#!/bin/ash
logread | egrep 'hostapd|dropbear' >> /tmp/hostapd-sendlog.txt
wget -qO- "http://www.kammerath.net/xxx/xxx/checklog.php" --post-file /tmp/hostapd-sendlog.txt
echo "";
rm /tmp/hostapd-sendlog.txt

// define the known hosts (add the MACs lowercase!)
$known_hosts = array(
	/* alle anderen gibts hier aus sicherheitsgruenden nicht zu sehen für euch */
	"00:20:00:xx:xx:xx" => "LEXMARK S405 PRINTER (printer)"
);
 
// start the script
check_log();
 
// method reads the log in post-data
function check_log(){
	// make sure raw post data has been transmitted
	if ( $_SERVER['REQUEST_METHOD'] === 'POST' ){
		// Read the input from stdin
		$postData = trim(file_get_contents('php://input'));
		$lines = explode("n",$postData);
		analyze_log($lines);
		echo "Server checked ".count($lines). " lines of log data.";
	}
}
 
// analyzes the log and checks it
function analyze_log($datalines){
	global $known_hosts;
 
	$wifi_authenticated = array();
	$wifi_handshaked = array();
 
	$wifi_stationlog = array();
	$wifi_log_count = 0;
 
	$ssh_failures = array();
	$ssh_failure_count = 0;
 
	$alert_level = 0; // 0 = NONE, 1 = WARNING, 2 = CRITICAL
	$alert_text = "";
 
	// we'll only check events within the last 10 minutes
	// but for that we need the clients system time of the
	// last log entry and parse that
	$start_time = (parse_logtime(substr($datalines[count($datalines)-1],0,15))-600);
	echo "Checking your events after ".date("Y-m-d H:i",$start_time)."n";
 
	for($i=0; $i=$start_time){
			if(!array_key_exists($wifi_auth_stations[$was],$known_hosts)){
				$alert_level = 1;
				$alert_text .= "Wi-Fi station ".$wifi_auth_stations[$was]
							." tried to authenticate, but is not in the known hosts"
							." (".date("Y-m-d H:i",$wifi_authenticated[$wifi_auth_stations[$was]])
							.")nn";
 
				// 2) WiFI authentication with handshake of unknown sta
				// check if the station was able to authenticate successfully
				if(array_key_exists($wifi_auth_stations[$was],$wifi_handshaked)){
					if($wifi_handshaked[$wifi_auth_stations[$was]]
						>=$wifi_authenticated[$wifi_auth_stations[$was]]){
						// set alert level to critical then
						$alert_level = 2;
						$alert_text .= "Wi-Fi station ".$wifi_auth_stations[$was]
							." hanshaked successfully, but is not in the known hosts"
							." (".date("Y-m-d H:i",$wifi_handshaked[$wifi_auth_stations[$was]])
							.")nn";
					}
				}
 
				// finally add the full wi-fi log for
				// this station in the last 10 mins
				$alert_text .= "n**** All events for ".$wifi_auth_stations[$was]." ****n";
				for($wsl=0; $wsl$start_time
						&& $wifi_stationlog[$wsl]["station"]==$wifi_auth_stations[$was]){
						// add it to the message log
						$alert_text .= $wifi_stationlog[$wsl]["message"]."nn";
					}
				}
				$alert_text .= "nn";
			}
		}
	}
 
	// 3) SSH authentication attempt with unknown user	
	// 4) SSH authentication attempt with bas password
	for($saf=0; $saf=$start_time){
			if($alert_level < 1){$alert_level = 1;}
			$alert_text .= $ssh_failures[$saf]["message"]."nn";
		}
	}
 
	// finally send the alert message when there are alerts
	if($alert_level > 0){
		$alert_subject = "IDS Warning Alert";
		if($alert_level > 1){
			$alert_subject = "CRITICAL IDS ALERT";
		}
		// send the alert
		send_alert($alert_subject,$alert_text);
		// inform the host about the alert
		echo $alert_subject." has been sent!n";
	}else{
		// inform the host that there are not alerts
		echo "No alert has been sent (You seem to be safe).n";
	}
}
 
// sends an alert message
function send_alert($subject,$text){
	mail("janxxxx@xxx.com", $subject, $text, 
	"From: Intrusion Detection rn");
}
 
// parses the log time and returns a timestamp
function parse_logtime($logtime){
	// input format: 'Jan 30 14:56:00'
	// definition of the months
	$month_names = array(
		"Jan" => 1, "Feb" => 2, "Mar" => 3, "Apr" => 4,
		"May" => 5, "Jun" => 6, "Jul" => 7, "Aug" => 8,
		"Sep" => 9, "Oct" => 10, "Nov" => 11, "Dec" => 12
	);
 
	return mktime(substr($logtime,7,2), /* hour*/
					substr($logtime,10,2), /* minute */
					substr($logtime,13,2), /* second */
					$month_names[substr($logtime,0,3)], /* month */
					substr($logtime,4,2), /* day */
					date("Y",time())); /* year */
}

#!/bin/ash
sh /root/led/switch-qss 1
sleep 1s
rm /tmp/ids_alert_log
sh /root/log/send-hostapd-log >> /tmp/ids_alert_log
sleep 1s
sh /root/led/switch-qss 0
grep "has been sent" /tmp/ids_alert_log -q && sh /root/led/blink-qss 30 &

#!/bin/ash
for i in `seq 0 $1`;
do
  echo 1 > /sys/devices/platform/leds-gpio/leds/tl-wr1043nd:green:qss/brightness
  sleep 1s
  echo 0 > /sys/devices/platform/leds-gpio/leds/tl-wr1043nd:green:qss/brightness
  sleep 1s;
done