@roflsec/fail2scan 0.0.14 → 0.0.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/daemon.js +82 -114
- package/package.json +1 -1
package/bin/daemon.js
CHANGED
|
@@ -6,12 +6,10 @@ const { execFile, spawn } = require('child_process');
|
|
|
6
6
|
const { promisify } = require('util');
|
|
7
7
|
const execFileP = promisify(execFile);
|
|
8
8
|
|
|
9
|
-
// === Géolocalisation ===
|
|
10
9
|
let getGeo = async (ip) => null;
|
|
11
10
|
if (process.env.IPGEO_API_KEY) {
|
|
12
11
|
const { default: IPGeolocationAPI, GeolocationParams } = require("ip-geolocation-api-javascript-sdk");
|
|
13
12
|
const ipGeo = new IPGeolocationAPI(process.env.IPGEO_API_KEY, true);
|
|
14
|
-
|
|
15
13
|
getGeo = (ip) => {
|
|
16
14
|
return new Promise((resolve) => {
|
|
17
15
|
const params = new GeolocationParams();
|
|
@@ -22,11 +20,9 @@ if (process.env.IPGEO_API_KEY) {
|
|
|
22
20
|
};
|
|
23
21
|
}
|
|
24
22
|
|
|
25
|
-
// === Arguments CLI ===
|
|
26
23
|
const argv = process.argv.slice(2);
|
|
27
|
-
const getArg = (k,
|
|
28
|
-
if
|
|
29
|
-
console.log(`Fail2Scan optimized daemon
|
|
24
|
+
const getArg = (k,d) => { for(let i=0;i<argv.length;i++){const a=argv[i]; if(a===k&&argv[i+1]) return argv[++i]; if(a.startsWith(k+'=')) return a.split('=')[1]; } return d; };
|
|
25
|
+
if(argv.includes('--help')||argv.includes('-h')){console.log(`Fail2Scan optimized daemon
|
|
30
26
|
--log PATH (default /var/log/fail2ban.log)
|
|
31
27
|
--out PATH (default /var/log/fail2scan)
|
|
32
28
|
--concurrency N (default 1)
|
|
@@ -34,41 +30,34 @@ if (argv.includes('--help') || argv.includes('-h')) {
|
|
|
34
30
|
--nmap-args "args" (default "-sS -Pn -p- -T4 -sV")
|
|
35
31
|
--scan-ip IP (do one scan and exit)
|
|
36
32
|
--quiet
|
|
37
|
-
`); process.exit(0);
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
const
|
|
41
|
-
const
|
|
42
|
-
const
|
|
43
|
-
const
|
|
44
|
-
const
|
|
45
|
-
const SINGLE_IP = getArg('--scan-ip', null);
|
|
33
|
+
`); process.exit(0); }
|
|
34
|
+
|
|
35
|
+
const LOG_PATH = getArg('--log','/var/log/fail2ban.log');
|
|
36
|
+
const OUT_ROOT = getArg('--out','/var/log/fail2scan');
|
|
37
|
+
const USER_CONCURRENCY = parseInt(getArg('--concurrency','0'),10)||0;
|
|
38
|
+
const CORE_OVERRIDE = parseInt(getArg('--cores','0'),10)||0;
|
|
39
|
+
const NMAP_ARGS_STR = getArg('--nmap-args','-sS -Pn -p- -T4 -sV');
|
|
40
|
+
const SINGLE_IP = getArg('--scan-ip',null);
|
|
46
41
|
const QUIET = argv.includes('--quiet');
|
|
47
|
-
const RESCAN_TTL_SEC = 60
|
|
48
|
-
const STATE_FILE = path.join(os.homedir(),
|
|
49
|
-
const LOG_FILE = path.join(os.homedir(),
|
|
42
|
+
const RESCAN_TTL_SEC = 60*60;
|
|
43
|
+
const STATE_FILE = path.join(os.homedir(),'.fail2scan_state.json');
|
|
44
|
+
const LOG_FILE = path.join(os.homedir(),'.fail2scan.log');
|
|
50
45
|
|
|
51
|
-
|
|
52
|
-
const log = (...a) => { if (!QUIET) console.log(new Date().toISOString(), ...a); try { fs.appendFileSync(LOG_FILE, new Date().toISOString() + ' ' + a.join(' ') + '\n'); } catch { } };
|
|
46
|
+
const log=(...a)=>{if(!QUIET)console.log(new Date().toISOString(),...a); try{fs.appendFileSync(LOG_FILE,new Date().toISOString()+' '+a.join(' ')+'\n');}catch{}};
|
|
53
47
|
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
async function
|
|
57
|
-
|
|
58
|
-
function safeMkdirSyncWithFallback(p) { try { return fs.mkdirSync(p, { recursive: true, mode: 0o750 }) || p } catch (e) { const f = path.join('/tmp', 'fail2scan'); try { return fs.mkdirSync(f, { recursive: true, mode: 0o750 }) || f } catch (ee) { throw e; } } }
|
|
48
|
+
const sanitizeFilename=s=>String(s).replace(/[:\/\\<>?"|* ]+/g,'_');
|
|
49
|
+
async function which(bin){try{await execFileP('which',[bin]);return true;}catch{return false;}}
|
|
50
|
+
async function runCmdCapture(cmd,args,opts={}){try{const {stdout,stderr}=await execFileP(cmd,args,{maxBuffer:1024*1024*32,...opts}); return {ok:true,stdout:stdout||'',stderr:stderr||''};}catch(e){return {ok:false,stdout:(e.stdout||'')+'',stderr:(e.stderr||e.message)+''};}}
|
|
51
|
+
function safeMkdirSyncWithFallback(p){try{return fs.mkdirSync(p,{recursive:true,mode:0o750})||p}catch(e){const f=path.join('/tmp','fail2scan');try{return fs.mkdirSync(f,{recursive:true,mode:0o750})||f}catch(ee){throw e;}}}
|
|
59
52
|
|
|
60
|
-
|
|
61
|
-
(async () => { for (const t of ['nmap', 'dig', 'whois', 'which']) { if (t === 'which') continue; if (!(await which(t))) { console.error(`Missing required binary: ${t}`); process.exit(2); } } })().catch(e => { console.error('Prereq check failed', e); process.exit(2); });
|
|
53
|
+
(async()=>{for(const t of ['nmap','dig','whois','which']){if(t==='which')continue;if(!(await which(t))){console.error(`Missing required binary: ${t}`);process.exit(2);}}})().catch(e=>{console.error('Prereq check failed',e);process.exit(2);});
|
|
62
54
|
|
|
63
|
-
|
|
64
|
-
function
|
|
65
|
-
|
|
66
|
-
const STATE = loadState();
|
|
55
|
+
function loadState(){try{if(fs.existsSync(STATE_FILE)){const j=JSON.parse(fs.readFileSync(STATE_FILE,'utf8'));return{seen:new Set(Array.isArray(j.seen)?j.seen:[]),retryAfter:typeof j.retryAfter==='object'?j.retryAfter:{}};}}catch{}return{seen:new Set(),retryAfter:{}};}
|
|
56
|
+
function saveState(s){try{fs.mkdirSync(path.dirname(STATE_FILE),{recursive:true,mode:0o700});fs.writeFileSync(STATE_FILE,JSON.stringify({seen:Array.from(s.seen||[]),retryAfter:s.retryAfter||{}},null,2));}catch{}}
|
|
57
|
+
const STATE=loadState();
|
|
67
58
|
|
|
68
|
-
|
|
69
|
-
function extractIpFromLine(line) { const v4 = line.match(/\b(?:\d{1,3}\.){3}\d{1,3}\b/); if (v4 && v4[0]) return v4[0]; const v6 = line.match(/\b([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/); if (v6 && v6[0]) return v6[0]; return null; }
|
|
59
|
+
function extractIpFromLine(line){const v4=line.match(/\b(?:\d{1,3}\.){3}\d{1,3}\b/);if(v4&&v4[0])return v4[0];const v6=line.match(/\b([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/);if(v6&&v6[0])return v6[0];return null;}
|
|
70
60
|
|
|
71
|
-
// === Nmap spawn ===
|
|
72
61
|
function spawnOneNmap(args, outFile) {
|
|
73
62
|
return new Promise((resolve, reject) => {
|
|
74
63
|
const proc = spawn('nmap', args, { stdio: ['ignore', 'pipe', 'pipe'] });
|
|
@@ -78,7 +67,7 @@ function spawnOneNmap(args, outFile) {
|
|
|
78
67
|
proc.stderr.on('data', c => { stderr += c.toString(); });
|
|
79
68
|
proc.on('close', code => {
|
|
80
69
|
if (stderr) {
|
|
81
|
-
try { fs.appendFileSync(outFile, '\n\nSTDERR:\n' + stderr); } catch (e) {
|
|
70
|
+
try { fs.appendFileSync(outFile, '\n\nSTDERR:\n' + stderr); } catch (e) {}
|
|
82
71
|
}
|
|
83
72
|
resolve({ code, ok: code === 0 });
|
|
84
73
|
});
|
|
@@ -102,7 +91,7 @@ async function spawnNmapParallel(ip, outDir, requestedArgs, parts) {
|
|
|
102
91
|
const start = 1 + i * portsPer;
|
|
103
92
|
const end = (i === numParts - 1) ? 65535 : ((i + 1) * portsPer);
|
|
104
93
|
const subdir = path.join(outDir, `part-${i}`);
|
|
105
|
-
try { fs.mkdirSync(subdir, { recursive: true, mode: 0o750 }); } catch (e) {
|
|
94
|
+
try { fs.mkdirSync(subdir, { recursive: true, mode: 0o750 }); } catch (e) {}
|
|
106
95
|
const outNmap = path.join(subdir, 'nmap.txt');
|
|
107
96
|
const portArg = `-p${start}-${end}`;
|
|
108
97
|
const args = requestedArgs.map(a => a === '-p-' ? portArg : a).concat([ip]);
|
|
@@ -115,10 +104,10 @@ async function spawnNmapParallel(ip, outDir, requestedArgs, parts) {
|
|
|
115
104
|
for (let i = 0; i < numParts; i++) {
|
|
116
105
|
const fn = path.join(outDir, `part-${i}`, 'nmap.txt');
|
|
117
106
|
try {
|
|
118
|
-
if (fs.existsSync(fn)) partsContent.push(fs.readFileSync(fn,
|
|
119
|
-
} catch (e) {
|
|
107
|
+
if (fs.existsSync(fn)) partsContent.push(fs.readFileSync(fn,'utf8'));
|
|
108
|
+
} catch (e) {}
|
|
120
109
|
}
|
|
121
|
-
try { fs.writeFileSync(path.join(outDir, 'nmap.txt'), partsContent.join('\n\n--- PART ---\n\n')); } catch (e) {
|
|
110
|
+
try { fs.writeFileSync(path.join(outDir, 'nmap.txt'), partsContent.join('\n\n--- PART ---\n\n')); } catch (e) {}
|
|
122
111
|
}
|
|
123
112
|
|
|
124
113
|
async function runNmap(ip, outDir, requestedArgs) {
|
|
@@ -129,105 +118,84 @@ async function runNmap(ip, outDir, requestedArgs) {
|
|
|
129
118
|
await spawnNmapParallel(ip, outDir, args, parts);
|
|
130
119
|
}
|
|
131
120
|
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
const summary = { ip, ts: now.toISOString(), cmds: {} };
|
|
121
|
+
async function performScan(ip){
|
|
122
|
+
const now=new Date(),dateDir=now.toISOString().slice(0,10),safeIp=sanitizeFilename(ip);
|
|
123
|
+
let outDir=path.join(OUT_ROOT,dateDir,`${safeIp}_${now.toISOString().replace(/[:.]/g,'-')}`);
|
|
124
|
+
outDir=path.join(safeMkdirSyncWithFallback(path.dirname(outDir)),path.basename(outDir));
|
|
125
|
+
try { fs.mkdirSync(outDir,{recursive:true,mode:0o750}); } catch (e) {}
|
|
126
|
+
const summary={ip,ts:now.toISOString(),cmds:{}};
|
|
139
127
|
|
|
140
|
-
const requested
|
|
128
|
+
const requested=NMAP_ARGS_STR.trim().split(/\s+/).filter(Boolean);
|
|
141
129
|
|
|
142
|
-
try
|
|
143
|
-
log('Running nmap on',
|
|
130
|
+
try{
|
|
131
|
+
log('Running nmap on',ip,'args:',requested.join(' '));
|
|
144
132
|
await runNmap(ip, outDir, requested);
|
|
145
133
|
summary.cmds.nmap = { ok: true, args: requested.join(' '), path: 'nmap.txt' };
|
|
146
|
-
} catch
|
|
147
|
-
log('nmap failed for',
|
|
134
|
+
} catch(e){
|
|
135
|
+
log('nmap failed for',ip, e && e.message ? e.message : e);
|
|
148
136
|
summary.cmds.nmap = { ok: false, err: e && e.message ? e.message : String(e) };
|
|
149
137
|
}
|
|
150
138
|
|
|
151
|
-
try {
|
|
152
|
-
|
|
153
|
-
fs.writeFileSync(path.join(outDir, 'dig.txt'), (dig.stdout || '') + (dig.stderr ? '\n\nSTDERR:\n' + dig.stderr : ''));
|
|
154
|
-
summary.cmds.dig = { ok: dig.ok, path: 'dig.txt' };
|
|
155
|
-
} catch (e) { summary.cmds.dig = { ok: false, err: e && e.message ? e.message : String(e) }; }
|
|
156
|
-
|
|
157
|
-
try {
|
|
158
|
-
const who = await runCmdCapture('whois', [ip]);
|
|
159
|
-
fs.writeFileSync(path.join(outDir, 'whois.txt'), (who.stdout || '') + (who.stderr ? '\n\nSTDERR:\n' + who.stderr : ''));
|
|
160
|
-
summary.cmds.whois = { ok: who.ok, path: 'whois.txt' };
|
|
161
|
-
} catch (e) { summary.cmds.whois = { ok: false, err: e && e.message ? e.message : String(e) }; }
|
|
139
|
+
try{ const dig = await runCmdCapture('dig',['-x',ip,'+short']); fs.writeFileSync(path.join(outDir,'dig.txt'),(dig.stdout||'') + (dig.stderr?'\n\nSTDERR:\n'+dig.stderr:'')); summary.cmds.dig = { ok: dig.ok, path: 'dig.txt' }; } catch(e){ summary.cmds.dig = { ok:false, err: e && e.message ? e.message : String(e) }; }
|
|
140
|
+
try{ const who = await runCmdCapture('whois',[ip]); fs.writeFileSync(path.join(outDir,'whois.txt'),(who.stdout||'') + (who.stderr?'\n\nSTDERR:\n'+who.stderr:'')); summary.cmds.whois = { ok: who.ok, path: 'whois.txt' }; } catch(e){ summary.cmds.whois = { ok:false, err: e && e.message ? e.message : String(e) }; }
|
|
162
141
|
|
|
142
|
+
// Geolocation
|
|
163
143
|
try {
|
|
164
|
-
const
|
|
165
|
-
|
|
166
|
-
|
|
144
|
+
const geo = await getGeo(ip);
|
|
145
|
+
if (geo) fs.writeFileSync(path.join(outDir,'geo.json'),JSON.stringify(geo,null,2));
|
|
146
|
+
summary.cmds.geo = { ok: !!geo, path: 'geo.json' };
|
|
147
|
+
} catch(e){ summary.cmds.geo = { ok:false, err: e && e.message ? e.message : String(e) }; }
|
|
167
148
|
|
|
168
|
-
|
|
169
|
-
if (getGeo) {
|
|
170
|
-
try {
|
|
171
|
-
const geo = await getGeo(ip);
|
|
172
|
-
fs.writeFileSync(path.join(outDir, 'geo.json'), JSON.stringify(geo, null, 2));
|
|
173
|
-
summary.geo = geo;
|
|
174
|
-
} catch (e) {
|
|
175
|
-
log('Geo lookup failed for', ip, e.message || e);
|
|
176
|
-
summary.geo = null;
|
|
177
|
-
}
|
|
178
|
-
}
|
|
149
|
+
try{ const nmapTxt = fs.readFileSync(path.join(outDir,'nmap.txt'),'utf8'); summary.open_ports = nmapTxt.split(/\r?\n/).filter(l=>/^\d+\/tcp\s+open/.test(l)).map(l=>l.trim()); } catch(e){ summary.open_ports = []; }
|
|
179
150
|
|
|
180
|
-
try
|
|
181
|
-
try
|
|
182
|
-
log('Scan written for',
|
|
151
|
+
try{ fs.writeFileSync(path.join(outDir,'summary.json'),JSON.stringify(summary,null,2)); } catch (e) {}
|
|
152
|
+
try{ fs.chmodSync(outDir,0o750); } catch (e) {}
|
|
153
|
+
log('Scan written for',ip,'->',outDir);
|
|
183
154
|
}
|
|
184
155
|
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
if
|
|
191
|
-
|
|
192
|
-
this.
|
|
193
|
-
this.q.push(ip); this.tmpCache.add(ip); this._next();
|
|
156
|
+
class ScanQueue{
|
|
157
|
+
constructor(concurrency=1){this.concurrency=concurrency;this.running=0;this.q=[];this.set=STATE.seen;this.tmpCache=new Set();}
|
|
158
|
+
push(ip){
|
|
159
|
+
const now=Math.floor(Date.now()/1000),next=STATE.retryAfter[ip]||0;
|
|
160
|
+
if((this.set.has(ip)&&next>now)||this.tmpCache.has(ip)){log('IP already queued or running (TTL/cache):',ip);return;}
|
|
161
|
+
if(this.set.has(ip)&&next<=now)log('Re-queueing after TTL:',ip),this.set.delete(ip);
|
|
162
|
+
this.set.add(ip);STATE.seen=this.set;saveState(STATE);
|
|
163
|
+
this.q.push(ip);this.tmpCache.add(ip);this._next();
|
|
194
164
|
}
|
|
195
|
-
_next()
|
|
196
|
-
if
|
|
197
|
-
const ip
|
|
165
|
+
_next(){
|
|
166
|
+
if(this.running>=this.concurrency)return;
|
|
167
|
+
const ip=this.q.shift();if(!ip)return;
|
|
198
168
|
this.running++;
|
|
199
|
-
(async
|
|
200
|
-
try
|
|
201
|
-
catch
|
|
202
|
-
finally
|
|
203
|
-
STATE.retryAfter[ip]
|
|
169
|
+
(async()=>{
|
|
170
|
+
try{log('Scanning',ip);await performScan(ip);log('Done',ip);}
|
|
171
|
+
catch(e){log('Error scanning',ip,e.message||e);}
|
|
172
|
+
finally{
|
|
173
|
+
STATE.retryAfter[ip]=Math.floor(Date.now()/1000)+RESCAN_TTL_SEC;
|
|
204
174
|
saveState(STATE);
|
|
205
|
-
this.set.delete(ip);
|
|
206
|
-
this.running--;
|
|
175
|
+
this.set.delete(ip);this.tmpCache.delete(ip);
|
|
176
|
+
this.running--;setImmediate(()=>this._next());
|
|
207
177
|
}
|
|
208
178
|
})();
|
|
209
|
-
setImmediate(()
|
|
179
|
+
setImmediate(()=>this._next());
|
|
210
180
|
}
|
|
211
181
|
}
|
|
212
182
|
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
// === Lancement daemon ===
|
|
217
|
-
const concurrency = CORE_OVERRIDE || USER_CONCURRENCY || os.cpus().length || 1;
|
|
183
|
+
if(SINGLE_IP){(async()=>{const q=new ScanQueue(CORE_OVERRIDE||USER_CONCURRENCY||1);q.push(SINGLE_IP);})();return;}
|
|
184
|
+
const concurrency = CORE_OVERRIDE||USER_CONCURRENCY||os.cpus().length||1;
|
|
218
185
|
const q = new ScanQueue(concurrency);
|
|
219
186
|
log(`Fail2Scan started. Watching ${LOG_PATH} -> output ${OUT_ROOT}, concurrency ${concurrency}`);
|
|
220
187
|
|
|
221
188
|
const BAN_RE = /\bBan\b/i;
|
|
222
|
-
class FileTail
|
|
223
|
-
constructor(filePath,
|
|
224
|
-
start()
|
|
225
|
-
_watch()
|
|
226
|
-
async _readNew()
|
|
227
|
-
close()
|
|
189
|
+
class FileTail{
|
|
190
|
+
constructor(filePath,onLine){this.filePath=filePath;this.onLine=onLine;this.pos=0;this.inode=null;this.buf='';this.watch=null;this.start();}
|
|
191
|
+
start(){try{const st=fs.statSync(this.filePath);this.inode=st.ino;this.pos=st.size;}catch{this.inode=null;this.pos=0;}this._watch();this._readNew().catch(()=>{});}
|
|
192
|
+
_watch(){try{this.watch=fs.watch(this.filePath,{persistent:true},async()=>{try{const st=fs.statSync(this.filePath);if(!st){this.inode=null;this.pos=0;return;}if(this.inode!==null&&st.ino!==this.inode)this.inode=st.ino,this.pos=0;else if(this.inode===null)this.inode=st.ino,this.pos=0;await this._readNew();}catch{}});}catch(e){log('fs.watch failed:',e.message);}}
|
|
193
|
+
async _readNew(){try{const st=fs.statSync(this.filePath);if(st.size<this.pos)this.pos=0;if(st.size===this.pos)return;const stream=fs.createReadStream(this.filePath,{start:this.pos,end:st.size-1,encoding:'utf8'});for await(const chunk of stream){this.buf+=chunk;let idx;while((idx=this.buf.indexOf('\n'))>=0){const line=this.buf.slice(0,idx);this.buf=this.buf.slice(idx+1);if(line.trim())this.onLine(line);}}this.pos=st.size;}catch{}}
|
|
194
|
+
close(){try{this.watch?.close();}catch{}}
|
|
228
195
|
}
|
|
229
|
-
const tail
|
|
196
|
+
const tail=new FileTail(LOG_PATH,line=>{try{if(!BAN_RE.test(line))return;const ip=extractIpFromLine(line);if(!ip)return;q.push(ip);}catch(e){log('onLine handler error',e.message||e);}});
|
|
230
197
|
|
|
231
|
-
function shutdown()
|
|
232
|
-
process.on('SIGINT',
|
|
233
|
-
process.on('SIGTERM',
|
|
198
|
+
function shutdown(){log('Shutting down Fail2Scan...');tail.close();const start=Date.now();const wait=()=>{if(q.running===0||Date.now()-start>10000)process.exit(0);setTimeout(wait,500);};wait();}
|
|
199
|
+
process.on('SIGINT',shutdown);
|
|
200
|
+
process.on('SIGTERM',shutdown);
|
|
201
|
+
//
|
package/package.json
CHANGED