271 |
if($findSpecifyStrFormat["found"]==="false"){
|
|
|
3272 |
|
|
|
3273 |
#跳過該行
|
|
|
3274 |
continue 2;
|
|
|
3275 |
|
|
|
3276 |
}#if end
|
|
|
3277 |
|
|
|
3278 |
#取得時間點
|
|
|
3279 |
$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
|
|
|
3280 |
|
|
|
3281 |
#取得ip
|
|
|
3282 |
$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
|
|
|
3283 |
|
|
|
3284 |
#儲存其資訊
|
|
|
3285 |
$risky_ips[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
|
|
|
3286 |
|
|
|
3287 |
#跳出 switch
|
|
|
3288 |
break;
|
|
|
3289 |
|
|
|
3290 |
#不應該執行到這邊
|
|
|
3291 |
default:
|
|
|
3292 |
|
|
|
3293 |
#設置執行失敗
|
|
|
3294 |
$result["status"]="false";
|
|
|
3295 |
|
|
|
3296 |
#設置錯誤訊息
|
|
|
3297 |
$result["error"][]="unexpected error";
|
|
|
3298 |
|
|
|
3299 |
#設置錯誤訊息
|
|
|
3300 |
$result["error"][]=$findManyKeyWordsFromManyString;
|
|
|
3301 |
|
|
|
3302 |
#回傳結果
|
|
|
3303 |
return $result;
|
|
|
3304 |
|
|
|
3305 |
}#switch end
|
|
|
3306 |
|
|
|
3307 |
}#foreach end
|
|
|
3308 |
|
|
|
3309 |
#針對每個可能有問題ip的每個log行
|
|
|
3310 |
foreach($risky_ips as $ip => $infos){
|
|
|
3311 |
|
|
|
3312 |
#初始化暫存歷史記錄的陣列
|
|
|
3313 |
$history=array();
|
|
|
3314 |
|
|
|
3315 |
#初始化記錄ip來訪不大於1分鐘的計數
|
|
|
3316 |
$count=0;
|
|
|
3317 |
|
|
|
3318 |
#針對每個log行資訊
|
|
|
3319 |
foreach($infos as $index => $info){
|
|
|
3320 |
|
|
|
3321 |
#unixtime
|
|
|
3322 |
$time=strtotime($info["time"]);
|
|
|
3323 |
|
|
|
3324 |
#如果沒有下筆記錄
|
|
|
3325 |
if(!isset($infos[$index+1])){
|
|
|
3326 |
|
|
|
3327 |
#結束 foreach
|
|
|
3328 |
break;
|
|
|
3329 |
|
|
|
3330 |
}#if end
|
|
|
3331 |
|
|
|
3332 |
#取得unixtime
|
|
|
3333 |
$next_time=strtotime($infos[$index+1]["time"]);
|
|
|
3334 |
|
|
|
3335 |
#如果下筆時間記錄與當前這筆間隔大於60秒
|
|
|
3336 |
if($next_time-$time>60){
|
|
|
3337 |
|
|
|
3338 |
#跳過,看下筆記錄
|
|
|
3339 |
continue;
|
|
|
3340 |
|
|
|
3341 |
}#if end
|
|
|
3342 |
|
|
|
3343 |
#計數+1
|
|
|
3344 |
$count++;
|
|
|
3345 |
|
|
|
3346 |
#記錄該次記錄
|
|
|
3347 |
$history[]=array("time"=>$time,"log"=>$info["log"]);
|
|
|
3348 |
|
|
|
3349 |
}#foreach end
|
|
|
3350 |
|
|
|
3351 |
#如果有達到3次
|
|
|
3352 |
if($count>=3){
|
|
|
3353 |
|
|
|
3354 |
#初始化暫存的陣列
|
|
|
3355 |
$tmp=array();
|
|
|
3356 |
|
|
|
3357 |
#取得資訊
|
|
|
3358 |
$tmp["info"]=$history;
|
|
|
3359 |
|
|
|
3360 |
#取得問題ip
|
|
|
3361 |
$tmp["ip"]=$ip;
|
|
|
3362 |
|
|
|
3363 |
#記錄攻擊者的IP
|
|
|
3364 |
$attacker_ips_ssh[]=$tmp;
|
|
|
3365 |
|
|
|
3366 |
}#if end
|
|
|
3367 |
|
|
|
3368 |
}#foreach end
|
|
|
3369 |
|
|
|
3370 |
#設置結果
|
|
|
3371 |
$result["content"]=$attacker_ips_ssh;
|
|
|
3372 |
|
|
|
3373 |
#設置執行正常
|
|
|
3374 |
$result["status"]="true";
|
|
|
3375 |
|
|
|
3376 |
#回傳結果
|
|
|
3377 |
return $result;
|
|
|
3378 |
|
|
|
3379 |
}#function checkSshAttackLog end
|
|
|
3380 |
|
| 3 |
liveuser |
3381 |
}#class security end
|
|
|
3382 |
|
|
|
3383 |
?>
|