#!/bin/sh -
#
# analyze auth.log*
#

LANG=C
LC_ALL=C
LOG="/var/log"

yesterday=`date "+%b %_d" --date "1 days ago"`

catmsgs() {
        find ${LOG} -name 'auth.log.*' -mtime -2 |
            sort -t. -r -n -k 3,3 |
            while read f
            do
                case $f in
                    *.gz)       zcat -f $f;;
                    *.bz2)      bzcat -f $f;;
                    *)          cat $f;;
                esac
            done
        [ -f ${LOG}/auth.log ] && cat $LOG/auth.log
}

/bin/echo -e "**** `hostname -f` login failures ****"
catmsgs | egrep -ia "^$yesterday.*(fail|invalid|bad|illegal)" | grep -v "failed to bind to LDAP server"
/bin/echo -e ""

/bin/echo -e "**** refused connections ****"
catmsgs | egrep -i "^$yesterday.*refused connect"
/bin/echo -e ""

/bin/echo -e "**** suspicious connections ****"
catmsgs | egrep -i "^$yesterday.*Did not receive identification string from"
/bin/echo -e ""

exit 0
