Find bad network-activity on a server

#!/usr/bin/perl

# list of ALLOWED ports
@Ports = (':80', ':443', ':21', ':25', 'portmap', 'STREAM', 'Active UNIX domain sockets', 'RefCnt');

$A   = 'netstat -nlp';

foreach $P (@Ports) {

        $A .= ' | grep -v \'' . $P . '\'';
}

system("$A > /tmp/boese");

$tmp    = `cat /tmp/boese | wc -l`;
$Server = "servername";

chomp($tmp);

if($tmp > 2) {

        # send mail to us if theres something ...
        system ("$A | mail -s \"Unspezifizierte Ports auf $Server offen!\" yourname\@domain.de");
}

unlink("/tmp/boese");

Powered by klikics.de