Mini Shell

#!/usr/bin/perl

=pod

=head1 show-conns

show-conns - Summarize information about connections to different services on the server

=head1 SYNOPSIS

show-conns [--http|--imap|--pop3|--smtp|--ftp|--cpanel|--webmail|--whm|--ssh]* [port-no port-no ...]

=head1 DESCRIPTION

Summarize information about connections to different services on the server

=head1 OPTIONS

=over 8

=item B<--http>

Show only HTTP connection details (ports 80 and 443)

=item B<--imap>

Show only IMAP connection details (ports 143, 993)

=item B<--pop3>

Show only POP3 connection details (ports 110, 995)

=item B<--smtp>

Show only SMTP connection details (ports 25, 465, 587)

=item B<--ftp>

Show only FTP connection details (ports 20, 21)

=item B<--ssh>

Show only SSH connection details (ports 22, 2222)

=item B<--webmail>

Show only Webmail connection details (ports 2095, 2096)

=item B<--cpanel>

Show only Cpanel connection details (ports 2082, 2083)

=item B<--whm>

Show only WHM connection details (ports 2086, 2087)

=item B<--all>

Show all connections on known ports (default behavior)

=item B<-f>, B<--flat>

Do not perform any tabular formatting in the output. Instead, print a flat list of ports, IPs, and connection counts. This is mainly intended for piping into other commands to extract data.

=item B<-c>, B<--count>=I<NUM>

Show the top I<NUM> IPs by connection count for each port. Defaults to 10.

=item B<-b>, B<--bleach>

Disable ANSI color escape sequences in the output

=item B<-h>, B<--help>

You know the drill

=item B<-v>, B<--version>

Ditto

=back

=cut


our $VERSION = "1.1";

use strict;
use Cwd qw( realpath );
use File::Basename;
use File::Spec::Functions;
use Getopt::Long;
use Pod::Usage;

BEGIN {
  my @dir_templates = qw( %s/perl %s/../perl %s/../lib/perl );
  for my $lib_template ( @dir_templates ) {
    my $lib_dir = realpath( sprintf( $lib_template, dirname( __FILE__ ) ) );
    if ( -d "$lib_dir/IMH/" ) {
      unshift( @INC, $lib_dir );
      last;
    }
  }
};

use IMH::ShowConns::Formatters;
use IMH::Terminal;


####################################################################################################
########################### Global Script Variable / Constant Definitions ##########################
####################################################################################################


our $show_all_ports = 1;
our %selected_ports = ();
our @port_groups    = ();
our %connections    = ();
our $flat           = 0;
our %report_options;

####################################################################################################
###################################### Supporting Subroutines ######################################
####################################################################################################


sub select_ports {
  $show_all_ports = 0;
  $selected_ports{ $_ } = 1 for ( @_ );
}


####################################################################################################
############################################ Main Script ###########################################
####################################################################################################



GetOptions(
  "http"      => sub { select_ports( 80, 443 ); },
  "imap"      => sub { select_ports( 143, 993 ); },
  "pop3"      => sub { select_ports( 110, 995 ); },
  "smtp"      => sub { select_ports( 25, 587, 465 ); },
  "ftp"       => sub { select_ports( 20, 21 ); },
  "ssh"       => sub { select_ports( 22, 2222 ); },
  "cpanel"    => sub { select_ports( 2082, 2083 ); },
  "whm"       => sub { select_ports( 2086, 2087 ); },
  "webmail"   => sub { select_ports( 2095, 2096 ); },
  "all"       => sub { $show_all_ports = 1; },
  "c|count=i" => sub {
    my ( $opt, $val ) = @_;
    $report_options{display_count} = $val;
  },
  "f|flat"    => \$flat,
  "b|bleach"  => \$IMH::Terminal::bleach,
  'h|help'    => sub { pod2usage( 0 ); },
  'v|version' => sub {
    print( "$VERSION\n" );
    exit( 0 );
  }
);


for ( @ARGV ) {
  if ( /^\d+$/ ) {
    select_ports( 0 + $_ );
  } else {
    warn( sprintf( "Invalid script argument `%s'\n", $_ ) );
  }
}

open( SS, "/usr/sbin/ss -tan |" );

while ( <SS> ) {

  chomp;
    my @cols                = split( /\s+/ );
    my ( $server, $client ) = @cols[ 3 ... 4 ];

    $server =~ s(^::ffff:)()i;
    $client =~ s(^::ffff:)()i;

    my ( $server_ip, $server_port ) = split( /:/, $server, 2 );
    if ($server_ip == '*' || $server_port == '*' || $server_ip == '0.0.0.0' || $server_ip == '127.0.0.1') {
        next;
    }
    $server_port = 0 + $server_port;

    if ( $server_port < 5000 and $show_all_ports || $selected_ports{ $server_port } ) {
      my ( $client_ip, $client_port ) = split( /:/, $client, 2 );
      $connections{ $server_port }->{ $client_ip }++;
    }
}

close( SS );



#
# %connections should now contain a map that follows this structure:
#    { port_number => { ip_address => connection_count } }
#
# So this loop starts walking through the individual stat maps and calculates
#  the total number of connections for the port
#
for my $port ( keys %connections ) {
  my $port_connections = $connections{ $port };
  my $total            = 0;

  #
  # get the total connection count for the port by summing up the
  # individual IP connection totals
  #
  $total += $_ for ( values %$port_connections );

  $connections{ $port } = {
    total => $total,
    ips   => $port_connections
  };
}


if ( $flat ) {
  flat_report( \%connections, %report_options );
} else {
  tabular_report( \%connections, %report_options );
}