Verificando entradas Telnet en el syslog con script en Perl.

[Ricardo de Jesús Pelcastre Cervantes]

Escaneo de conexiones en el syslog; el script genera una lista de los
accesos al sistema de manera ordenada por fecha, hora, hostname e ip,
todo esto para tener un control sobre las entradas via telnet.

Ejemplo:

[Mie 28 Jun 17:26:10] - interclan2.nte.dpep.pep.pemex.com =>
142.66.1.141
[Mie 28 Jun 17:51:50] - interclan2.nte.dpep.pep.pemex.com =>
142.66.1.141
[Mie 28 Jun 18:19:57] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 18:30:59] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 18:34:00] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 18:36:11] - naff1ne1i344.nte.dpep.pep.pemex.com =>
142.68.7.23
[Mie 28 Jun 19:15:54] - oem-b6ccd1894ab.nte.dpep.pep.pemex.com =>
142.95.3.22
[Mie 28 Jun 19:46:44] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 19:50:46] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 19:54:47] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Mie 28 Jun 21:50:30] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Jue 29 Jun 07:14:53] - unknown => 142.66.1.230
[Jue 29 Jun 07:31:23] - leveh04.ver.nte.pep.pemex.com => 142.111.1.60
[Jue 29 Jun 07:42:52] - oem-b6ccd1894ab.nte.dpep.pep.pemex.com =>
142.95.3.22
[Jue 29 Jun 09:12:29] - unknown => 142.66.1.141
[Jue 29 Jun 09:12:56] - unknown => 142.66.1.141
[Jue 29 Jun 09:44:51] - naff1ne1i344.nte.dpep.pep.pemex.com =>
142.68.7.23
[Jue 29 Jun 09:55:11] - jerusalem.nte.dpep.pep.pemex.com =>
142.66.1.220
[Jue 29 Jun 12:34:28] - nteux01 => 142.95.1.204
[Jue 29 Jun 12:54:55] - unknown => 142.66.1.141
[Jue 29 Jun 14:07:53] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Jue 29 Jun 14:10:54] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Jue 29 Jun 16:01:24] - oem-b6ccd1894ab.nte.dpep.pep.pemex.com =>
142.95.3.22
[Jue 29 Jun 16:02:12] - unknown => 142.66.1.141
[Jue 29 Jun 16:25:28] - ntii1ne1i056039.nte.dpep.pep.pemex.com =>
142.95.3.127
[Jue 29 Jun 16:37:29] - ntii1ne1i056039.nte.dpep.pep.pemex.com =>
142.95.3.127
[Jue 29 Jun 18:30:54] - naff1ne1i344.nte.dpep.pep.pemex.com =>
142.68.7.23
[Jue 29 Jun 20:21:35] - unknown => 142.95.3.22
[Jue 29 Jun 20:38:43] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Vie 30 Jun 07:43:11] - leveh04.ver.nte.pep.pemex.com => 142.111.1.60
[Vie 30 Jun 08:01:25] - unknown => 142.95.3.22
[Vie 30 Jun 08:31:10] - unknown => 142.66.1.141
[Vie 30 Jun 08:33:57] - ntii1ne1i000000.nte.dpep.pep.pemex.com =>
142.95.3.115
[Vie 30 Jun 08:40:55] - unknown => 142.66.1.141
[Vie 30 Jun 08:41:32] - unknown => 142.66.1.141
[Vie 30 Jun 08:46:16] - unknown => 142.66.1.141
[Vie 30 Jun 08:49:59] - unknown => 142.66.1.141
[Vie 30 Jun 08:50:09] - unknown => 142.66.1.141
[Vie 30 Jun 08:50:45] - unknown => 142.66.1.141
[Vie 30 Jun 08:52:06] - naff1ne1i344.nte.dpep.pep.pemex.com =>
142.68.7.23
[Vie 30 Jun 10:05:01] - mycomputer.nte.dpep.pep.pemex.com =>
142.66.1.91
[Vie 30 Jun 10:32:55] - naff1ne1i344.nte.dpep.pep.pemex.com =>
142.68.7.23

Codigo fuente en perl:

#!/opt/perl/bin/perl
# codigo: ricardo pelcastre

%dias = (Sun => "Dom",
Mon => "Lun",
Tue => "Mar",
Wed => "Mie",
Thu => "Jue",
Fri => "Vie",
Sat => "Sab"
);

%meses = (Jan => "Ene",
Feb => "Feb",
Mar => "Mar",
Apr => "Abr",
May => "May",
Jun => "Jun",
Jul => "Jul",
Aug => "Ago",
Sep => "Sep",
Oct => "Oct",
Nov => "Nov",
Dec => "Dic"
);

$fecha=$ARGV[0];
$cmd="/usr/bin/grep \"$fecha\" /var/adm/syslog/syslog.log\n";

@lineas=qx($cmd);
foreach (@lineas)
{
if (/telnet\/tcp: Connection from\s+(\S+)\s+\((\S+)\) at (\S+)
(\S+)\s+(\S+) (\S+) (\S+
)$/)
{
$salida=sprintf("[%s %2s %s %s] - %s =>
%s\n",$dias{$3},$5,$meses{$4},$6,$1,$2);
print $salida;
}

}