Initial commit: pingu scripts

2026-04-21 08:40:20 +01:00
commit c9c8b77508
3 changed files with 201 additions and 0 deletions
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+TOKEN="8101319618:AAHboFVVgmLPccJB0MDr_R2g0K90hkGqkRw"
+CHAT_ID="581059353"
+
+PIS=("192.168.178.2" "192.168.178.3" "localhost")
+
+STATE_FILE="/home/kai/.ssh-monitor-lastcheck"
+
+if [ ! -f "$STATE_FILE" ]; then
+    date --iso-8601=seconds > "$STATE_FILE"
+fi
+
+LAST_CHECK=$(cat "$STATE_FILE")
+NOW=$(date --iso-8601=seconds)
+
+for PI in "${PIS[@]}"
+do
+    if [ "$PI" == "localhost" ]; then
+        LOG=$(journalctl -u ssh --since "$LAST_CHECK" --no-pager)
+        HOST=$(hostname)
+    else
+        LOG=$(ssh -o ConnectTimeout=5 kai@$PI \
+        "journalctl -u ssh --since \"$LAST_CHECK\" --no-pager")
+
+        HOST=$(ssh kai@$PI hostname)
+    fi
+
+    FAILS=$(echo "$LOG" | grep "Failed password" | wc -l)
+
+    if [ "$FAILS" -gt 0 ]; then
+
+        IPS=$(echo "$LOG" | grep "Failed password" \
+        | awk '{print $(NF-3)}' \
+        | sort | uniq -c | sort -nr)
+
+        MESSAGE="🚨 SSH Angriff erkannt!
+Host: $HOST ($PI)
+Fehlversuche: $FAILS
+
+Top Angreifer:
+$IPS"
+
+        curl -s -X POST "https://api.telegram.org/bot$TOKEN/sendMessage" \
+        -d chat_id="$CHAT_ID" \
+        -d text="$MESSAGE"
+    fi
+done
+
+echo "$NOW" > "$STATE_FILE"