Скрипт контроля авторизации LoginSecurity для MikroTik

Добрый день! более удобная альтернатива так называемого port knocking.

//определяем локальные переменные

:local sysname [/system identity get name];

:local sysver [/system package get routeros version];

:local sysreso [:sys reso get uptime];

//отдельный журнал лога для уменьшения нагрузки на слабых микротах

:loc LoginList LoginSecurity;

# список плохишей

:loc LB LoginSecurity-;

# список хороших

:loc LA LoginSecurity+;

:loc ESMTP [:resolve "smtp.yandex.ru"];

:loc EUSER login@ya.ru;

:loc EPASS password;

:loc EPORT 587;

/if ([/tool/e-m/g address]=$ESMTP) do={} else={/tool/e-m/set address=$ESMTP;};/if ([/tool/e-m/g from]=$EUSER) do={} else={/tool/e-m/set from=$EUSER;};/if ([/tool/e-m/g port]=$EPORT) do={} else={/tool/e-m/set port=$EPORT;};/if ([/tool/e-m/g user]=$EUSER) do={} else={/tool/e-m/set user=$EUSER;};/if ([/tool/e-m/g password]=$EPASS) do={} else={/tool/e-m/set password=$EPASS;};/if ([/tool/e-m/g tls]="starttls") do={} else={/tool/e-m/set tls="starttls";};

/if ([/sys logg action/find name=$LoginList]="") do={/sys logg action add memory-lines=150 name=$LoginList target=memory;/sys logg add action=$LoginList topics=system,error,critical prefix="$sysnameLogin";/system logging add action=$LoginList topics=system,account,inf prefix="$sysnameLogin";};

:foreach line in=[/log find buffer=$LoginList message~"login failure"] do={:do {:loc message [/log get $line message];:loc LoginLogin [:pick "$message" [:put ([:find "$message" "user" -1]+5)] [:put ([:find "$message" "from" -1]-1)]];:loc LoginIP [:pick "$message" [:put ([:find "$message" "from" -1]+5)] [:put ([:find "$message" "via" -1]-1)]];:delay 1;/if ([/ip fir address-list find address=$LoginIP list=$LB]) do={ :log info "IP exits $LoginIP $LoginLogin"; } else={ :ip f a a address=$LoginIP list=$LB timeout=1d comment=$LoginLogin;/tool e-mail send to="kalugin66@ya.ru" subject="$sysname $sysver $sysreso LoginSecurity" body="$LB $LoginIP"; };/log error "[$LB] $LoginIP $LoginLogin";}};:foreach line in=[/log find buffer=$LoginList message~"logged"] do={:do {:loc message [/log get $line message];:loc LoginLogin [:pick "$message" [:put ([:find "$message" "user" -1]+5)] [:put ([:find "$message" "logged" -1]-1)]];:loc LoginIP [:pick "$message" [:put ([:find "$message" "from" -1]+5)] [:put ([:find "$message" "via" -1]-1)]];:delay 1;/if ([/ip fir address-list find address=$LoginIP list=$LA]) do={ /ip f a a address=$LoginIP list=$LA comment=$LoginLogin;/tool e-mail send to="kalugin66@ya.ru" subject="$sysname $sysver $sysreso LoginSecurity" body="$LA $LoginIP"; };/log error "[$LA] $LoginIP";}};

:sy lo ac set $LoginList memory-lines=1;:sy lo ac set $LoginList memory-lines=150;:log info "Good Finish LoginSecurity";