WebSVN – php-qbpwcf – Diff – /trunk/usr/lib/qbpwcf/cmd.php

 			#回傳結果
 			return $result;
 			}#if end
-		#取得 http 存取記錄的 log
-		#函式說明:
-		#檢查指令的輸出是否含有關鍵字
-		#回傳結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息.
-		#$result["function"],當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["grepCmd"],截取關鍵字的指令.
-		#$result["founded"],是否找到關鍵字,"true"代表有,"false"代表沒有.
-		#$result["content"],關鍵字所在列的輸出.
-		#$result["count"],輸出的列數.
-		#必填參數:
-		#$conf["cmd"],字串,要執行的指令.
-		$conf["cmd::searchOutPut"]["cmd"]="cat";
-		#$conf["keyWord"],字串,要檢查是否有關鍵字.
-		$conf["cmd::searchOutPut"]["keyWord"]=" 404 ";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["cmd::searchOutPut"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["binPath"],字串,應用程式的路徑,預設為"/usr/bin".
-		#$conf["binPath"]="";
-		#$conf["argu"],陣列字串,指令搭配的參數,預設不使用.
-		$conf["cmd::searchOutPut"]["argu"]=array($conf["logPath"]."/access_log");
-		#$conf["excludeGrep"],字串,"true"代表排除含有 " | grep ".$conf["keyWord"] 字樣的輸出;預設為"false",不排除.
-		#$conf["excludeGrep"]="false";
-		#如果有設置 username
-		if(isset($conf["username"])){
-			#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-			$conf["cmd::searchOutPut"]["username"]=$conf["username"];
-			}#if end
-		#如果有設置 password
-		if(isset($conf["password"])){
-			#$conf["password"],字串,與$conf["username"]搭配的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-			$conf["cmd::searchOutPut"]["password"]=$conf["password"];
-			}#if end
-		$searchOutPut=cmd::searchOutPut($conf["cmd::searchOutPut"]);
-		unset($conf["cmd::searchOutPut"]);
-		#如果執行失敗
-		if($searchOutPut["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$searchOutPut;
-			#回傳結果
-			return $result;
-			}#if end
-		#過濾掉對於含有 ".css" ".js" "favicon.ico" ".jpg" ".png" 關鍵字串的結果.
-		#函式說明:
-		#檢查多個字串中的每個字串是否有多個關鍵字
-		#回傳的結果：
-		#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
-		#$result["function"],當前執行的函式名稱.
-		#$result["error"],錯誤訊息.
-		#$result["argu"],使用的參數.
-		#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列.
-		#$result["foundedKeyWords"].找到的關鍵字.
-		#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列.
-		#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
-		#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
-		#必填參數：
-		$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array(".css",".js","favicon.ico",".jpg",".png");#想要搜尋的關鍵字
-		$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$searchOutPut["content"];#要被搜尋的字串內容陣列
-		#可省略參數：
-		#$conf["completeEqual"]="true";#是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
-		$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
-		unset($conf["search::findManyKeyWordsFromManyString"]);
-		#如果執行出錯
-		if($findManyKeyWordsFromManyString["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$findManyKeyWordsFromManyString;
-			#回傳結果
-			return $result;
-			}#if end
-		#取得不含有 ".css" ".js" "favicon.ico" ".jpg" ".png" 關鍵字串的結果.
-		$searchOutPut["content"]=$findManyKeyWordsFromManyString["foundedFalseKey"];
-		#更新計數
-		$searchOutPut["count"]=count($searchOutPut["content"]);
-		#用空格分割字串
-		#函式說明:
-		#將多個固定格式的字串分開，並回傳分開的結果
-		#回傳的參數：
-		#$result["status"],執行成功與否，若爲"true"，代表執行成功，若爲"false"代表執失敗。
-		#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
-		#$result["spiltString"][$i]["oriStr"]，爲第i個字串的原始內容
-		#$result["spiltString"][$i]["dataArray"]，爲第($i+1)個字串分割後的字串陣列
-		#$result["spiltString"][$i]["dataArray"][$j]，爲第($i+1)的分割好的字串的第($j+1)段內容
-		#$result["spiltString"][$i]["dataCounts"]，爲第($i+1)個字串分割後總共分成幾段
-		#必填參數：
-		#$conf["stringIn"],字串陣列,要處理的字串陣列.
-		$conf["stringProcess::spiltMutiString"]["stringIn"]=$searchOutPut["content"];
-		#$conf["spiltSymbol"],字串,爲要以哪個符號作爲分割.
-		$conf["stringProcess::spiltMutiString"]["spiltSymbol"]=" ";
-		$spiltMutiString=stringProcess::spiltMutiString($conf["stringProcess::spiltMutiString"]);
-		unset($conf["stringProcess::spiltMutiString"]);
-		#如果分割失敗
-		if($spiltMutiString["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$spiltMutiString;
-			#回傳結果
-			return $result;
-			}#if end
-		#初始化儲存有問題IP的陣列
+		#初始化要檢查的服務清單
-		$ips=array();
-		#初始化儲存可能有問題的IP陣列
-		$ips_byIp=array();
+		$service2check=array();
-		#針對每行內容
-		for($i=0;$i<$searchOutPut["count"];$i++){
-			#如果沒有分割出來的內容
-			if($spiltMutiString["spiltString"][$i]["dataCounts"]===0){
-				#換下一個
-				continue;
-				}#if end
-			#有問題的資訊
-			$info=array();
-			#設置問題對應的log行內容
-			$info["log"]=$spiltMutiString["spiltString"][$i]["oriStr"];
-			#設置問題時間點
-			$info["time"]=$spiltMutiString["spiltString"][$i]["dataArray"][3];
-			#記錄有問題的ip
-			$info["ip"]=$spiltMutiString["spiltString"][$i]["dataArray"][0];
-			#取得可能有問題的IP位置資訊
-			$ips_byIp[$spiltMutiString["spiltString"][$i]["dataArray"][0]][]=$info;
-			}#for end
-		#針對每個可能有問題的IP
-		foreach($ips_byIp as $ip => $infos){
-			#計數 ip 於同時間前來的計數
-			$ipSameTimeCount=0;
-			#用來存放來存取的同一時間
-			$ipSameTime="";
-			#看來拜訪的時間點
-			foreach($infos as $info){
-				#如果是初次
-				if($ipSameTime===""){
-					#記錄時間點
-					$ipSameTime=$info["time"];
-					#同時間點計數加1
-					$ipSameTimeCount++;
-					}#if end
-				#反之如果時間點相同
-				else if($ipSameTime===$info["time"]){
-					#同時間點計數加1
+		#新增 http 服務
-					$ipSameTimeCount++;
+		$service2check[]="http";
-					}#if end
+		#新增 https 服務
+		$service2check[]="https";
-				#反之時間點不相同
+		#新增 postfix 服務
-				else{
+		$service2check[]="postfix";
-					#記錄時間點
+		#新增 named 服務
-					$ipSameTime=$info["time"];
+		$service2check[]="named";
-					#同時間點計數重設為1
+		#新增 docevot 服務
-					$ipSameTimeCount=1;
+		$service2check[]="dovecot";
-					}#else end
+		#新增 ssh 服務
+		$service2check[]="ssh";
-				#如果同時間的計數達到3
+		#針對每個要檢查的服務
-				if($ipSameTimeCount===3){
+		foreach($service2check as $index => $serviceName){
-					#初始化暫存的陣列
+			#判斷服務的名稱
+			switch($serviceName){
+				#如果是 http 服務
-					$tmp=array();
+				case "http":
-					#儲存資訊
+					#函式說明:
+					#檢查 apache http(s) log 中疑似攻擊的記錄.
+					#回傳結果:
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["error"],錯誤訊息陣列.
+					#$result["function"],字串,當前執行的函式名稱.
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
+					#必填參數:
+					#無.
+					#可省略參數:
+					#$conf["logPath"],http log的路徑,預設為"/var/log/httpd".
+					$conf["cmd::checkHttpAttackLog"]["logPath"]=$conf["logPath"];
+					#$conf["https"],字串,是否為要查https的log,預設為"false"，代表為http.
-					$tmp["info"]=$infos;
+					#$conf["https"]="false";
+					#參考資料:
+					#無.
+					#備註:
+					#目前僅支援 apache 提供的 http 服務.
+					#攻擊者的定義為http回應的code為4開頭,且時間間隔不超過1秒鐘,次數達到3次.
+					$checkHttpAttackLog=security::checkHttpAttackLog($conf["cmd::checkHttpAttackLog"]);
+					unset($conf["cmd::checkHttpAttackLog"]);
-					#儲存ip
-					$tmp["ip"]=$info["ip"];
-					#取得有問題的IP
-					$ips[]=$tmp;
-					#換檢查下一個IP
-					continue 2;
-					}#if end
-				}#foreach end
-			}#foreach end
-		#取得 https 存取記錄的 log
-		#函式說明:
-		#檢查指令的輸出是否含有關鍵字
-		#回傳結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息.
-		#$result["function"],當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["grepCmd"],截取關鍵字的指令.
-		#$result["founded"],是否找到關鍵字,"true"代表有,"false"代表沒有.
-		#$result["content"],關鍵字所在列的輸出.
-		#$result["count"],輸出的列數.
-		#必填參數:
-		#$conf["cmd"],字串,要執行的指令.
-		$conf["cmd::searchOutPut"]["cmd"]="cat";
-		#$conf["keyWord"],字串,要檢查是否有關鍵字.
-		$conf["cmd::searchOutPut"]["keyWord"]=" 404 ";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["cmd::searchOutPut"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["binPath"],字串,應用程式的路徑,預設為"/usr/bin".
-		#$conf["binPath"]="";
-		#$conf["argu"],陣列字串,指令搭配的參數,預設不使用.
-		$conf["cmd::searchOutPut"]["argu"]=array($conf["logPath"]."/ssl_access_log");
-		#$conf["excludeGrep"],字串,"true"代表排除含有 " | grep ".$conf["keyWord"] 字樣的輸出;預設為"false",不排除.
-		#$conf["excludeGrep"]="false";
-		#如果有設置 username
-		if(isset($conf["username"])){
-			#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-			$conf["cmd::searchOutPut"]["username"]=$conf["username"];
-			}#if end
-		#如果有設置 password
-		if(isset($conf["password"])){
-			#$conf["password"],字串,與$conf["username"]搭配的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-			$conf["cmd::searchOutPut"]["password"]=$conf["password"];
-			}#if end
-		$searchOutPut=cmd::searchOutPut($conf["cmd::searchOutPut"]);
-		unset($conf["cmd::searchOutPut"]);
-		#如果執行失敗
-		if($searchOutPut["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$searchOutPut;
-			#回傳結果
-			return $result;
-			}#if end
-		#過濾掉對於含有 ".css",".js","favicon.ico",".jpg",".png" 關鍵字串的結果.
-		#函式說明:
-		#檢查多個字串中的每個字串是否有多個關鍵字
-		#回傳的結果:
-		#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
-		#$result["function"],當前執行的函式名稱.
-		#$result["error"],錯誤訊息.
-		#$result["argu"],使用的參數.
-		#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列.
-		#$result["foundedKeyWords"].找到的關鍵字.
-		#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列.
-		#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
-		#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
-		#必填參數：
-		$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array(".css",".js","favicon.ico",".jpg",".png");#想要搜尋的關鍵字
-		$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$searchOutPut["content"];#要被搜尋的字串內容陣列
-		#可省略參數：
-		#$conf["completeEqual"]="true";#是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
-		$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
-		unset($conf["search::findManyKeyWordsFromManyString"]);
-		#如果執行出錯
+					#如果執行異常
-		if($findManyKeyWordsFromManyString["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$findManyKeyWordsFromManyString;
-			#回傳結果
-			return $result;
-			}#if end
-		#取得不含有 ".css",".js","favicon.ico",".jpg",".png" 關鍵字串的結果.
-		$searchOutPut["content"]=$findManyKeyWordsFromManyString["foundedFalseKey"];
-		#更新計數
-		$searchOutPut["count"]=count($searchOutPut["content"]);
-		#用空格分割字串
-		#函式說明:
-		#將多個固定格式的字串分開，並回傳分開的結果
-		#回傳的參數：
-		#$result["status"],執行成功與否，若爲"true"，代表執行成功，若爲"false"代表執失敗。
-		#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
-		#$result["spiltString"][$i]["oriStr"]，爲第i個字串的原始內容
-		#$result["spiltString"][$i]["dataArray"]，爲第($i+1)個字串分割後的字串陣列
-		#$result["spiltString"][$i]["dataArray"][$j]，爲第($i+1)的分割好的字串的第($j+1)段內容
-		#$result["spiltString"][$i]["dataCounts"]，爲第($i+1)個字串分割後總共分成幾段
-		#必填參數：
-		#$conf["stringIn"],字串陣列,要處理的字串陣列.
-		$conf["stringProcess::spiltMutiString"]["stringIn"]=$searchOutPut["content"];
-		#$conf["spiltSymbol"],字串,爲要以哪個符號作爲分割.
-		$conf["stringProcess::spiltMutiString"]["spiltSymbol"]=" ";
-		$spiltMutiString=stringProcess::spiltMutiString($conf["stringProcess::spiltMutiString"]);
-		unset($conf["stringProcess::spiltMutiString"]);
-		#如果分割失敗
-		if($spiltMutiString["status"]==="false"){
+					if($checkHttpAttackLog["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$spiltMutiString;
-			#回傳結果
-			return $result;
-			}#if end
-		#初始化儲存有問題IP的陣列
-		$ips_https=array();
-		#初始化儲存可能有問題的IP陣列
-		$ips_byIp_https=array();
-		#針對每行內容
-		for($i=0;$i<$searchOutPut["count"];$i++){
-			#如果沒有分割出來的內容
-			if($spiltMutiString["spiltString"][$i]["dataCounts"]===0){
-				#換下一個
-				continue;
-				}#if end
-			#有問題的資訊
-			$info=array();
-			#設置問題對應的log行內容
-			$info["log"]=$spiltMutiString["spiltString"][$i]["oriStr"];
-			#設置問題時間點
-			$info["time"]=$spiltMutiString["spiltString"][$i]["dataArray"][3];
-			#記錄有問題的ip
-			$info["ip"]=$spiltMutiString["spiltString"][$i]["dataArray"][0];
-			#取得可能有問題的IP位置,key為[ip][int]
-			$ips_byIp_https[$spiltMutiString["spiltString"][$i]["dataArray"][0]][]=$info;
-			}#for end
-		#debug
-		#var_dump(__LINE__,"http待整理的可能有問題IP清單",$ips_byIp_https);
-		#針對每個可能有問題的IP
-		foreach($ips_byIp_https as $infos){
-			#計數 ip 於同時間前來的計數
-			$ipSameTimeCount=0;
-			#用來存放來存取的同一時間
-			$ipSameTime="";
-			#看來拜訪的時間點
-			foreach($infos as $info){
-				#如果是初次
-				if($ipSameTime===""){
-					#記錄時間點
+						#設置執行失敗
-					$ipSameTime=$info["time"];
-					#同時間點計數加1
-					$ipSameTimeCount++;
-					}#if end
-				#反之如果時間點相同
-				else if($ipSameTime===$info["time"]){
-					#同時間點計數加1
-					$ipSameTimeCount++;
-					}#if end
-				#反之時間點不相同
-				else{
-					#記錄時間點
-					$ipSameTime=$info["time"];
+						$result["status"]="false";
-					#同時間點計數重設為1
-					$ipSameTimeCount=1;
-					}#else end
-				#如果同時間的計數達到3
+						#設置錯誤訊息
-				if($ipSameTimeCount===3){
+						$result["error"]=$checkHttpAttackLog;
-					#初始化暫存的陣列
+						#回傳結果
-					$tmp=array();
+						return $result;
-					#取得事件資訊
-					$tmp["info"]=$infos;
+						}#if end
-					#取得ip
-					$tmp["ip"]=$info["ip"];
-					#取得有問題的IP資訊
+					#取得有問題的 http log 記錄
-					$ips_https[]=$tmp;
-					#換檢查下一個IP
-					continue 2;
-					}#if end
-				}#foreach end
-			}#foreach end
-		#debug
-		#var_dump(__LINE__,"http有問題IP清單",$ips_https);
-		#透過 journalctl -a -e -f --unit=postfix.service | grep "authentication failed" 來取得認證失敗的 ip
-		#函式說明:
-		#呼叫shell執行系統命令,並取得回傳的內容.
-		#回傳的結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["cmd"],執行的指令內容.
-		#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
-		#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["running"],是否還在執行.
-		#$result["pid"],pid.
-		#$result["statusCode"],執行結束後的代碼.
-		#必填參數:
-		#$conf["command"],字串,要執行的指令與.
-		$conf["external::callShell"]["command"]="journalctl";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["external::callShell"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
-		$conf["external::callShell"]["argu"]=array("-a","-e","--unit=postfix.service","|","grep","authentication failed");
-		#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
-		#$conf["arguIsAddr"]=array();
-		#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
-		#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
-		#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
-		#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
-		#$conf["enablePrintDescription"]="true";
-		#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
-		#$conf["printDescription"]="";
-		#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
-		$conf["external::callShell"]["escapeshellarg"]="true";
-		#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-		#$conf["username"]="";
-		#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-		#$conf["password"]="";
-		#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
-		#$conf["useScript"]="";
-		#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
-		#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
-		#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
-		#$conf["inBackGround"]="";
-		#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
-		#$conf["getErr"]="false";
-		#備註:
-		#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
-		#參考資料：
-		#exec=>http://php.net/manual/en/function.exec.php
+					$ips_http=$checkHttpAttackLog["content"];
-		#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
-		#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
-		$callShell=external::callShell($conf["external::callShell"]);
-		unset($conf["external::callShell"]);
-		#如果執行失敗
-		if($callShell["status"]==="false" && ( $callShell["statusCode"]!==0 && $callShell["statusCode"]!==1 ) ){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$callShell;
-			#回傳結果
-			return $result;
-			}#if end
-		#儲存有問題的smtp IP
-		$ips_smtp=array();
-		#狀態碼不為1才執行
-		if($callShell["statusCode"]!==1){
-			#初始化記錄每行log的時間點
-			$occurTime=array();
-			#初始化儲存log行資訊的變數
-			$oriLog=array();
-			#根據每筆記錄
-			foreach($callShell["output"] as $index => $line){
-				#截取出的格式
-				#Sep 28 07:54:16 qbpwcf.org postfix/smtpd[2766456]: warning: unknown[158.94.208.72]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=1q2w
-				#Sep 28 07:57:15 qbpwcf.org postfix/smtpd[2768441]: warning: unknown[213.209.157.249]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=sybase
-				#Sep 28 08:01:09 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[213.209.157.165]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=spam
-				#Sep 28 08:01:51 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[103.109.20.174]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=print@qbpwcf.org
-				#Sep 28 08:03:14 qbpwcf.org postfix/smtpd[2771112]: warning: unknown[62.60.130.148]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin2
-				#Sep 28 08:16:06 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[103.109.20.174]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=user@qbpwcf.org
-				#Sep 28 08:16:44 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
-				#Sep 28 08:16:53 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
-				#Sep 28 08:17:06 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hualing@qbpwcf.org
-				#Sep 28 08:17:16 qbpwcf.org postfix/smtpd[2781279]: warning: unknown[178.16.53.142]: SASL LOGIN authentication failed: Connection lost to authentication server, sasl_username=hualing@qbpwcf.org
-				#Sep 28 08:20:28 qbpwcf.org postfix/smtpd[2784204]: warning: unknown[158.94.208.72]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=1q2w1q2w
-				#Sep 28 08:23:09 qbpwcf.org postfix/smtpd[2785986]: warning: unknown[213.209.157.249]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=informix
-				#Sep 28 08:23:39 qbpwcf.org postfix/smtpd[2785986]: warning: unknown[62.60.130.148]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin3
-				#May 22 12:58:54 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: Invalid authentication mechanism: 'LOGIN', sasl_username=(unavailable)
-				#May 22 12:58:59 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=nonexistent_user_26@qbpwcf.org
-				#May 22 12:59:07 qbpwcf.org postfix/smtpd[2059124]: warning: unknown[80.94.95.242]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=finance@qbpwcf.org#"${doNotNeed} postfix/smtpd[${pid}]${doNotNeed}[${ip}]"
-				#用 " " 分割 以取得 月日時分秒
-				#函式說明:
-				#將固定格式的字串分開,並回傳分開的結果.
-				#回傳結果:
-				#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-				#$result["error"],錯誤訊息陣列
-				#$result["function"],當前執行的函數名稱.
-				#$result["argu"],使用的參數.
-				#$result["oriStr"],要分割的原始字串內容
-				#$result["dataArray"],爲分割好字串的陣列內容,$result["dataArray"][$i]爲第($i+1)段的內容。
-				#$result["dataCounts"],爲總共分成幾段
-				#$result["found"],是否有在$conf["stringIn"]找到$conf["spiltSymbol"],"true"代表有找到,"false"代表沒有找到.
-				#必填參數:
-				#$conf["stringIn"],字串,要處理的字串.
-				$conf["stringProcess::spiltString"]["stringIn"]=$line;
-				#$conf["spiltSymbol"],字串,爲以哪個符號作爲分割.
-				$conf["stringProcess::spiltString"]["spiltSymbol"]=" ";
-				#可省略參數:
-				#$conf["allowEmptyStr"],是否允許分割出來空字串,預設為"false"不允許;"true"代表允許.
-				#$conf["allowEmptyStr"]="false";
-				#參考資料:
-				#無.
-				#備註:
-				#無.
-				$spiltString=stringProcess::spiltString($conf["stringProcess::spiltString"]);
-				unset($conf["stringProcess::spiltString"]);
-				#如果分割失敗
-				if($spiltString["status"]==="false"){
-					#設置執行失敗
-					$result["status"]="false";
-					#設置錯誤訊息
-					$result["error"]=$spiltString;
-					#回傳結果
-					return $result;
-					}#if end
-				#如果分割失敗
-				if($spiltString["dataCounts"]<3){
-					#設置執行失敗
-					$result["status"]="false";
-					#設置錯誤訊息
-					$result["error"]=$spiltString;
-					#回傳結果
-					return $result;
-					}#if end
-				#儲存時間
-				$occurTime[$index]=strtotime($spiltString["dataArray"][0]." ".$spiltString["dataArray"][1]." ".$spiltString["dataArray"][2]);
-				#取得 ip
-				#函式說明：
-				#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
-				#回傳結果:
-				#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-				#$reuslt["error"],執行不正常結束的錯訊息陣列.
-				#$result["function"],當前執行的函式名稱.
-				#$result["argu"],所使用的參數.
-				#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
-				#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-				#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
-				#必填參數:
-				#$conf["input"],字串,要檢查的字串.
-				$conf["search::findSpecifyStrFormat"]["input"]=$line;
-				#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-				$conf["search::findSpecifyStrFormat"]["format"]="\${doNotNeed} postfix/smtpd[\${pid}]\${doNotNeed}[\${ip}]:[\${reason}]";
-				#可省略參數:
-				#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
-				#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
-				#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#結束 switch
-				#$conf["varCon"]=array("no_tail"=>" not");
-				#參考資料:
-				#無.
+					break;
-				#備註:
-				#無.
-				$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-				unset($conf["search::findSpecifyStrFormat"]);
-				#如果分割失敗
-				if($findSpecifyStrFormat["status"]==="false"){
-					#設置執行失敗
-					$result["status"]="false";
-					#設置錯誤訊息
-					$result["error"]=$findSpecifyStrFormat;
-					#回傳結果
-					return $result;
-					}#if end
-				#如果沒有符合格式
+				#如果是 https 服務
-				if($findSpecifyStrFormat["found"]==="false"){
-					#剔除時間點 記錄
-					array_pop($occurTime);
-					#跳過該行
-					continue;
-					}#if end
-				#取得解析好的ip
-				$ip=$findSpecifyStrFormat["parsedVar"]["ip"];
-				#儲存原始的log行內容
-				$oriLog[$index]=$spiltMutiString["spiltString"][$index ]["oriStr"];
-				#初始化暫存的陣列
-				$tmp=array();
+				case "https":
-				#設置log、time
-				$tmp["info"][]=array("log"=>$oriLog[$index],"time"=>$occurTime[$index]);
-				#設置問題ip
-				$tmp["ip"]=$ip;
-				#取得所需的有問題的IP
-				$ips_smtp[]=$tmp;
-				}#foreach end
-			}#if end
-		#透過 journalctl -a -e -f --unit=named.service | grep ' query ' 來取得 IP
-		#函式說明:
+					#函式說明:
-		#呼叫shell執行系統命令,並取得回傳的內容.
+					#檢查 apache http log 中疑似攻擊的記錄.
-		#回傳的結果:
+					#回傳結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息陣列.
+					#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
+					#$result["function"],字串,當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["cmd"],執行的指令內容.
-		#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
-		#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["running"],是否還在執行.
-		#$result["pid"],pid.
-		#$result["statusCode"],執行結束後的代碼.
-		#必填參數:
-		#$conf["command"],字串,要執行的指令與.
-		$conf["external::callShell"]["command"]="journalctl";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["external::callShell"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
-		$conf["external::callShell"]["argu"]=array("-a","-e","--unit=named.service","|","grep"," query ");
-		#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
-		#$conf["arguIsAddr"]=array();
-		#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
-		#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
-		#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
-		#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
-		#$conf["enablePrintDescription"]="true";
-		#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
-		#$conf["printDescription"]="";
-		#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
-		$conf["external::callShell"]["escapeshellarg"]="true";
-		#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-		#$conf["username"]="";
-		#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-		#$conf["password"]="";
-		#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
-		#$conf["useScript"]="";
-		#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
-		#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
-		#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
-		#$conf["inBackGround"]="";
-		#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
-		#$conf["getErr"]="false";
-		#備註:
-		#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
-		#參考資料：
-		#exec=>http://php.net/manual/en/function.exec.php
-		#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
-		#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
-		$callShell=external::callShell($conf["external::callShell"]);
-		unset($conf["external::callShell"]);
-		#如果執行失敗
-		if($callShell["status"]==="false" && ( $callShell["statusCode"]!==0 && $callShell["statusCode"]!==1 ) ){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$callShell;
-			#回傳結果
-			return $result;
-			}#if end
-		#記錄攻擊者的IP
-		$attacker_ips_namd=array();
-		#狀態碼不為1才執行
-		if($callShell["statusCode"]!==1){
-			#截取出的格式
-			#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:15 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#6238 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f77180297c0 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 34.80.86.198#31220 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f77180297c0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f770c077bf0 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:17 localhost.localdomain named[99512]: client @0x7f7714041d10 191.7.219.100#8794 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f770c077bf0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f770c077bf0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f77180297c0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f77180297c0 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:18 localhost.localdomain named[99512]: client @0x7f7714041d10 5.29.224.190#10027 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Nov 24 20:55:22 localhost.localdomain named[99512]: client @0x7f7714041d10 123.253.64.16#54404 (PEACECORPS.GOV): query (cache) 'PEACECORPS.GOV/ANY/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#40052 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#48628 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#52460 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#60457 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#10213 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc801bc80 61.220.11.198#44377 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#4481 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#53061 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc8003700 61.220.11.198#31654 (dns.qbpwcf.org): query 'dns.qbpwcf.org/AAAA/IN' denied
-			#Dec 14 18:51:45 localhost.localdomain named[1159]: client @0x7f3dc802a410 61.220.11.198#57701 (aesopower-cms-sock-latest.qbpwcf.org): query 'aesopower-cms-sock-latest.qbpwcf.org/A/IN' denied
-			#Sep 29 03:37:20 dns.qbpwcf.org named[94]: client @0x7f60e00734e8 61.166.210.84#49954 (twitter.com): query failed (REFUSED) for twitter.com/IN/AAAA at ../../../lib/ns/query.c:5691
-			#Sep 29 03:37:20 dns.qbpwcf.org named[94]: client @0x7f60e006f428 61.166.210.84#49954 (twitter.com): query failed (REFUSED) for twitter.com/IN/A at ../../../lib/ns/query.c:5691
-			#Sep 29 03:37:21 dns.qbpwcf.org named[94]: client @0x7f60e80889a8 61.166.210.84#50057 (astrill4u.com): query failed (REFUSED) for astrill4u.com/IN/AAAA at ../../../lib/ns/query.c:5691
-			#Sep 29 03:37:21 dns.qbpwcf.org named[94]: client @0x7f60e805ed08 61.166.210.84#50057 (astrill4u.com): query failed (REFUSED) for astrill4u.com/IN/A at ../../../lib/ns/query.c:5691
-			#Sep 29 03:46:33 dns.qbpwcf.org named[94]: client @0x7f60d402b618 165.22.223.147#16200 (tool.lu): query failed (REFUSED) for tool.lu/IN/A at ../../../lib/ns/query.c:5691
-			#Sep 29 03:49:16 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#Sep 29 04:19:10 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#Sep 29 04:20:28 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#Sep 29 04:24:20 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#Sep 29 04:24:59 dns.qbpwcf.org named[94]: client @0x7f60e0060a28 76.20.229.207#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#Sep 29 04:40:48 dns.qbpwcf.org named[94]: client @0x7f60f9377888 174.96.56.126#80 (sl): query failed (REFUSED) for sl/IN/ANY at ../../../lib/ns/query.c:5691
-			#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} client ${doNotNeed} ${ip}#${remoteRevPort} (${$queryTarget}): ${doNotNeed}
-			#函式說明:
-			#檢查多個字串中的每個字串是否有多個關鍵字
-			#回傳結果:
-			#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
-			#$result["function"],當前執行的函數名稱.
-			#$result["error"],錯誤訊息.
-			#$result["argu"],使用的參數.
-			#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
-			#$result["foundedKeyWords"],找到的關鍵字陣列.
-			#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
-			#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
-			#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
-			#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
-			#必填參數:
+					#必填參數:
-			#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
-			$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array("(REFUSED)"," denied");
-			#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
-			$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
-			#可省略參數:
-			#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
-			#$conf["completeEqual"]="true";
-			#參考資料:
-			#無.
-			#備註:
-			#無.
+					#無.
-			$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
-			unset($conf["search::findManyKeyWordsFromManyString"]);
-			#如果執行失敗
-			if($findManyKeyWordsFromManyString["status"]==="false"){
-				#設置執行失敗
-				$result["status"]="false";
-				#設置錯誤訊息
-				$result["error"]=$findManyKeyWordsFromManyString;
-				#回傳結果
-				return $result;
-				}#if end
-			#初始化儲存原始log行內容
-			#$oriLog=array();
-			#儲存疑似有問題的IP
-			$ips_named=array();
-			#初始化儲存確定有問題的ip
-			$attacker_ips_namd=array();
-			#針對每個符合的行
-			foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $oriLog){
-				#初始化儲存資訊的暫存陣列
-				$info=array();
-				#解析時間與來源ip
-				#函式說明：
-				#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
-				#回傳結果:
-				#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-				#$reuslt["error"],執行不正常結束的錯訊息陣列.
-				#$result["function"],當前執行的函式名稱.
-				#$result["argu"],所使用的參數.
-				#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
-				#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-				#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
-				#必填參數:
-				#$conf["input"],字串,要檢查的字串.
-				$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
-				#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-				$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} client \${doNotNeed} \${ip}#\${remoteRevPort} (\${queryTarget}): \${doNotNeed}";
-				#可省略參數:
+					#可省略參數:
-				#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
+					#$conf["logPath"],http log的路徑,預設為"/var/log/httpd".
-				#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
+					#$conf["logPath"]="/var/log/httpd";
-				#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#$conf["https"],字串,是否為要查https的log,預設為"false"，代表為http.
-				#$conf["varCon"]=array("no_tail"=>" not");
+					$conf["security::checkHttpAttackLog"]["https"]="true";
-				#參考資料:
+					#參考資料:
-				#無.
+					#無.
-				#備註:
+					#備註:
-				#無.
-				$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-				unset($conf["search::findSpecifyStrFormat"]);
+					#目前僅支援 apache 提供的 http 服務.
-				#如果分割失敗
-				if($findSpecifyStrFormat["status"]==="false"){
-					#設置執行失敗
-					$result["status"]="false";
-					#設置錯誤訊息
-					$result["error"]=$findSpecifyStrFormat;
-					#回傳結果
-					return $result;
-					}#if end
-				#如果沒有符合格式
-				if($findSpecifyStrFormat["found"]==="false"){
-					#跳過該行
-					continue;
-					}#if end
-				#儲存時間點
-				$info["time"]=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
+					#攻擊者的定義為http回應的code為4開頭,且時間間隔不超過1秒鐘,次數達到3次.
-				#儲存ip
-				$info["ip"]=$findSpecifyStrFormat["parsedVar"]["ip"][0];
-				#儲存log
-				$info["log"]=$oriLog;
-				#儲存查詢的目標
-				$info["queryTarget"]=$findSpecifyStrFormat["parsedVar"]["queryTarget"][0];
+					$checkHttpsAttackLog=security::checkHttpAttackLog($conf["security::checkHttpAttackLog"]);
-				#儲存疑似有問題的ip
-				$ips_named[$info["ip"]][]=$info;
-				}#foreach end
-			#針對每個可能有問題ip的每個log行
-			foreach($ips_named as $ip => $infos){
-				#初始化記錄ip來訪不大於1分鐘的計數
-				$count=0;
-				#初始化記錄歷史log跟time
-				$history=array();
-				#針對每個log行資訊
-				foreach($infos as $index => $info){
+					unset($conf["security::checkHttpAttackLog"]);
-					#unixtime
-					$time=strtotime($info["time"]);
-					#如果沒有下筆記錄
+					#如果執行異常
-					if(!isset($infos[$index+1])){
+					if($checkHttpsAttackLog["status"]==="false"){
-						#結束 foreach
-						break;
-						}#if end
-					#取得unixtime
+						#設置執行失敗
-					$next_time=strtotime($infos[$index+1]["time"]);
+						$result["status"]="false";
-					#如果時間間隔大於60秒
+						#設置錯誤訊息
-					if($next_time-$time>60){
+						$result["error"]=$checkHttpsAttackLog;
-						#跳過,看下筆記錄
+						#回傳結果
-						continue;
+						return $result;
 						}#if end
-					#計數+1
-					$count++;
-					#記錄歷史資訊
-					$history[]=array("time"=>$time,"log"=>$info["log"]);
-					}#foreach end
-				#如果有達到3次
-				if($count>=3){
-					#初始化暫存的陣列
-					$tmp=array();
-					#設置ip
-					$tmp["ip"]=$ip;
-					#設置info
-					$tmp["info"]=$history;
-					#記錄攻擊者的IP
-					$attacker_ips_namd[]=$tmp;
-					}#if end
-				}#foreach end
-			}#if end
-		#透過 journalctl -a -e --unit=dovecot.service 來取得 IP
-		#函式說明:
-		#呼叫shell執行系統命令,並取得回傳的內容.
-		#回傳的結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["cmd"],執行的指令內容.
-		#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
-		#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["running"],是否還在執行.
-		#$result["pid"],pid.
-		#$result["statusCode"],執行結束後的代碼.
-		#必填參數:
-		#$conf["command"],字串,要執行的指令與.
-		$conf["external::callShell"]["command"]="journalctl";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["external::callShell"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
-		$conf["external::callShell"]["argu"]=array("-a","-e","--unit=dovecot.service");
-		#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
-		#$conf["arguIsAddr"]=array();
-		#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
-		#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
-		#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
-		#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
-		#$conf["enablePrintDescription"]="true";
-		#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
-		#$conf["printDescription"]="";
-		#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
-		$conf["external::callShell"]["escapeshellarg"]="true";
-		#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-		#$conf["username"]="";
-		#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-		#$conf["password"]="";
-		#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
-		#$conf["useScript"]="";
-		#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
-		#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
-		#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
-		#$conf["inBackGround"]="";
-		#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
-		#$conf["getErr"]="false";
-		#備註:
-		#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
-		#參考資料：
-		#exec=>http://php.net/manual/en/function.exec.php
-		#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
-		#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
-		$callShell=external::callShell($conf["external::callShell"]);
-		unset($conf["external::callShell"]);
-		#如果執行失敗
-		if($callShell["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$callShell;
-			#回傳結果
-			return $result;
-			}#if end
-		#記錄攻擊者的IP
-		$attacker_ips_imap=array();
-		/* $callShell["output"] 範例截取結果
-		Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MxQuPu+73xpliNc9>
-		Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hH8xPu+7dBtliNc9>
-		Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<nmI0Pu+7zhtliNc9>
+					#取得有問題的 https log 記錄
-		Feb 23 00:24:58 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<1GU2Pu+7NBhliNc9>
+					$ips_https=$checkHttpsAttackLog["content"];
-		Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0Io5Pu+7sRhliNc9>
-		Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zbQ+Pu+7rhlliNc9>
+					#結束 switch
-		Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0P5APu+7/BlliNc9>
+					break;
-		Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<gKRDPu+7XhpliNc9>
-		Feb 23 00:24:59 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<4hNHPu+77hpliNc9>
+				#如果是 postfix
-		Feb 23 00:25:00 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<belIPu+7bBtliNc9>
-		Feb 23 00:25:00 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<VhRLPu+7xBtliNc9>
-		Feb 23 00:46:19 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<loiMiu+7cxhliNc9>
-		Feb 23 00:46:19 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<RNCQiu+7/xhliNc9>
-		Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NWCTiu+7PBlliNc9>
-		Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<2tiViu+7hBlliNc9>
-		Feb 23 00:46:20 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<w6Sbiu+7/xlliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SkWkiu+7gBtliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<bGCmiu+7qBtliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0E+oiu+76RtliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FBGriu+7UhhliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<AeSsiu+7iBhliNc9>
-		Feb 23 00:46:21 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<gpSuiu+70hhliNc9>
-		Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zYfITPC7RBlliNc9>
-		Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<GULMTPC7zhlliNc9>
-		Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3jjOTPC7CBpliNc9>
-		Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vhHQTPC7UBpliNc9>
-		Feb 23 01:40:38 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vArTTPC7rxpliNc9>
-		Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hDTXTPC7GhtliNc9>
-		Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<c6vZTPC7SRtliNc9>
-		Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<rQzcTPC7jBtliNc9>
-		Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<LSffTPC78htliNc9>
-		Feb 23 01:40:39 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<XLThTPC7KBhliNc9>
-		Feb 23 01:40:40 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<tZfjTPC7dxhliNc9>
-		Feb 23 03:27:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<i3bIyfG7AxtliNc9>
-		Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0sLVyfG7uxtliNc9>
-		Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<BJXZyfG7BhhliNc9>
-		Feb 23 03:27:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<xK3cyfG7SxhliNc9>
-		Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<q43gyfG7aRhliNc9>
-		Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Oj3syfG7FBlliNc9>
-		Feb 23 03:27:12 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SF7uyfG7RhlliNc9>
-		Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<IM/wyfG7ZRlliNc9>
-		Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<pXv1yfG7vBlliNc9>
-		Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8ub4yfG7/xlliNc9>
-		Feb 23 03:27:13 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<H0j7yfG7NRpliNc9>
-		Feb 23 06:10:07 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Zw6FEPS7WxhliNc9>
-		Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<vmKTEPS7cRpliNc9>
-		Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SkOXEPS7BxtliNc9>
-		Feb 23 06:10:08 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<H42bEPS7WRtliNc9>
-		Feb 23 06:10:09 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<jFqoEPS7SRhliNc9>
-		Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<TNy4EPS7DhpliNc9>
-		Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JYW7EPS7mBpliNc9>
-		Feb 23 06:10:10 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=</Ve+EPS76hpliNc9>
-		Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<StLGEPS7qhtliNc9>
-		Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<7RnLEPS7DBhliNc9>
-		Feb 23 06:10:11 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<6xTOEPS7eBhliNc9>
-		Feb 23 06:29:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<YHy0VfS7uBhliNc9>
-		Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<WLW4VfS7fxlliNc9>
-		Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<lM66VfS73BlliNc9>
-		Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Q4K9VfS7NxpliNc9>
-		Feb 23 06:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JiLBVfS7rRpliNc9>
-		Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<DETIVfS7qxtliNc9>
-		Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<UlLLVfS7GhhliNc9>
-		Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<safNVfS7txhliNc9>
-		Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<M/DQVfS7LxlliNc9>
-		Feb 23 06:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<+zPTVfS7eRlliNc9>
-		Feb 23 06:29:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<dxXWVfS72hlliNc9>
-		Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<S0pci/S7SxhliNc9>
-		Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<zThji/S78RhliNc9>
-		Feb 23 06:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8PJoi/S7ixlliNc9>
-		Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Qkhui/S7PBpliNc9>
-		Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<SXVzi/S7hhtliNc9>
-		Feb 23 06:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=</X55i/S7uhhliNc9>
-		Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MHJ9i/S74hlliNc9>
-		Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<RBWBi/S7pRpliNc9>
-		Feb 23 06:44:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NJeGi/S7yhtliNc9>
-		Feb 23 06:44:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<QsaMi/S7rxhliNc9>
-		Feb 23 06:44:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8fiPi/S7uBlliNc9>
-		Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<dt04yPS7KBlliNc9>
-		Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<ZMI9yPS7WxpliNc9>
-		Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<nTVAyPS7ARtliNc9>
-		Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<wj1CyPS7lxtliNc9>
-		Feb 23 07:01:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<u7RFyPS7YRhliNc9>
-		Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<tpBLyPS7ZhlliNc9>
-		Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<CRdOyPS7wxlliNc9>
-		Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<v9NQyPS7JxpliNc9>
-		Feb 23 07:01:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<81lUyPS73hpliNc9>
-		Feb 23 07:01:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<PCZXyPS7TRtliNc9>
-		Feb 23 07:01:31 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<VnNZyPS7qxtliNc9>
-		Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<op+l9vS7ZxhliNc9>
-		Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<aBCr9vS7CBlliNc9>
-		Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<0sOt9vS7dRlliNc9>
-		Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<NFaw9vS7xhlliNc9>
-		Feb 23 07:14:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<QS609vS7SRpliNc9>
-		Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<4FW79vS76htliNc9>
-		Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Fxu+9vS7gBhliNc9>
-		Feb 23 07:14:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3djA9vS75RhliNc9>
-		Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<hgzE9vS7mxlliNc9>
-		Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<J8TG9vS7GBpliNc9>
-		Feb 23 07:14:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<t87I9vS7mBpliNc9>
-		Feb 23 07:29:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<1xBILPW7MRtliNc9>
-		Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<IXZNLPW79htliNc9>
-		Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<6OdPLPW7chhliNc9>
-		Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<M5BSLPW78hhliNc9>
-		Feb 23 07:29:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Nv9VLPW7UxlliNc9>
-		Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<foJbLPW7KRpliNc9>
-		Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<EoVeLPW7nxpliNc9>
-		Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<DwNhLPW7JRtliNc9>
-		Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<mKhkLPW7ohtliNc9>
-		Feb 23 07:29:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<3nhnLPW7/htliNc9>
-		Feb 23 07:29:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<e+lpLPW7XRhliNc9>
-		Feb 23 07:44:27 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<KtTtYfW7dBhliNc9>
-		Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<MLTxYfW77BhliNc9>
-		Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<9GL0YfW7KBlliNc9>
-		Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<JNT2YfW7fRlliNc9>
-		Feb 23 07:44:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8Zv5YfW72RlliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<lbv/YfW73BpliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<5zsCYvW7EBtliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<aE8EYvW7bRtliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<LEIHYvW75RtliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<rLsJYvW7MRhliNc9>
-		Feb 23 07:44:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<9oMMYvW7ihhliNc9>
-		Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<x7SUl/W7mBpliNc9>
-		Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<k1KZl/W73xtliNc9>
-		Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Veabl/W7PxhliNc9>
-		Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Yamel/W7sxhliNc9>
-		Feb 23 07:59:28 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<wpGil/W7OBlliNc9>
-		Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<+VCol/W7aBpliNc9>
-		Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<TMaql/W7zhpliNc9>
-		Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<KnKtl/W7GBtliNc9>
+				case "postfix":
-		Feb 23 07:59:29 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<Lkixl/W7ixtliNc9>
-		Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<8bWzl/W7ARhliNc9>
+					#函式說明:
-		Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<70q2l/W7PBhliNc9>
+					#檢查 postfixv log 中疑似攻擊的記錄.
-		Sep 29 06:53:42 qbpwcf.org dovecot[98]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.231.151.171, lip=169.254.2.1, TLS, session=<MaKQGOs/wIMD55er>
-		Sep 29 07:42:58 qbpwcf.org auth[3737748]: pam_unix(dovecot:auth): check pass; user unknown
-		Sep 29 07:42:58 qbpwcf.org auth[3737748]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=account@qbpwcf.org rhost=62.60.131.29
-		Sep 29 08:10:02 qbpwcf.org dovecot[98]: imap(liveuser)<3755807><SvyIKew/xLpyIuFn>: Disconnected: Connection closed (UID SEARCH finished 0.039 secs ago) in=119 out=1504 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
-		Sep 29 08:12:02 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=149.102.158.38, lip=169.254.2.1, mpid=3757116, TLS, session=<B2O9MOw/TrmVZp4m>
-		Sep 29 08:12:04 qbpwcf.org dovecot[98]: imap(liveuser)<3757116><B2O9MOw/TrmVZp4m>: Disconnected: Logged out in=240 out=21891 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
-		Sep 29 08:12:06 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=149.102.158.38, lip=169.254.2.1, mpid=3757144, TLS, session=<S0rwMOw/XLmVZp4m>
-		Sep 29 08:12:09 qbpwcf.org dovecot[98]: imap(liveuser)<3757144><S0rwMOw/XLmVZp4m>: Disconnected: Logged out in=885 out=25454 deleted=0 expunged=0 trashed=0 hdr_count=2 hdr_bytes=21658 body_count=0 body_bytes=0
-		Sep 29 08:28:48 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768144, TLS, session=<Gk6ybOw/nNpyIuFn>
-		Sep 29 08:28:51 qbpwcf.org dovecot[98]: imap(liveuser)<3768144><Gk6ybOw/nNpyIuFn>: Disconnected: Connection closed (LIST finished 1.939 secs ago) in=50 out=17609 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
-		Sep 29 08:28:51 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768149, TLS, session=<ct7bbOw/qtpyIuFn>
-		Sep 29 08:28:52 qbpwcf.org dovecot[98]: imap(liveuser)<3768149><ct7bbOw/qtpyIuFn>: Disconnected: Connection closed (UID FETCH finished 0.045 secs ago) in=196 out=2381 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
-		Sep 29 08:28:53 qbpwcf.org dovecot[98]: imap-login: Login: user=<liveuser>, method=PLAIN, rip=114.34.225.103, lip=169.254.2.1, mpid=3768155, TLS, session=<DvP1bOw/tNpyIuFn>
-		Sep 29 08:28:55 qbpwcf.org dovecot[98]: imap(liveuser)<3768155><DvP1bOw/tNpyIuFn>: Disconnected: Connection closed (UID SEARCH finished 0.180 secs ago) in=119 out=1504 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
-		Sep 29 08:39:24 qbpwcf.org auth[3775219]: pam_unix(dovecot:auth): check pass; user unknown
-		Sep 29 08:39:24 qbpwcf.org auth[3775219]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=test rhost=196.251.92.78
-		Sep 29 08:40:44 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): check pass; user unknown
-		Sep 29 08:40:44 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=1q2w3e4r5t4567 rhost=158.94.208.72
-		Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): check pass; user unknown
-		Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=spam rhost=62.60.130.148
-		*/
-		#認證失敗的關鍵字
-		$keyWordAF="authentication failure";
-		#未認證或SSL錯誤
-		$keyWordNAA="no auth attempts";
-		#搜尋符合關鍵字的log行
-		#函式說明:
-		#檢查多個字串中的每個字串是否有多個關鍵字
-		#回傳結果:
-		#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
-		#$result["function"],當前執行的函數名稱.
-		#$result["error"],錯誤訊息.
-		#$result["argu"],使用的參數.
-		#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
-		#$result["foundedKeyWords"],找到的關鍵字陣列.
-		#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
-		#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
-		#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
-		#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
-		#必填參數:
-		#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
-		$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array($keyWordAF,$keyWordNAA);
-		#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
-		$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
-		#可省略參數:
-		#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
-		#$conf["completeEqual"]="true";
-		#參考資料:
-		#無.
-		#備註:
-		#無.
-		$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
-		unset($conf["search::findManyKeyWordsFromManyString"]);
-		#如果執行失敗
-		if($findManyKeyWordsFromManyString["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$findManyKeyWordsFromManyString;
-			#回傳結果
-			return $result;
-			}#if end
-		#初始化儲存可能有問題的存取Dovecot服務遠端ip
-		$rickyIpsOfDocecot=array();
-		#針對每個符合的log行
-		foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $index => $oriLog){
-			#找到的關鍵字
-			$foundKeyWord=$findManyKeyWordsFromManyString["foundedTrueKeyWords"][$index][0];
-			#依照符合的關鍵字
-			switch($foundKeyWord){
-				#如果是認證失敗
-				case $keyWordAF:
-					#範例
-					#Sep 29 08:41:18 qbpwcf.org auth[3776113]: pam_unix(dovecot:auth): authentication failure; logname=liveuser uid=0 euid=0 tty=dovecot ruser=spam rhost=62.60.130.148
-					#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} : authentication failure; logname=${account} ${doNotNeed} rhost=${ip}
-					#取得時間點跟遠端IP
-					#函式說明：
-					#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
 					#回傳結果:
-					#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
-					#$reuslt["error"],執行不正常結束的錯訊息陣列.
+					#$result["error"],錯誤訊息陣列.
-					#$result["function"],當前執行的函式名稱.
+					#$result["function"],字串,當前執行的函式名稱.
-					#$result["argu"],所使用的參數.
-					#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
-					#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-					#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
 					#必填參數:
-					#$conf["input"],字串,要檢查的字串.
+					#無.
-					$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
-					#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-					$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} : authentication failure; logname=\${account} \${doNotNeed} rhost=\${ip}";
 					#可省略參數:
-					#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
-					#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
-					#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#無
-					#$conf["varCon"]=array("no_tail"=>" not");
 					#參考資料:
 					#無.
 					#備註:
 					#無.
-					$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-					unset($conf["search::findSpecifyStrFormat"]);
+					$checkPostfixAttackLog=security::checkPostfixAttackLog();
-					#如果分割失敗
+					#如果執行異常
-					if($findSpecifyStrFormat["status"]==="false"){
+					if($checkPostfixAttackLog["status"]==="false"){
 						#設置執行失敗
 						$result["status"]="false";
 						#設置錯誤訊息
-						$result["error"]=$findSpecifyStrFormat;
+						$result["error"]=$checkPostfixAttackLog;
 						#回傳結果
 						return $result;
 						}#if end
-					#如果沒有符合格式
-					if($findSpecifyStrFormat["found"]==="false"){
-						#跳過該行
-						continue 2;
-						}#if end
-					#取得時間點
+					#取得有問題的 postfix log 記錄
-					$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
+					$ips_smtp=$checkPostfixAttackLog["content"];
-					#取得ip
-					$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
-					#儲存其資訊
-					$rickyIpsOfDocecot[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
-					#跳出  switch
+					#跳出 switch
 					break;
-				#如果是未認證或SSL錯誤
+				#如果是 "named"
-				case $keyWordNAA:
+				case "named":
-					#範例
-					#Feb 23 07:59:30 localhost.localdomain dovecot[1427]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=101.136.215.61, lip=169.254.1.1, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<70q2l/W7PBhliNc9>
-					#Sep 29 06:53:42 qbpwcf.org dovecot[98]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.231.151.171, lip=169.254.2.1, TLS, session=<MaKQGOs/wIMD55er>
-					#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} ( no auth attempts in ${doNotNeed} user=<${account}>, rip=${ip}, ${doNotNeed}
-					#取得時間點跟遠端IP
-					#函式說明：
+					#函式說明:
-					#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
+					#檢查 named log 中疑似攻擊的記錄.
 					#回傳結果:
-					#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
-					#$reuslt["error"],執行不正常結束的錯訊息陣列.
+					#$result["error"],錯誤訊息陣列.
-					#$result["function"],當前執行的函式名稱.
+					#$result["function"],字串,當前執行的函式名稱.
-					#$result["argu"],所使用的參數.
-					#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
-					#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-					#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
 					#必填參數:
-					#$conf["input"],字串,要檢查的字串.
+					#無.
-					$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
-					#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-					$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} ( no auth attempts in \${doNotNeed} user=<\${account}>, rip=\${ip}, \${doNotNeed}";
 					#可省略參數:
-					#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
-					#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
-					#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#無
-					#$conf["varCon"]=array("no_tail"=>" not");
 					#參考資料:
 					#無.
 					#備註:
 					#無.
-					$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-					unset($conf["search::findSpecifyStrFormat"]);
+					$checkNamedAttackLog=security::checkNamedAttackLog();
-					#如果分割失敗
+					#如果執行異常
-					if($findSpecifyStrFormat["status"]==="false"){
+					if($checkNamedAttackLog["status"]==="false"){
 						#設置執行失敗
 						$result["status"]="false";
 						#設置錯誤訊息
-						$result["error"]=$findSpecifyStrFormat;
+						$result["error"]=$checkNamedAttackLog;
 						#回傳結果
 						return $result;
 						}#if end
-					#如果沒有符合格式
-					if($findSpecifyStrFormat["found"]==="false"){
-						#跳過該行
-						continue 2;
-						}#if end
-					#取得時間點
+					#取得有問題的 dns log 記錄
-					$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
+					$attacker_ips_namd=$checkNamedAttackLog["content"];
-					#取得ip
-					$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
-					#儲存其資訊
-					$rickyIpsOfDocecot[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
-					#跳出  switch
+					#跳出 switch
-					break;
-				#不應該執行到這邊
-				default:
-					#設置執行失敗
-					$result["status"]="false";
-					#設置錯誤訊息
-					$result["error"][]="unexpected error";
-					#設置錯誤訊息
-					$result["error"][]=$findManyKeyWordsFromManyString;
-					#回傳結果
-					return $result;
-				}#switch end
-			}#foreach end
-		#初始化儲存可能有問題的ip資訊
-		$risky_ips=array();
-		#針對每個ip
-		foreach($rickyIpsOfDocecot as $ip => $info){
-			#如果同樣ip不到3次
-			if(count($rickyIpsOfDocecot[$ip])<3){
-				#換看下個ip
-				continue;
-				}#if end
-			#儲存可能有問題的ip資訊
-			$risky_ips[]=$rickyIpsOfDocecot[$ip];
-			}#foreach end
-		#針對每個可能有問題ip的每個log行
-		foreach($risky_ips as $ip => $infos){
-			#初始化暫存歷史資訊的陣列
-			$history=array();
-			#初始化記錄ip來訪不大於1分鐘的計數
-			$count=0;
-			#針對每個log行資訊
-			foreach($infos as $index => $info){
-				#unixtime
-				$time=strtotime($info["time"]);
-				#如果沒有下筆記錄
-				if(!isset($infos[$index+1])){
-					#結束 foreach
 					break;
-					}#if end
-				#取得unixtime
-				$next_time=strtotime($infos[$index+1]["time"]);
-				#如果時間間隔大於60秒
-				if($next_time-$time>60){
-					#跳過,看下筆記錄
-					continue;
-					}#if end
-				#計數+1
-				$count++;
-				#記錄該次事件資訊
-				$history[]=array("time"=>$time,"log"=>$info["log"]);
-				}#foreach end
-			#如果有達到3次
+				#如果是 "dovecot"
-			if($count>=3){
-				#初始化陣列
-				$tmp=array();
-				#記錄ip
-				$tmp["ip"]=$ip;
+				case "dovecot":
-				#記錄歷史資訊
-				$tmp["info"]=$history;
-				#記錄攻擊者的IP
-				$attacker_ips_imap[]=$ip;
-				}#if end
-			}#foreach end
-		#記錄ssh攻擊者的IP
-		$attacker_ips_ssh=array();
-		#透過 journalctl -a -e --unit=sshd.service來取得 ssh 攻擊者的 IP
-		#函式說明:
-		#呼叫shell執行系統命令,並取得回傳的內容.
-		#回傳的結果:
-		#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
-		#$result["error"],錯誤訊息陣列.
-		#$result["function"],當前執行的函式名稱.
-		#$result["argu"],使用的參數.
-		#$result["cmd"],執行的指令內容.
-		#$result["fullCmd"],如果參數 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["output"],爲執行完二元碼後的輸出陣列,若 $conf["inBackGround"] 為 "true",則為當下的輸出.
-		#$result["tmpFileOutput"],儲存輸出的暫存檔案名稱,若 $conf["inBackGround"] 為 "true" 則會回傳該值.
-		#$result["running"],是否還在執行.
-		#$result["pid"],pid.
-		#$result["statusCode"],執行結束後的代碼.
-		#必填參數:
-		#$conf["command"],字串,要執行的指令與.
-		$conf["external::callShell"]["command"]="journalctl";
-		#$conf["fileArgu"],字串,變數__FILE__的內容.
-		$conf["external::callShell"]["fileArgu"]=$conf["fileArgu"];
-		#可省略參數:
-		#$conf["argu"],陣列字串,指令搭配的參數,預設為空陣列.
-		$conf["external::callShell"]["argu"]=array("-a","-e","--unit=sshd.service");
-		#$conf["arguIsAddr"],陣列字串,指令搭配的哪些參數為路徑,為路徑的參數會進行轉換以便符合呼叫當前函式的位置,預設不指定,若有3個參數,其中第3個參數為路徑,則表示為array("false","false","true").
-		#$conf["arguIsAddr"]=array();
-		#$conf["pre"],陣列,要在本指令前執行的每個指令與參數.
-		#$conf["pre"][$i]["cmd"],字串,要在本指令前執行的第$i+1個指令.
-		#$conf["pre"][$i]["param"],陣列字串,要在本指令前執行的第$i+1個指令的參數.
-		#$conf["enablePrintDescription"],字串,是否要印出$conf["printDescription"]的內容,"true"代表要,"false"代表不要,預設為"false".
-		#$conf["enablePrintDescription"]="true";
-		#$conf["printDescription"],字串,執行該外部程式前要印出來的的文字,預設為$conf["command"]的內容加上使用的$conf["argu"]參數.
-		#$conf["printDescription"]="";
-		#$conf["escapeshellarg"],字串,是否要啟用過濾參數,用了比較安全,但可能會出錯,"true"為啟用,"false"為不啟用,預設為"false".
-		$conf["external::callShell"]["escapeshellarg"]="true";
-		#$conf["username"],字串,要用什麼使用者來執行,預設為執行php的使用者,該參數不適用於apache環境.
-		#$conf["username"]="";
-		#$conf["password"],字串,root的使用者密碼,預設不使用密碼,該參數不適用於apache環境.
-		#$conf["password"]="";
-		#$conf["useScript"],字串,是否要啟用Linux的script指令來記錄輸出,"true"代表要,Fedora的selinux會擋住該操作;"false"代表不要,預設為"false".
-		#$conf["useScript"]="";
-		#$conf["logFilePath"],字串,當 $conf["useScript"] 為 "true" 時,輸出的內容要暫存到哪裡,預設為 "/tmp/.qbpwcf_tmp/external/callShell/".
-		#$conf["logFilePath"]=".qbpwcf_tmp/external/callShell/";
-		#$conf["inBackGround"],字串,是否要在背景執行,且不會等待程式執行結束再執行下一個指令,"true"代表是,"false"代表不要,預設為"false",如果$conf["command"]有用「;」區隔的多個指令將會出錯.
-		#$conf["inBackGround"]="";
-		#$conf["getErr"],字串,"true"代表將錯誤輸出變成標準輸出,反之"false"為不變動.
-		#$conf["getErr"]="false";
-		#備註:
-		#不是所有指令都能用apache的身份執行,目前已知java,javac指令無法執行,使用root身份可能會被selinux阻擋.
-		#參考資料：
-		#exec=>http://php.net/manual/en/function.exec.php
-		#escapeshellcmd=>http://php.net/manual/en/function.escapeshellcmd.php
-		#escapeshellarg=>http://php.net/manual/en/function.escapeshellarg.php
-		$callShell=external::callShell($conf["external::callShell"]);
-		unset($conf["external::callShell"]);
-		#如果執行失敗
-		if($callShell["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$callShell;
-			#回傳結果
-			return $result;
-			}#if end
-		/*
-		得到的範例輸出
-		Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: Invalid user lizepeng from 60.213.10.69 port 39156
-		Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: pam_unix(sshd:auth): check pass; user unknown
-		Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.69
-		Sep 30 00:36:38 silverblue-guest.qbpwcf.org sshd-session[1607010]: Failed password for invalid user lizepeng from 60.213.10.69 port 39156 ssh2
-		Sep 30 00:36:40 silverblue-guest.qbpwcf.org sshd-session[1607010]: Connection closed by invalid user lizepeng 60.213.10.69 port 39156 [preauth]
-		Sep 30 05:54:01 silverblue-guest.qbpwcf.org sshd-session[2346022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.81  user=root
-		Sep 30 05:54:03 silverblue-guest.qbpwcf.org sshd-session[2346022]: Failed password for root from 60.213.10.81 port 41644 ssh2
-		Sep 30 05:54:04 silverblue-guest.qbpwcf.org sshd-session[2346022]: Connection closed by authenticating user root 60.213.10.81 port 41644 [preauth]
-		Sep 30 05:54:20 silverblue-guest.qbpwcf.org sshd-session[2346860]: Invalid user qy from 60.213.10.81 port 42960
-		Sep 30 05:54:21 silverblue-guest.qbpwcf.org sshd-session[2346860]: pam_unix(sshd:auth): check pass; user unknown
-		Sep 30 05:54:21 silverblue-guest.qbpwcf.org sshd-session[2346860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.213.10.81
-		Sep 30 05:54:22 silverblue-guest.qbpwcf.org sshd-session[2346860]: Failed password for invalid user qy from 60.213.10.81 port 42960 ssh2
-		Sep 30 05:54:23 silverblue-guest.qbpwcf.org sshd-session[2346860]: Connection closed by invalid user qy 60.213.10.81 port 42960 [preauth]
-		Sep 30 06:08:06 silverblue-guest.qbpwcf.org sshd-session[2378295]: Connection closed by 167.94.145.105 port 55712 [preauth]
-		Sep 30 08:09:51 silverblue-guest.qbpwcf.org sshd-session[2662907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.13.207.69  user=root
-		Sep 30 08:09:54 silverblue-guest.qbpwcf.org sshd-session[2662907]: Failed password for root from 183.13.207.69 port 18258 ssh2
-		Sep 30 08:09:54 silverblue-guest.qbpwcf.org sshd-session[2662907]: Connection closed by authenticating user root 183.13.207.69 port 18258 [preauth]
-		Sep 30 08:10:11 silverblue-guest.qbpwcf.org sshd-session[2663658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.13.207.69  user=root
-		Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Failed password for root from 183.13.207.69 port 17293 ssh2
-		Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Connection closed by authenticating user root 183.13.207.69 port 17293 [preauth]
-		*/
-		#認證失敗的關鍵字
-		$keyWordFP=" Failed password ";
-		#不存在使用者的關鍵字
-		$keyWordIU=" Invalid user ";
-		#搜尋符合關鍵字的log行
-		#函式說明:
+					#函式說明:
-		#檢查多個字串中的每個字串是否有多個關鍵字
+					#檢查 dovecot log 中疑似攻擊的記錄.
-		#回傳結果:
-		#$result["status"],整體來說，執行是否成功，"true"代表執行成功，"false"代表執行失敗。
-		#$result["function"],當前執行的函數名稱.
-		#$result["error"],錯誤訊息.
-		#$result["argu"],使用的參數.
-		#$result["foundedTrueKey"],結果為"true"的被搜尋元素key陣列,與其數值內容.
-		#$result["foundedKeyWords"],找到的關鍵字陣列.
-		#$result["foundedFalseKey"],結果為"false"的被搜尋元素key陣列,與其數值內容.
-		#$result["foundedTrueKeyWords"],二維陣列,各個字串有找到的關鍵字陣列.
-		#$result["foundedAll"],是否每個關鍵字都有找到,"true"代表每個都有找到,"false"代表沒有每個都找到.
-		#$result["keyWordsIncludeStr"],陣列,儲存有找到關鍵字的來源的索引(sourceIndex)與其內容(sourceVal)跟找到的關鍵字項目陣列(KeyWords).
-		#必填參數:
-		#$conf["keyWords"],字串陣列,想要搜尋的關鍵字.
-		$conf["search::findManyKeyWordsFromManyString"]["keyWords"]=array($keyWordFP,$keyWordIU);
-		#$conf["stringArray"],字串陣列,要被搜尋的字串內容陣列.
-		$conf["search::findManyKeyWordsFromManyString"]["stringArray"]=$callShell["output"];
-		#可省略參數:
-		#$conf["completeEqual"],字串,是否內容要完全符合，不能多出任何不符合的內容，預設為"false"不需要完全符合.
-		#$conf["completeEqual"]="true";
-		#參考資料:
-		#無.
-		#備註:
-		#無.
-		$findManyKeyWordsFromManyString=search::findManyKeyWordsFromManyString($conf["search::findManyKeyWordsFromManyString"]);
-		unset($conf["search::findManyKeyWordsFromManyString"]);
-		#如果執行失敗
-		if($findManyKeyWordsFromManyString["status"]==="false"){
-			#設置執行失敗
-			$result["status"]="false";
-			#設置錯誤訊息
-			$result["error"]=$findManyKeyWordsFromManyString;
-			#回傳結果
-			return $result;
-			}#if end
-		#初始化儲存可能有問題的存取ssh服務遠端ip
-		$risky_ips=array();
-		#針對每個符合的log行
-		foreach($findManyKeyWordsFromManyString["foundedTrueKey"] as $index => $oriLog){
-			#找到的關鍵字
-			$foundKeyWord=$findManyKeyWordsFromManyString["foundedTrueKeyWords"][$index][0];
-			#依照符合的關鍵字
-			switch($foundKeyWord){
-				#如果是秘密碼錯誤
-				case $keyWordFP:
-					#範例
-					#Sep 30 08:10:13 silverblue-guest.qbpwcf.org sshd-session[2663658]: Failed password for root from 183.13.207.69 port 17293 ssh2
-					#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} Failed password for ${account} from ${ip} ${doNotNeed}
-					#取得時間點跟遠端IP
-					#函式說明：
-					#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
 					#回傳結果:
-					#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
-					#$reuslt["error"],執行不正常結束的錯訊息陣列.
+					#$result["error"],錯誤訊息陣列.
-					#$result["function"],當前執行的函式名稱.
+					#$result["function"],字串,當前執行的函式名稱.
-					#$result["argu"],所使用的參數.
-					#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
-					#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-					#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
 					#必填參數:
-					#$conf["input"],字串,要檢查的字串.
+					#無.
-					$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
-					#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-					$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} Failed password for \${account} from \${ip} \${doNotNeed}";
 					#可省略參數:
-					#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
-					#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
-					#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#無
-					#$conf["varCon"]=array("no_tail"=>" not");
 					#參考資料:
 					#無.
 					#備註:
 					#無.
-					$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-					unset($conf["search::findSpecifyStrFormat"]);
+					$checkDovecotAttackLog=security::checkDovecotAttackLog();
-					#如果分割失敗
+					#如果執行異常
-					if($findSpecifyStrFormat["status"]==="false"){
+					if($checkDovecotAttackLog["status"]==="false"){
 						#設置執行失敗
 						$result["status"]="false";
 						#設置錯誤訊息
-						$result["error"]=$findSpecifyStrFormat;
+						$result["error"]=$checkDovecotAttackLog;
 						#回傳結果
 						return $result;
 						}#if end
-					#如果沒有符合格式
-					if($findSpecifyStrFormat["found"]==="false"){
-						#跳過該行
-						continue 2;
-						}#if end
-					#取得時間點
+					#取得有問題的 dovecot log 記錄
-					$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
+					$attacker_ips_imap=$checkDovecotAttackLog["content"];
-					#取得ip
-					$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
-					#儲存其資訊
-					$risky_ips[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
-					#跳出  switch
+					#跳出 switch
 					break;
-				#如果是不存在的使用者
+				#如果是 "ssh"
-				case $keyWordIU:
+				case "ssh":
-					#範例
-					#Sep 30 00:36:36 silverblue-guest.qbpwcf.org sshd-session[1607010]: Invalid user lizepeng from 60.213.10.69 port 39156
-					#${month} ${day} ${hour}:${min}:${sec} ${doNotNeed} Invalid user ${account} from ${ip} port ${doNotNeed}
-					#取得時間點跟遠端IP
-					#函式說明：
+					#函式說明:
-					#尋找字串中是否含有符合格式的內容,且回傳解析好的變數數值.
+					#檢查 ssh log 中疑似攻擊的記錄.
 					#回傳結果:
-					#$result["status"],執行是否正常,"true"代表正常,"false"代表不正常.
+					#$result["status"],字串,執行是否正常,"true"代表正常,"false"代表不正常.
-					#$reuslt["error"],執行不正常結束的錯訊息陣列.
+					#$result["error"],錯誤訊息陣列.
-					#$result["function"],當前執行的函式名稱.
+					#$result["function"],字串,當前執行的函式名稱.
-					#$result["argu"],所使用的參數.
-					#$result["found"],是否有找到符合格式的字串內容,"true"代表有找到,"false"代表沒有找到.
+					#$result["content"],陣列,攻擊記錄資訊,每個元素為陣列key為"ip"者為攻擊者的ip;key為info者為其資訊陣列,其key為"log"者代表log的行內容;key為"time"者代表時間點;key為ip者代表ip.
-					#$result["content"],陣列,若為n個${*},則當found為"true"時,就會回傳n個元素.
-					#$result["parsedVar"][varName],陣列,解析好的變數陣列,varName為${}中的內容.
 					#必填參數:
-					#$conf["input"],字串,要檢查的字串.
+					#無.
-					$conf["search::findSpecifyStrFormat"]["input"]=$oriLog;
-					#$conf["format"],格式字串,要尋找的格式字串.格式為固定的字串("fixedStr format")與變數("${keyWordVarName}")組成.
-					$conf["search::findSpecifyStrFormat"]["format"]="\${month} \${day} \${hour}:\${min}:\${sec} \${doNotNeed} Invalid user \${account} from \${ip} port \${doNotNeed}";
 					#可省略參數:
-					#$conf["varEqual"],陣列,變數對應的數值,null代表不指定,其他內容代表該變數解析出來必須要為該內容.
-					#$conf["search::findSpecifyStrFormat"]["varEqual"]=array(null,"found");
-					#$conf["varCon"],陣列,每個varEqual為null者,其是否有其他條件,預設為null代表無其他條件,條件的表示是用陣列的key與value來表達,例如:array("no_tail"=>" not"),就代表變數的結尾不能為" not",可以用的key有"head",代表開頭要有什麼;"no_head",代表不能為什麼開頭;"tail",代表要什麼結尾;"no_tail",代表不能什麼結尾.
+					#無
-					#$conf["varCon"]=array("no_tail"=>" not");
 					#參考資料:
 					#無.
 					#備註:
 					#無.
-					$findSpecifyStrFormat=search::findSpecifyStrFormat($conf["search::findSpecifyStrFormat"]);
-					unset($conf["search::findSpecifyStrFormat"]);
+					$checkSshAttackLog=security::checkSshAttackLog();
-					#如果分割失敗
+					#如果執行異常
-					if($findSpecifyStrFormat["status"]==="false"){
+					if($checkSshAttackLog["status"]==="false"){
 						#設置執行失敗
 						$result["status"]="false";
 						#設置錯誤訊息
-						$result["error"]=$findSpecifyStrFormat;
+						$result["error"]=$checkSshAttackLog;
 						#回傳結果
 						return $result;
 						}#if end
-					#如果沒有符合格式
-					if($findSpecifyStrFormat["found"]==="false"){
-						#跳過該行
-						continue 2;
-						}#if end
-					#取得時間點
+					#取得有問題的 ssh log 記錄
-					$time=$findSpecifyStrFormat["parsedVar"]["month"][0]." ".$findSpecifyStrFormat["parsedVar"]["day"][0]." ".$findSpecifyStrFormat["parsedVar"]["hour"][0].":".$findSpecifyStrFormat["parsedVar"]["min"][0].":".$findSpecifyStrFormat["parsedVar"]["sec"][0];
+					$attacker_ips_ssh=$checkSshAttackLog["content"];
-					#取得ip
-					$ip=$findSpecifyStrFormat["parsedVar"]["ip"][0];
-					#儲存其資訊
-					$risky_ips[$ip][]=array("time"=>$time,"ip"=>$ip,"log"=>$oriLog);
-					#跳出  switch
+					#跳出 switch
 					break;
-				#不應該執行到這邊
+				#其他不支援的服務
 				default:
 					#設置執行失敗
 					$result["status"]="false";
 					#設置錯誤訊息
-					$result["error"][]="unexpected error";
+					$result["error"][]="unsupported service:".$serviceName;
-					#設置錯誤訊息
-					$result["error"][]=$findManyKeyWordsFromManyString;
 					#回傳結果
 					return $result;
 				}#switch end
-			}#foreach end
-		#針對每個可能有問題ip的每個log行
-		foreach($risky_ips as $ip => $infos){
-			#初始化暫存歷史記錄的陣列
-			$history=array();
-			#初始化記錄ip來訪不大於1分鐘的計數
-			$count=0;
-			#針對每個log行資訊
-			foreach($infos as $index => $info){
-				#unixtime
-				$time=strtotime($info["time"]);
-				#如果沒有下筆記錄
-				if(!isset($infos[$index+1])){
-					#結束 foreach
-					break;
-					}#if end
-				#取得unixtime
-				$next_time=strtotime($infos[$index+1]["time"]);
-				#如果下筆時間記錄與當前這筆間隔大於60秒
-				if($next_time-$time>60){
-					#跳過,看下筆記錄
-					continue;
-					}#if end
-				#計數+1
-				$count++;
-				#記錄該次記錄
-				$history[]=array("time"=>$time,"log"=>$info["log"]);
-				}#foreach end
-			#如果有達到3次
-			if($count>=3){
-				#初始化暫存的陣列
-				$tmp=array();
-				#取得資訊
-				$tmp["info"]=$history;
-				#取得問題ip
-				$tmp["ip"]=$ip;
-				#記錄攻擊者的IP
-				$attacker_ips_ssh[]=$tmp;
-				}#if end
 			}#foreach end
 		#合併取得的有問題IP集合
 		#$ips,$ips_https,$ips_smtp,$attacker_ips_imap,$attacker_ips_namd,$attacker_ips_ssh
 		#$result["error"],錯誤訊息陣列.
 		#$result["function"],當前執行的函式.
 		#$result["content"],合併好的一維陣列.
 		#必填參數:
 		#$conf["inputArray"],陣列,要合併的一維陣列變數，例如：=array($array1,$array2);
-		$conf["arrays::mergeArray"]["inputArray"]=array($ips,$ips_https,$ips_smtp,$attacker_ips_namd,$attacker_ips_imap,$attacker_ips_ssh);
+		$conf["arrays::mergeArray"]["inputArray"]=array($ips_http,$ips_https,$ips_smtp,$attacker_ips_namd,$attacker_ips_imap,$attacker_ips_ssh);
 		#可省略參數:
 		#$conf["allowRepeat"],字串,預設為"true",允許重複的結果;若為"false"則不會出現重複的元素內容.
 		$conf["arrays::mergeArray"]["allowRepeat"]="false";
 		$mergeArray=arrays::mergeArray($conf["arrays::mergeArray"]);
 		unset($conf["arrays::mergeArray"]);

Subversion Repositories php-qbpwcf

(root)/trunk/usr/lib/qbpwcf/cmd.php – Rev 350 → 368