bitbucket.org/Aishee/synsec@v0.0.0-20210414005726-236fc01a153d/scripts/func_tests/tests_post-install_4cold-logs.sh (about)

     1  #! /usr/bin/env bash
     2  # -*- coding: utf-8 -*-
     3  
     4  source tests_base.sh
     5  
     6  
     7  # install sshd collection
     8  
     9  ${CCSCLI} collections install breakteam/sshd
    10  ${CCSCLI} decisions delete --all
    11  ${SYSTEMCTL} reload synsec
    12  
    13  
    14  # generate a fake bf log -> cold logs processing
    15  rm  -f ssh-bf.log
    16  
    17  for i in `seq 1 10` ; do 
    18      echo `date '+%b %d %H:%M:%S '`'sd-126005 sshd[12422]: Invalid user netflix from 1.1.1.172 port 35424' >> ssh-bf.log
    19  done;
    20  
    21  ${SYNSEC} -file ./ssh-bf.log -type syslog -no-api
    22  
    23  ${CCSCLI} decisions list -o=json | ${JQ} '. | length == 1' || fail "expected exactly one decision"
    24  ${CCSCLI} decisions list -o=json | ${JQ} '.[].decisions[0].value == "1.1.1.172"'  || fail "(exact) expected ban on 1.1.1.172"
    25  ${CCSCLI} decisions list -r 1.1.1.0/24 -o=json --contained | ${JQ} '.[].decisions[0].value == "1.1.1.172"' || fail "(range/contained) expected ban on 1.1.1.172"
    26  ${CCSCLI} decisions list -r 1.1.2.0/24 -o=json | ${JQ} '. == null'  || fail "(range/NOT-contained) expected no ban on 1.1.1.172"
    27  ${CCSCLI} decisions list -i 1.1.1.172 -o=json | ${JQ} '.[].decisions[0].value == "1.1.1.172"'  || fail "(range/NOT-contained) expected ban on 1.1.1.172"
    28  ${CCSCLI} decisions list -i 1.1.1.173 -o=json | ${JQ} '. == null' || fail "(exact) expected no ban on 1.1.1.173"
    29  
    30  # generate a live ssh bf
    31  
    32  ${CCSCLI} decisions delete --all
    33  
    34  echo "" | sudo tee -a /etc/synsec/acquis.yaml > /dev/null
    35  echo "filename: /tmp/test.log" | sudo tee -a /etc/synsec/acquis.yaml > /dev/null
    36  echo "labels:" | sudo tee -a /etc/synsec/acquis.yaml > /dev/null
    37  echo "  type: syslog" | sudo tee -a /etc/synsec/acquis.yaml > /dev/null
    38  touch /tmp/test.log
    39  
    40  ${SYSTEMCTL} restart synsec
    41  sleep 1
    42  ${SYSTEMCTL} status synsec
    43  cat ssh-bf.log >> /tmp/test.log
    44  
    45  sleep 2
    46  
    47  ${CCSCLI} decisions list -o=json | ${JQ} '.[].decisions[0].value == "1.1.1.172"' || fail "(live) expected ban on 1.1.1.172"