CyberMind-FR
a53d2b1d63
- WAF blocked now counts mitmproxy scenario decisions (1031 blocks) - Removed waf_threats field (redundant with waf_blocked) - Fixed dashboard to show 3 WAF stats: Bans, Alerts, Blocked Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
264 lines
8.5 KiB
Bash
264 lines
8.5 KiB
Bash
#!/bin/sh
|
|
# SecuBox Metrics Dashboard - RPCD Backend
|
|
# Double-buffered pre-cached stats for instant response
|
|
|
|
. /usr/share/libubox/jshn.sh
|
|
|
|
CACHE_DIR="/tmp/secubox"
|
|
CACHE_FILE="$CACHE_DIR/metrics-cache.json"
|
|
CACHE_TTL=30 # seconds
|
|
|
|
# Ensure cache dir exists
|
|
[ -d "$CACHE_DIR" ] || mkdir -p "$CACHE_DIR"
|
|
|
|
# Check if cache is fresh
|
|
cache_is_fresh() {
|
|
[ -f "$CACHE_FILE" ] || return 1
|
|
local now=$(date +%s)
|
|
local mtime=$(stat -c %Y "$CACHE_FILE" 2>/dev/null || echo 0)
|
|
local age=$((now - mtime))
|
|
[ "$age" -lt "$CACHE_TTL" ]
|
|
}
|
|
|
|
# Build overview (called by cron or on stale cache)
|
|
build_overview() {
|
|
local uptime load mem_total mem_free mem_used mem_pct
|
|
local haproxy_up mitmproxy_up crowdsec_up
|
|
local vhost_count metablog_count streamlit_count cert_count lxc_running
|
|
|
|
uptime=$(cut -d. -f1 /proc/uptime 2>/dev/null || echo 0)
|
|
load=$(cut -d' ' -f1-3 /proc/loadavg 2>/dev/null || echo "0 0 0")
|
|
mem_total=$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)
|
|
mem_free=$(awk '/MemAvailable/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)
|
|
[ "$mem_total" -gt 0 ] && mem_used=$((mem_total - mem_free)) || mem_used=0
|
|
[ "$mem_total" -gt 0 ] && mem_pct=$((mem_used * 100 / mem_total)) || mem_pct=0
|
|
|
|
haproxy_up=false
|
|
lxc-info -n haproxy -s 2>/dev/null | grep -q RUNNING && haproxy_up=true
|
|
|
|
mitmproxy_up=false
|
|
lxc-info -n mitmproxy-in -s 2>/dev/null | grep -q RUNNING && mitmproxy_up=true
|
|
|
|
crowdsec_up=false
|
|
pgrep crowdsec >/dev/null 2>&1 && crowdsec_up=true
|
|
|
|
vhost_count=$(uci show haproxy 2>/dev/null | grep -c '=vhost$' || echo 0)
|
|
metablog_count=$(uci show metablogizer 2>/dev/null | grep -c '=site$' || echo 0)
|
|
streamlit_count=$(uci show streamlit 2>/dev/null | grep -c '=instance$' || echo 0)
|
|
cert_count=$(ls /srv/haproxy/certs/*.pem 2>/dev/null | wc -l || echo 0)
|
|
lxc_running=$(lxc-ls --running 2>/dev/null | wc -w || echo 0)
|
|
|
|
printf '{"uptime":%d,"load":"%s","mem_total_kb":%d,"mem_used_kb":%d,"mem_pct":%d,"haproxy":%s,"mitmproxy":%s,"crowdsec":%s,"vhosts":%d,"metablogs":%d,"streamlits":%d,"certificates":%d,"lxc_containers":%d}' \
|
|
"$uptime" "$load" "$mem_total" "$mem_used" "$mem_pct" \
|
|
"$haproxy_up" "$mitmproxy_up" "$crowdsec_up" \
|
|
"$vhost_count" "$metablog_count" "$streamlit_count" "$cert_count" "$lxc_running"
|
|
}
|
|
|
|
# Build WAF stats
|
|
build_waf_stats() {
|
|
local cs_running=false mitmproxy_running=false
|
|
local bans=0 alerts_today=0 waf_blocked=0
|
|
|
|
pgrep crowdsec >/dev/null 2>&1 && cs_running=true
|
|
pgrep -f mitmdump >/dev/null 2>&1 && mitmproxy_running=true
|
|
|
|
if [ "$cs_running" = "true" ]; then
|
|
bans=$(cscli decisions list -o json 2>/dev/null | grep -c '"id"' || echo 0)
|
|
alerts_today=$(cscli alerts list --since 24h -o json 2>/dev/null | grep -c '"id"' || echo 0)
|
|
# WAF blocks = mitmproxy scenario decisions
|
|
waf_blocked=$(cscli decisions list -o json 2>/dev/null | grep -c 'mitmproxy' || echo 0)
|
|
fi
|
|
|
|
printf '{"crowdsec_running":%s,"mitmproxy_running":%s,"active_bans":%d,"alerts_today":%d,"waf_blocked":%d}' \
|
|
"$cs_running" "$mitmproxy_running" "$bans" "$alerts_today" "$waf_blocked"
|
|
}
|
|
|
|
# Build connections
|
|
build_connections() {
|
|
local http_conns https_conns ssh_conns total_tcp
|
|
|
|
http_conns=$(netstat -an 2>/dev/null | grep -c ":80 .*ESTABLISHED" || echo 0)
|
|
https_conns=$(netstat -an 2>/dev/null | grep -c ":443 .*ESTABLISHED" || echo 0)
|
|
ssh_conns=$(netstat -an 2>/dev/null | grep -c ":22 .*ESTABLISHED" || echo 0)
|
|
total_tcp=$(netstat -an 2>/dev/null | grep -c "ESTABLISHED" || echo 0)
|
|
|
|
printf '{"http":%d,"https":%d,"ssh":%d,"total_tcp":%d}' \
|
|
"$http_conns" "$https_conns" "$ssh_conns" "$total_tcp"
|
|
}
|
|
|
|
# Build full cache
|
|
build_cache() {
|
|
local overview waf conns ts
|
|
overview=$(build_overview)
|
|
waf=$(build_waf_stats)
|
|
conns=$(build_connections)
|
|
ts=$(date -Iseconds)
|
|
|
|
printf '{"overview":%s,"waf":%s,"connections":%s,"timestamp":"%s"}' \
|
|
"$overview" "$waf" "$conns" "$ts" > "$CACHE_FILE"
|
|
}
|
|
|
|
# Refresh cache in background if stale
|
|
refresh_cache_async() {
|
|
if ! cache_is_fresh; then
|
|
( build_cache ) &
|
|
fi
|
|
}
|
|
|
|
# Get cached or build
|
|
get_cached() {
|
|
if [ -f "$CACHE_FILE" ]; then
|
|
cat "$CACHE_FILE"
|
|
# Trigger background refresh if getting stale
|
|
refresh_cache_async
|
|
else
|
|
build_cache
|
|
cat "$CACHE_FILE"
|
|
fi
|
|
}
|
|
|
|
# Fast getters from cache
|
|
get_overview() {
|
|
if [ -f "$CACHE_FILE" ]; then
|
|
jsonfilter -i "$CACHE_FILE" -e '@.overview' 2>/dev/null || build_overview
|
|
else
|
|
build_overview
|
|
fi
|
|
}
|
|
|
|
get_waf_stats() {
|
|
if [ -f "$CACHE_FILE" ]; then
|
|
jsonfilter -i "$CACHE_FILE" -e '@.waf' 2>/dev/null || build_waf_stats
|
|
else
|
|
build_waf_stats
|
|
fi
|
|
}
|
|
|
|
get_connections() {
|
|
if [ -f "$CACHE_FILE" ]; then
|
|
jsonfilter -i "$CACHE_FILE" -e '@.connections' 2>/dev/null || build_connections
|
|
else
|
|
build_connections
|
|
fi
|
|
}
|
|
|
|
# Simple getters (less critical, can compute)
|
|
get_certs() {
|
|
json_init
|
|
json_add_array "certs"
|
|
local count=0
|
|
for pem in /srv/haproxy/certs/*.pem; do
|
|
[ -f "$pem" ] || continue
|
|
count=$((count + 1))
|
|
[ $count -gt 10 ] && break
|
|
local name=$(basename "$pem" .pem)
|
|
json_add_object ""
|
|
json_add_string "name" "$name"
|
|
json_add_string "expiry" "valid"
|
|
json_add_int "days_left" 365
|
|
json_add_string "status" "valid"
|
|
json_close_object
|
|
done
|
|
json_close_array
|
|
json_dump
|
|
}
|
|
|
|
get_vhosts() {
|
|
json_init
|
|
json_add_array "vhosts"
|
|
local count=0
|
|
for section in $(uci show haproxy 2>/dev/null | grep "=vhost$" | head -20 | cut -d. -f2 | cut -d= -f1); do
|
|
local domain=$(uci -q get "haproxy.$section.domain")
|
|
local enabled=$(uci -q get "haproxy.$section.enabled")
|
|
[ -z "$domain" ] && continue
|
|
[ "$enabled" != "1" ] && continue
|
|
json_add_object ""
|
|
json_add_string "domain" "$domain"
|
|
json_add_boolean "enabled" 1
|
|
json_close_object
|
|
count=$((count + 1))
|
|
[ $count -ge 20 ] && break
|
|
done
|
|
json_close_array
|
|
json_dump
|
|
}
|
|
|
|
get_metablogs() {
|
|
json_init
|
|
json_add_array "sites"
|
|
for section in $(uci show metablogizer 2>/dev/null | grep "=site$" | head -20 | cut -d. -f2 | cut -d= -f1); do
|
|
local name=$(echo "$section" | sed 's/^site_//')
|
|
local domain=$(uci -q get "metablogizer.$section.domain")
|
|
local port=$(uci -q get "metablogizer.$section.port")
|
|
local enabled=$(uci -q get "metablogizer.$section.enabled")
|
|
local running=0
|
|
netstat -tln 2>/dev/null | grep -q ":${port:-0} " && running=1
|
|
json_add_object ""
|
|
json_add_string "name" "$name"
|
|
json_add_string "domain" "$domain"
|
|
json_add_int "port" "${port:-0}"
|
|
json_add_boolean "enabled" "${enabled:-0}"
|
|
json_add_boolean "running" "$running"
|
|
json_close_object
|
|
done
|
|
json_close_array
|
|
json_dump
|
|
}
|
|
|
|
get_streamlits() {
|
|
json_init
|
|
json_add_array "apps"
|
|
for section in $(uci show streamlit 2>/dev/null | grep "=instance$" | head -20 | cut -d. -f2 | cut -d= -f1); do
|
|
local name="$section"
|
|
local domain=$(uci -q get "streamlit.$section.domain")
|
|
local port=$(uci -q get "streamlit.$section.port")
|
|
local enabled=$(uci -q get "streamlit.$section.enabled")
|
|
local running=0
|
|
pgrep -f "streamlit.*$port" >/dev/null 2>&1 && running=1
|
|
json_add_object ""
|
|
json_add_string "name" "$name"
|
|
json_add_string "domain" "$domain"
|
|
json_add_int "port" "${port:-0}"
|
|
json_add_boolean "enabled" "${enabled:-0}"
|
|
json_add_boolean "running" "$running"
|
|
json_close_object
|
|
done
|
|
json_close_array
|
|
json_dump
|
|
}
|
|
|
|
get_firewall_stats() {
|
|
printf '{"iptables_drops":0,"nft_drops":0,"bouncer_blocks":0}'
|
|
}
|
|
|
|
get_all() {
|
|
get_cached
|
|
}
|
|
|
|
# Cron refresh entry point
|
|
do_refresh() {
|
|
build_cache
|
|
echo "Cache refreshed at $(date)"
|
|
}
|
|
|
|
case "$1" in
|
|
list)
|
|
echo '{"overview":{},"certs":{},"vhosts":{},"metablogs":{},"streamlits":{},"waf_stats":{},"connections":{},"firewall_stats":{},"all":{},"refresh":{}}'
|
|
;;
|
|
call)
|
|
case "$2" in
|
|
overview) get_overview ;;
|
|
certs) get_certs ;;
|
|
vhosts) get_vhosts ;;
|
|
metablogs) get_metablogs ;;
|
|
streamlits) get_streamlits ;;
|
|
waf_stats) get_waf_stats ;;
|
|
connections) get_connections ;;
|
|
firewall_stats) get_firewall_stats ;;
|
|
all) get_all ;;
|
|
refresh) do_refresh ;;
|
|
*) echo '{"error":"Unknown method"}' ;;
|
|
esac
|
|
;;
|
|
esac
|