Email alert when client in blacklist joins network

I have a textfile with a list of strings I want to monitor in my network.

alertlist:

hans
franz
tanz

So it can output for me whenever the a strings it matched:

#!/bin/sh
while : ; do
    testfile="/var/media/ftp/alertlist.txt"
  [[ -f "$testfile" ]] && echo "${testfile##*/} exists." ||  echo "${testfile##*/} does not exist."
  while /var/media/ftp/look.sh active | grep -i -f  /var/media/ftp/alertlist.txt
  do
???
        sleep 4 
    done
    sleep 4
done&

Now what I want is eh a notification, whenever the state changes, example, hans joins, franz leaves franz and tanz joins etc.

not when found or nor, only when the situation changes

how can I do this while keepin the I/O to the flashdrives to a minimum?

Hmm. Quick question - if a process or user is blacklisted correctly - iptables in linux can do this for you - then it never, ever get your system to start with. Why do you allow them to get going on your system to start with??

The tool to block access by IP is OS dependent. I gave a linux example.

this is more for that I'm informed if specific people are coming or nearby to my place via wifi

okay blacklist is misleading here, it is more an "alert list"

I have optimized the question. I hope it is clearer now...

I just want to do soemthing in this loop, if one the strings in the textfile apear in the shell output the first time, or when they disappear, or re appear..

If you want to keep I/O to a flashdrive to a minimum, why are you accessing that flashdrive at least four times every 4 seconds?

If you have a list of strings to search for, why do you have to test every four seconds whether or not your list exists? Does this list change frequently while you're running your script?

If you have a program you want to run every 4 seconds and you want to minimize accesses to a flashdrive, why is the program you want to run on a flashdrive?

What does /var/media/ftp/look.sh do? Does it invoke any other software that is located on that flashdrive? Does it access any other files that are located on that flashdrive?

Why are any of these files on a flashdrive if you don't want to access the flashdrive?

What output does /var/media/ftp/look.sh produce? Is the output just strings exactly matching the format of the strings in /var/media/ftp/alertlist.txt , or do lines in the output contain additional text that needs to be stripped away as part of your output?

Can a string in /var/media/ftp/alertlist.txt appear in the output from /var/media/ftp/look.sh more than once? If so, does the output from your script need to notice differences in the number of times a string is found? Or, does it just need to notice when the number of times a given string string appears changes from zero to non-zero and from non-zero to zero?

Does you output just need to give a list of the strings that changed status? Or does the output need to report strings that appeared and strings that disappeared, or the number of times a string appeared in the latest time through the loop?

If these strings are people's names or login IDs, do you really need case insensitive matches? Are UserName and username to be treated as different strings or as a single string?

Thats a good point! I need to fix this. :sunglasses:

The list changes, but reading it once every hour should be sufficient

If you have a program you want to run every 4 seconds and you want to minimize accesses to a flashdrive, why is the program you want to run on a flashdrive?

Look.sh calls a system internal function which goes through a set of arrays with which you can output several information. in this case I just let output clients in the network and its state (active/online)

it is how it is...

lines in the output like in the alertlist.txt

If you mean as a part of a string yes. so if alertlist.txt contains hans, look.sh could output this what I would like to have considered

hans
hansolo
Hansala

Hans joined
Hansala left
Hans left
hansolo joined

etc...

ideally yes

I saw there is a watch command available
This should display all output differences? can maybe this be used for this?

can this be used to just consider the data in the lists?

watch - Repeat Linux / Unix Command Regular Intervals

I apologize for not getting back to you sooner. When I saw some of your responses below, I guess I just lost interest.

So, have you done anything to fix this in the last six weeks?

OK. Have you made any changes to your script to only check this file once per hour?

That didn't answer either question.

Is /var/media/ftp/look.sh dependent on anything on the flashdrive? I.e., can we copy it off of the flash drive into /tmp and run it from there (which would change the number of accesses to the flashdrive from once every four seconds to just once)? And, why is it on your flashdrive at all? Why isn't it in your $HOME/bin directory instead?

This is what made me lose interest in this thread. If it is how it is and you aren't interested in changing it, why should we bother making suggestions?

OK. Thanks. That helps.

No, that is not what I meant. Can look.sh return two or more lines containing a name like hans ? (Presumably, this would indicate that two or more wifi stations have detected that hans is within range.) If a given name can be reported more than once, does your script need to report that a user appears or disappears, or does it need to report that the number of times a user appears has changed?

OK. I assume this is because whoever is editing alertlist.txt is careless with the shift key when adding names to the list.

It sounds like this might work perfectly for you... if you do NOT want to reduce the number of times your flashdrive is accessed.

The following script might help with your issues, but it is making LOTS of assumptions since you haven't answered many of my questions. If any of my assumptions are wrong, this script won't work. My assumptions include, but might not be limited to:

  1. Your flashdrive is mounted on the mount point /var/media/ftp .
  2. A primary goal of this modification to your script (whether it sits on your flashdrive, in your $HOME/bin directory, or in some other directory that you implicitly or explicitly specify the you run this script) is to reduce accesses to your flashdrive. After the initial start-up, this script accesses your flashdrive once per hour if your blacklist ( alertlist.txt ) does not change during the preceding hour or four times if the blacklist does change during that hour. Accesses to files off of the flashdrive are less efficient than they might otherwise be because the primary goal of these changes to your script is to reduce accesses to the flashdrive.
  3. The interpreter used to run your script is not a traditional Bourne shell. The following script was written and tested using a Korn shell, but should work with any mostly POSIX-conforming shell (such as bash , dash , ksh , or zsh ). It will NOT work with any csh derivative and will NOT work with a traditional Bourne shell.
  4. The script /var/media/ftp/look.sh can be moved off of the flashdrive into a different directory and run from that alternative location without referencing any other files on the flashdrive.
  5. This script looks for blacklisted nearby WiFi users and then sleeps for 4 seconds; it does not make any attempt to run every four seconds. (If it takes one second to run the code in the loop, this means the loop will be run about twelve times per minute instead of fifteen times per minute. I doubt that it will take one second to run one iteration of the loop, but the type of hardware you'r using, the amount of available memory you have, scheduling delays, system load, networking delays in delivering e-mail, etc. clearly may introduce delays that will keep this script from running 15 times per minute.)
  6. The only way to stop this script is to kill it (and if kill -9 is used to stop it, it will not be able to remove the temporary work areas it uses). It would be a good idea to add a stop file that the script can examine every time it goes through the loop and if that stop file is found, it will stop and exit normally.
  7. There is no attempt to keep multiple invocations of this script from running simultaneously. If that is a problem in your environment, add code to keep another invocation from running if the script is already running.
  8. Additional checks will be added to verify that commands run inside the loop complete successfully. This script is provided for demonstration purposes and is not suitable for use as production code.
  9. You will change the e-mail address shown in red in this script to be one or more valid e-mail addresses o people who want to receive the output produced by this script.
#!/bin/ksh
IAm=${0##*/}			# basename of this script
TempDir="/tmp/$IAm.$$"		# script working directory
ThumbDir='/var/media/ftp'	# Flashdrive mount point

BlackList='alertlist.txt'	# List of names on the blacklist
LookScript='look.sh'		# Script to look for nearby WiFi users
Log="$TempDir/log"		# Log of issues to report on this loop iteration
OldFile="$TempDir/old"		# LookScript output from previous loop iteration
NewFile="$TempDir/new"		# LookScript outupt from current loop iteration

# Remove script working directory on script termination.
trap 'rm -rf "$TempDir"' EXIT

# Verify that needed files are present and copy them from flashdrive to work
# area.
if ! cd "$ThumbDir"
then	printf '%s: Thumb Drive not mounted at "%s".  Aborting.\n' \
	    "$IAm" "$ThumbDir" >&2
	exit 1
fi
if [ ! -f "$BlackList" ] || [ ! -x "$LookScript" ]
then	ls -l "$BlackList" "$LookScript"
	printf '%s: "%s" or "%s" not found in "$ThumbDir".  Aborting.\n' \
	    "$IAm" "$BlackList" "$LookScript" "$ThumbDIr" >&2
	exit 2
fi

# Create a temporary work area (not on the flashdrive)...
if ! mkdir -p -m 0700 "$TempDir"
then	printf '%s: Could not create work area ("%s").  Aborting.\n' \
	    "$IAm" "$TempDir" >&2
	exit 3
fi
if ! cp "$BlackList" "$LookScript" "$TempDir"
then	printf '%s: Copying files to work araa failed.  Aborting.\n' "$IAm" >&2
	exit 4
fi

# And note the hour when the above files were copied.
hr=$(date +%H)

# Note also that each of the following executions of look.sh, grep, mv, and
# mailx shouldbe checked for successful completion, but doing that is left as
# an exercise for the reader...

# Note that whenever $Log is a non-empty file, a mail message will be sent...
# so the following will send a message the first time we go through the
# following loop even if no blacklisted users are nearby when this script
# starts.
date +"$IAm started on %x at %X" > "$Log"

# Get initial list of nearby blacklisted users.  (Note that this list is going
# to $OldFile instead of $NewFile so it can serve as the comparison point for
# the 1st time through the following loop.)
"$TempDir/$LookScript" active | grep -Fix -f "$TempDir/$BlackList" > "$OldFile"

# And, if it is not empty, log them as newly near...
[ -s "$OldFile" ] && while read -r name
do	printf '%s joined\n' "$name"
done < "$OldFile" >> "$Log"

# Now run the body of our script every four seconds.  Note that it would be
# more efficient to change directory to $TempDir, but staying on the flashdrive
# reduces accesses to the flashdrive.
while sleep 4
do	# Check to see if we need to update the blacklist at the top of every
	# hour...
	now=$(date +%H)
	if [ $now != $hr ]
	then	# We have just started a new hour, check to see if the blacklist
		# has changed.
		[[ "$BlackList" -nt "$TempDir/$BlackList" ]] &&
		    cp "$BlackList" "$TempDir/$BlackList" &&
		    echo  "$BlackList update installed." >> "$Log"
		# If your shell does not accept the syntax of the above test
		# command list, # comment it out and uncomment the following
		# slower find command that will make more accesses to the
		# flashdrive than the above AND list.
		# find . -name "$BlackList" -newer "$TempDir/$BlackList" \
		#     -exec cp {} "$TempDir/$BlackList" \; \
		#     -exec echo "$BlackList update installed." \; >> "$Log"
		hr=$now
	fi

	# Find blacklisted users currently on nearby WiFi.
	"$TempDir/$LookScript" active | grep -Fix -f "$TempDir/$BlackList" \
	    > "$NewFile"

	if [ -s "$OldFile" ] && [ -s "$NewFile" ]
	then	# Gather list of blacklisted users who are no longer nearby.
		grep -Fivx -f "$NewFile" "$OldFile" | while read -r name
		do	printf '%s left\n' "$name"
		done >> "$Log"

		# Gather list of blacklisted users who were not seen last time.
		grep -Fivx -f "$OldFile" "$NewFile" | while read -r name
		do	printf '%s joined\n' "$name"
		done >> "$Log"
	elif [ -s "$OldFile" ]
	then	# Gather list of blacklisted users who are no longer nearby.
		while read -r name
		do	printf '%s left\n' "$name"
		done < "$OldFile" >> "$Log"
	elif [ -s "$NewFile" ]
	then	# Gather list of blacklisted users who were not seen last time.
		while read -r name
		do	printf '%s joined\n' "$name"
		done < "$NewFile" >> "$Log"
	fi

	# If anything is different on this iteration, report our findings.
	if [ -s "$Log" ]
	then	mailx -s "Nearby blacklisted users" user@company.com < "$Log"
		# Clear the log file and move the current user list to be the
		# previous user list for the next iteration of the loop.
		> "$Log"
		mv "$NewFile" "$OldFile"
	fi
done
2 Likes

Ohaa @Don, this is far more than I expected.I tested it and it worked instantly.

Thank you so much that you also took the time to explain in detail what it is making.

If there is someting I could do in exchange let me know immediately but do not expect any super complex scripting solutions. hahaha