Gmer4Lfe
01601d210b
Both checks already answered their question on demand and both needed somebody to press a button on the right row. One host here has returned nothing but 5xx for months. Filed as findings, which is the existing answer to a condition that persists while nobody is looking. Grouped by cause rather than by hostname: a default policy of bypass produced twenty-two findings that were one sentence repeated, and they have one fix between them.
51 lines
2.7 KiB
Bash
Executable File
51 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================================
|
|
# ===================================== Auth Sweep =============================================
|
|
# ==============================================================================================
|
|
#
|
|
# PURPOSE
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Asks the two questions the Auth tab can answer about one host, about every host, and files
|
|
# what it finds as findings.
|
|
#
|
|
# Is this host serving? below the uptime threshold, and failing for longer than a restart
|
|
# Is this host protected? behind an auth_request block that no rule then applies to
|
|
#
|
|
# Both answers existed already and both needed somebody to open the tab and press a button on
|
|
# the right row. One host here has returned nothing but 5xx for months.
|
|
#
|
|
# ==============================================================================================
|
|
# OPERATIONAL MODEL
|
|
# ==============================================================================================
|
|
#
|
|
# A wrapper. The work is in auth_sweep.php.
|
|
#
|
|
# Reports only — nothing is started, restarted or rewritten. The remedies are "start a
|
|
# container", "edit a rule", "change a default policy", and each of those is a decision.
|
|
#
|
|
# The live half is gated on time rather than on sample count: a host must have been failing for
|
|
# longer than AUTH_SWEEP_DOWN_MIN before anything is filed, so a reboot does not produce a
|
|
# finding for every hostname on the machine.
|
|
#
|
|
# ==============================================================================================
|
|
# RUNTIME MODES
|
|
# ==============================================================================================
|
|
#
|
|
# auth_sweep.sh one pass, files findings
|
|
# auth_sweep.sh --dry-run report what it would file, write nothing
|
|
# auth_sweep.sh --report one-screen summary for the Sunday report; silent when clean
|
|
#
|
|
# ==============================================================================================
|
|
# CONFIGURATION
|
|
# ==============================================================================================
|
|
#
|
|
# AUTH_SWEEP_ENABLED master switch
|
|
# AUTH_SWEEP_UPTIME_MIN 24h percentage below which a host is a candidate
|
|
# AUTH_SWEEP_DOWN_MIN minutes it must have been failing before a finding is filed
|
|
# AUTH_SWEEP_ACCESS_CHECK whether to run the protection half at all
|
|
#
|
|
# ==============================================================================================
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
php "$SCRIPT_DIR/auth_sweep.php" "$@"
|