Скрипты для системных администраторов *NIX, Полезные скрипты для *NIX Опции

[nerve]

на работе поставили точку доступа Интертелеком.
на случай падения основного канала есть маленький скриптик, который сидит в кроне и каждые 5 минут проверяет.

» Нажмите, чтобы показать спойлер - нажмите опять, чтобы скрыть... «

#!/bin/sh

def_gw="x.x.x.x"
back_gw="y.y.y.y"

current_gw=$(netstat -rn | head -5 | tail -1 | awk '{print $2}')

change () {
route change default $1
}

check () {
if ping -q -c 3 8.8.8.8 > /dev/null; then
  echo "Default GW and Internet is OK"
  exit 0
else
  echo "Some problem with Default connection"
  change $backup_gw
fi
}

case $current_gw in
  $default_gw) check
;;
  $backup_gw) change $default_gw; check
;;
esac

Сообщение отредактировал nerve - Aug 22 2016, 16:58

[xfiles]

Проверяем корректно ли работает домен. Чекаем serial, ptr, dns propagation, status, current ns, ttl сразу одним махом. Когда работаешь в хостинге, и каждый день проверять по 1-20 доменов, скрипт сильно оптимизирует рабочее время.

Скрин:

» Нажмите, чтобы показать спойлер - нажмите опять, чтобы скрыть... «

Скрипт:

» Нажмите, чтобы показать спойлер - нажмите опять, чтобы скрыть... «

#!/bin/bash

if [ -z $1 ]; then
echo -e "Usage:\n\t$0 <domain>\n\t <ip>"
exit 0
else
domain=$1
fi

pattern=( "[nN]server:" "Name Server:" "\[Name Server\]" "nameservers:" ) # угадываем как записаны NS в whois-треше
HOST_WAIT="2" # timeout in sec
: ${WHOIS="/usr/bin/whois"}

CL_dark="\e[38;5;242m"
CL_ok="\e[38;5;2m"
CL_clientTransferProhibited="\e[38;5;13m"
CL_linked="\e[38;5;64m"
CL_epp_codes="\e[38;5;117m"
CL_orange="\e[38;5;166m"
CL_mnt="\e[38;5;31m"
CL_status="\e[38;5;30m"
CL_ptr="\e[38;5;26m"
CL_down="\e[38;5;124m"
CL_bad_ptr="\e[38;5;125m"
CL_good_ptr="\e[38;5;11m"
CL_arec="\e[38;5;26m"
CL_txt="\e[38;5;241m"
CL_hold="\e[38;5;124m"
CL_close="\e[0m"

valid_ip () {
local ip=$1
local stat=1
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
IFS='.'; ip=($ip); unset IFS
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
stat=$?
fi
return $stat
}

bl_ch () {

local ip="$1"
echo -e "\n ${CL_txt} Blacklist check: ${CL_close}"

BLISTS="
dnsbl.httpbl.org
cbl.abuseat.org
dnsbl.sorbs.net
bl.spamcop.net
zen.spamhaus.org
combined.njabl.org
"
# register at http://www.projecthoneypot.org/httpbl_api.php to
# obtain an API-key
HTTPbl_API_KEY="[api_key]"

ERROR() {
echo $0 ERROR: $ip >&2
exit 2
}

[ $# -ne 1 ] && ERROR 'Please specify a single IP address'

reverse=$( echo "${ip}" | sed -r 's/^([0-9]{1,3}).([0-9]{1,3}).([0-9]{1,3}).([0-9]{1,3})$/\4.\3.\2.\1/g' )

if [ "x${reverse}" = "x" ] ; then
ERROR "IMHO '$ip' doesn't look like a valid IP address"
exit 1
fi

for BL in ${BLISTS} ; do

if [ "$BL" == "dnsbl.httpbl.org" ]; then
LISTED="$( dig +short -t a ${HTTPbl_API_KEY}.${reverse}.${BL}. )"
printf "${CL_mnt}${HTTPbl_API_KEY}.${CL_txt}%-40s${CL_dark}%-20s${CL_close}\n" "${reverse}.${BL}." ${LISTED:----}
else
LISTED="$( dig +short -t a ${reverse}.${BL}. )"
printf "${CL_txt}%-50s${CL_dark}%-20s${CL_close}\n" ${reverse}.${BL}. ${LISTED:----}
fi
done
}

get_arpa () {

if valid_ip ${domain}; then

echo -e "${CL_txt} NS's \t\t [ PTR ] ${CL_close}"

NS=( $( V="$(host -W $HOST_WAIT -a ${domain}
if [ $? -eq 1 ]; then
echo -e "${CL_txt}> ${CL_down}NXDOMAIN ${CL_close}" 1>&2
fi
)"
V_FILTERED="$(echo "${V}" | grep "IN.*NS" | awk '{print $5}')"
if [ -z "${V_FILTERED}" ]; then
echo -e "${CL_txt}> ${CL_orange}no NS ${CL_close}" 1>&2
fi
echo "${V_FILTERED}"
)
)

for ns in ${NS[@]}; do

recPTR="$( host -W $HOST_WAIT -tPTR "${domain}" "${ns}" 2>/dev/null | awk -F"name pointer" '{print $2}' | grep . | tr -d " " | tr "\n" " " )"
printf "${CL_orange}%-30s${CL_PTR}%-35s${CL_close}\n" "${ns}" "${recPTR}"

done

RET=0
fi
return ${RET:-1}
}

get_whois () {

# ищем в whois нужное, и пишем это в переменные
WHOIS_V=$( ${WHOIS} ${domain:-NONEXISTSDOMAIN.COM} )

for p in "${pattern[@]}"; do

NS=( $(echo "${WHOIS_V}" | grep "${p}" | \
sed "s/$p//" | \
awk '{print $1}' | \
tr "[A-Z]" "[a-z]" | \
sort | uniq
)
)

[[ ! -z "${NS}" ]] && break # если по паттерну нашли строку с NS, дальше не грепаем
done

[[ ${#NS[@]} -eq 0 ]] && { echo -e "${CL_down}${WHOIS_V}\n${CL_close}"; exit 0; } # если, по паттерну, ничего не нашли

mntby=$( echo "${WHOIS_V}" | grep -i "mnt-by:" | head -n1 | tr -s ' ' )
# https://www.icann.org/resources/pages/epp-s...s-2014-06-16-en
status=( $( echo "${WHOIS_V}" | \
grep -iEo "status:.*" | \
sed 's/[Ss]tatus://' | \
sed 's/http[^ ]*//g' | \
tr -d " " | \
sed "s|linked|\\${CL_linked}linked\\${CL_close}| ; \
s|addPeriod|\\${CL_epp_codes}addPeriod\\${CL_close}| ; \
s|autoRenewPeriod|\\${CL_epp_codes}autoRenewPeriod\\${CL_close}| ; \
s|inactive|\\${CL_epp_codes}inactive\\${CL_close}| ; \
s|[oO][kK]|\\${CL_ok}ok\\${CL_close}| ; \
s|pendingCreate|\\${CL_epp_codes}pendingCreate\\${CL_close}| ; \
s|pendingDelete|\\${CL_epp_codes}pendingDelete\\${CL_close}| ; \
s|pendingRenew|\\${CL_epp_codes}pendingRenew\\${CL_close}| ; \
s|pendingRestore|\\${CL_epp_codes}pendingRestore\\${CL_close}| ; \
s|pendingTransfer|\\${CL_epp_codes}pendingTransfer\\${CL_close}| ; \
s|pendingUpdate|\\${CL_epp_codes}pendingUpdate\\${CL_close}| ; \
s|redemptionPeriod|\\${CL_epp_codes}redemptionPeriod\\${CL_close}| ; \
s|renewPeriod|\\${CL_epp_codes}renewPeriod\\${CL_close}| ; \
s|serverDeleteProhibited|\\${CL_epp_codes}serverDeleteProhibited\\${CL_close}| ; \
s|serverHold|\\${CL_epp_codes}serverHold\\${CL_close}| ; \
s|serverRenewProhibited|\\${CL_epp_codes}serverRenewProhibited\\${CL_close}| ; \
s|serverTransferProhibited|\\${CL_epp_codes}serverTransferProhibited\\${CL_close}| ; \
s|serverUpdateProhibited|\\${CL_epp_codes}serverUpdateProhibited\\${CL_close}| ; \
s|transferPeriod|\\${CL_epp_codes}transferPeriod\\${CL_close}| ; \
s|clientDeleteProhibited|\\${CL_epp_codes}clientDeleteProhibited\\${CL_close}| ; \
s|clientHold|\\${CL_hold}clientHold\\${CL_close}| ; \
s|clientRenewProhibited|\\${CL_epp_codes}clientRenewProhibited\\${CL_close}| ; \
s|clientTransferProhibited|\\${CL_clientTransferProhibited}clientTransferProhibited\\${CL_close}| ; \
s|clientUpdateProhibited|\\${CL_epp_codes}clientUpdateProhibited\\${CL_close}|
"
)
)

# Итого, вынесли с whois переменные $mntby $status ${NS[]}
}

print_line () {

local i=$1

# для первой строки, свой принт
if [ $i -eq 0 ]; then
printf "${CL_orange}%-30s${CL_recAs}%-16s${CL_PTR}%-35s${CL_rDNS_CHK}%-8s${CL_dark}%-20s${CL_close}\n" "${ns}" "${recAs}" "${PTR}" "${rDNS_CHK}" "${rDNS_CHK_TXT}"
else
printf " ${CL_recAs}%-16s${CL_PTR}%-35s${CL_rDNS_CHK}%-8s${CL_dark}%-20s${CL_close}\n" "${recAs}" "${PTR}" "${rDNS_CHK}" "${rDNS_CHK_TXT}"
fi
}

get_ns () {

local NStype=$1
case ${NStype} in

auth)
:
NS_save_auth=( "${NS[@]}" )
;;

locall)
NS=()
NS=( $(cat /etc/resolv.conf | grep nameserver | grep -oE "[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}" ) )
NS_save_locall=( "${NS[@]}" )
;;

public)
NS=()
NS=( 8.8.8.8 8.8.4.4 1.1.1.1 9.9.9.9 5.1.2.1 5.1.2.2)
NS_save_public=( "${NS[@]}" )
;;

*)
NS=()
echo "bad NS type"
exit 0
;;
esac

local ns_seq=0
for ns in ${NS[@]}; do

# flush var's
recAs=""
PTR=""
rDNS_CHK=""
rDNS_CHK_TXT=""
CL_PTR=""
CL_recAs=""
CL_rDNS_CHK=""
serial=""

# строим список А-записей одной строкой через пробелы
recA="$( host -W $HOST_WAIT -tA "${domain}" "${ns}" 2>/dev/null | awk -F"has address" '{print $2}' | grep . | tr -d " " | tr "\n" " " )"
#echo "a:${recA}:"

# для функции print_line
local i=0

if [[ -z "${recA}" ]]; then

recAs="-"
PTR="-"
rDNS_CHK="-"
CL_PTR="${CL_dark}"
CL_recAs="${CL_dark}"
CL_rDNS_CHK="${CL_dark}"

print_line $i

else

CL_recAs="${CL_arec}"

for recAs in ${recA}; do

PTR="$( host -W $HOST_WAIT "${recAs}" "${ns}" 2>/dev/null | grep -v "not found:" | awk -F"name pointer" '{print $2}' | grep . | tr "\n" " " | tr -d " " )"
#echo "ptr:${PTR}:"

if [[ -z "${PTR}" ]]; then

PTR="-"
#LN_PTR="17"
CL_PTR="${CL_dark}"

rDNS_CHK="-"
rDNS_CHK_TXT=""
CL_rDNS_CHK="${CL_dark}"

else
CL_PTR="${CL_ptr}"
#LN_PTR=$(( ${#PTR} +8 ))

rDNS="$( host -W $HOST_WAIT "${PTR}" "${ns}" 2>/dev/null | grep -v "not found:" | awk -F"has address" '{print $2}' | grep . | tr -d " " | tr "\n" " " )"
#echo "rdns:${rDNS}:"

# сверяем А-запись и резолв PTR
if [[ "${rDNS}" == *${recAs}* ]]; then
rDNS_CHK="[ GOOD ]"
rDNS_CHK_TXT=""
CL_rDNS_CHK="${CL_good_ptr}"
else
rDNS_CHK="[ BAD ]"
rDNS_CHK_TXT="${rDNS:-NULL}"
CL_rDNS_CHK="${CL_bad_ptr}"
fi
fi

print_line $i
(( i++ ))

done
fi

# достаем с текущего ${ns} сериал для домена ${domain}
local SOA="$( host -W $HOST_WAIT -tSOA "${domain}" "${ns}" 2>/dev/null | awk -F"has SOA record" '{print $2}' | grep . )"
local SOAmaster="$( echo "${SOA}" | awk '{print $1}' )"
local SOAserial="$( echo "${SOA}" | awk '{print $3}' | grep -Eo "[0-9]{10}" | tr -d " " )"
local SOAttl="$( echo "${SOA}" | awk '{$1=$2=$3="";print}' )"

case ${NStype} in
auth) recS_auth[$ns_seq]="${SOAserial}"
recS_auth_master[$ns_seq]="${SOAmaster}"
recS_auth_ttl[$ns_seq]="${SOAttl}"
;;
locall) recS_locall[$ns_seq]="${SOAserial}"
;;
public) recS_public[$ns_seq]="${SOAserial}"
;;
esac

(( ns_seq++ ))
done
}

serial_check_auth () {

master_ok=0

# совпадает ли мастер сервер в ответах от авторитативных серверов
find_master=( $( echo "${recS_auth_master[@]}" | tr " " "\n" | sort | uniq | grep . ) )

if [ ! ${#find_master[@]} -eq 1 ]; then
echo -e "\t ${CL_down}SOA master mismatch in Authoritative DNS: ${find_master[@]:-"N/A"}${CL_close}"
else

# for start print_timers()
master_ok=1

#
echo -e "\t ${CL_txt}Find master: ${CL_ok}${find_master}${CL_close}"

# определить кто из авторитативных есть мастер; нужно ли ?
#try_resolve="$( host -W $HOST_WAIT -tA "${find_master}" "${find_master}" 2>/dev/null | grep -v "not found:" | awk -F"has address" '{print $2}' | grep . | tr -d " " | tr "\n" " " )"

# совпадает ли сериал в ответах от авторитативных серверов
find_serial=( $( echo "${recS_auth[@]}" | tr " " "\n" | sort | uniq | grep . ) )
if [ ! ${#find_serial[@]} -eq 1 ]; then
echo -e "\t ${CL_down}SOA serial mismatch in Authoritative DNS: ${find_serial[@]:-"N/A"}${CL_close}"

# global var ${CL_serial_over}
CL_serial_over="${CL_down}"
else
echo -e "\t ${CL_txt}Find serial: ${CL_ok}${find_serial}${CL_close}"
fi

fi
}

serial_check_locall () {

for ((s=0; s<${#NS_save_locall[@]}; s++)); do

if [ -z "${recS_locall[$s]}" ]; then
local CL_serial_over="${CL_dark}"
recS_locall[$s]="-"
else
if [[ "${find_serial}" =~ "${recS_locall[$s]}" ]]; then
CL_serial="${CL_ok}"
else
CL_serial="${CL_down}"
fi
fi

printf "${CL_orange}%-21s${CL_close} ${CL_serial}${CL_serial_over}%-30s${CL_close}\n" "${NS_save_locall[$s]}" "${recS_locall[$s]}"

done
}

serial_check_public () {

for ((s=0; s<${#NS_save_public[@]}; s++)); do

if [ -z "${recS_public[$s]}" ]; then
local CL_serial_over="${CL_dark}"
recS_public[$s]="-"
else
if [[ "${find_serial}" =~ "${recS_public[$s]}" ]]; then
CL_serial="${CL_ok}"
else
CL_serial="${CL_down}"
fi
fi

printf "${CL_orange}%-21s${CL_close} ${CL_serial}${CL_serial_over}%-30s${CL_close}\n" "${NS_save_public[$s]}" "${recS_public[$s]:--}"

done

}

print_timers () {

# From Pingdom: http://dnscheck.pingdom.com/

# SOA TTL recommended >= 3600.
# SOA refresh recommended >= 14400.
# SOA retry recommended >= 3600.
# SOA expire recommended >= 604800.
# SOA minimum recommended between 300 and 86400.

TIMERS=( $( for (( t=0; t<${#recS_auth_ttl[@]}; t++ )); do
echo "${recS_auth_ttl[t]}"
done | sort | uniq
)
)

if [ ! ${#TIMERS[@]} -eq 4 ]; then
echo -e "\t${CL_down} ERROR IN SOA TIMERS: ${TIMERS[@]:-"NULL"} ${CL_close}"
else
REM_RF="planned zone re-read (recommended >= 14400)"
REM_RT="how offten re-read if fail master (recommended >= 3600)"
REM_EX="how long alive after fail master (recommended >= 604800)"
REM_DF="for application (recommended between 300 and 86400)"
printf "\t ${CL_txt}Refresh: ${CL_ok}%-10s${CL_txt}%-50s${CL_close}\n" "${TIMERS[0]}" "${REM_RF}"
printf "\t ${CL_txt}Retry: ${CL_ok}%-10s${CL_txt}%-50s${CL_close}\n" "${TIMERS[1]}" "${REM_RT}"
printf "\t ${CL_txt}Expire: ${CL_ok}%-10s${CL_txt}%-50s${CL_close}\n" "${TIMERS[2]}" "${REM_EX}"
printf "\t ${CL_txt}Default TTL: ${CL_ok}%-10s${CL_txt}%-50s${CL_close}\n" "${TIMERS[3]}" "${REM_DF}"
fi
}

smtp_ssl_check () {
if [ $master_ok -eq 1 ]; then

SSL_if_support="$( openssl x509 xxx 2>&1 | grep -o "\-checkhost" )"
if [ -z "$SSL_if_support" ]; then
echo -e "${CL_txt}openssl '-checkhost' not support${CL_close}"
return 1
fi

recMX="$( host -W $HOST_WAIT -tMX "${domain}" "${find_master}" 2>/dev/null | awk -F"handled by" '{print $2}' | grep . )"
if [ -z "${recMX}" ]; then
echo "No MX-record"
return 0
fi

MX_value=( $( echo "${recMX}" | awk '{print $2}' | sed 's/\.$//' ) )
MX_prior=( $( echo "${recMX}" | awk '{print $1}' ) )

for ((m=0;m<${#MX_value[@]};m++)); do

#CL_ssl_res=""
SSL_check=""
SSL_proto=""
#RES=""
SSL_check="$( echo | openssl s_client -connect ${MX_value[m]}:25 -starttls smtp 2>&1 | openssl x509 -noout -checkhost ${MX_value[m]} 2>&1 )"
SSL_proto="$( echo | openssl s_client -connect ${MX_value[m]}:25 -starttls smtp 2>&1 | grep Protocol | sed 's/Protocol//' | sed "s/://" | tr -d " " )"

if [[ "${SSL_check}" =~ "unable to load certificate" ]]; then

CL_ssl_res="${CL_dark}"
RES="-"
SSL_proto="${SSL_proto:--}"

elif [[ "${SSL_check}" =~ "does match" ]]; then

CL_ssl_res="${CL_ok}"
RES="Ok"

else
CL_ssl_res="${CL_down}"
RES="mismatch"
fi

MX_prior[m]="[${MX_prior[m]}]"
printf "${CL_orange}%-25s ${CL_dark}%-5s${CL_ssl_res}%-10s%-10s${CL_close}\n" "${MX_value[m]}" "${MX_prior[m]}" "${RES}" "${SSL_proto}"

done

fi
}

# ----------------------- GO RUN ------------------------------------------------------

if get_arpa; then
bl_ch ${domain}
exit 0
fi

get_whois

echo -e "\n ${CL_txt} Authoritative DNS: ${CL_close}"
echo -e " ${CL_txt}${mntby:-mnt-by:}${CL_close}"
echo -e " ${CL_txt}status: ${status[@]:-"n/a"}${CL_close}\n"
echo -e "${CL_txt} NS's \t\t [ A ] [ PTR ] [ rDNS ] ${CL_close}"
get_ns auth

echo -e "\n ${CL_txt} Local DNS (TopNET): ${CL_close}"
get_ns locall

echo -e "\n ${CL_txt} Public DNS (Google, CF, DG Anycast): ${CL_close}"
get_ns public

echo -en "\n ${CL_txt} Compare SOA from authoritative DNS: ${CL_close}\n"
serial_check_auth
serial_check_locall
serial_check_public
print_timers

echo -en "\n ${CL_txt} Check SMTP SSL: ${CL_close}\n"
smtp_ssl_check

echo
exit 0