A network port monitor daemon that launches UI I wrote Linux
Page 1 of 1 [ 1 post ]
Here is a network port monitor daemon i wrote. It parses the netstat -antp command for open ports. If port other than 443 or 80 are open it launches a UI that takes in a converted file(the parsed netstat file) and loads it into a scrollable textview widget. The UI has a kill button just in case you are using the pirate bay and do not want a pesky UI popping up evey minute. It runs every 30-60 seconds and checks what ports are open.
here is the daemon
Code:
#!/bin/bash
screen -dmS name watch -n 60 bash /home/amboxer21/Documents/monitor.sh
screen -dmS name watch -n 60 bash /home/amboxer21/Documents/monitor.sh
Here is the parse script
Code:
#!/bin/bash
netstat -antp |
awk 'NF="7" {print $5"\t""\t""\t""\t""\t"$7}' |
awk 'FS=":" {print $2}' |
awk '!x[$0]++' |
awk 'NF' > /home/amboxer21/Documents/netstat.txt;
egrep -v "(443|80)" /home/amboxer21/Documents/netstat.txt > /home/amboxer21/Documents/netstat2.txt;
LINES=$(awk 'END {print NR}' /home/amboxer21/Documents/netstat2.txt);
ONE=1;
if [ $LINES -lt $ONE ]; then
echo "NO SUSPICIOUS PORTS OPEN";
cat /home/amboxer21/Documents/netstat.txt;
exit 0;
else
echo "[OPEN PORTS]";
cat /home/amboxer21/Documents/netstat2.txt;
sudo /home/amboxer21/Documents/warning
fi
netstat -antp |
awk 'NF="7" {print $5"\t""\t""\t""\t""\t"$7}' |
awk 'FS=":" {print $2}' |
awk '!x[$0]++' |
awk 'NF' > /home/amboxer21/Documents/netstat.txt;
egrep -v "(443|80)" /home/amboxer21/Documents/netstat.txt > /home/amboxer21/Documents/netstat2.txt;
LINES=$(awk 'END {print NR}' /home/amboxer21/Documents/netstat2.txt);
ONE=1;
if [ $LINES -lt $ONE ]; then
echo "NO SUSPICIOUS PORTS OPEN";
cat /home/amboxer21/Documents/netstat.txt;
exit 0;
else
echo "[OPEN PORTS]";
cat /home/amboxer21/Documents/netstat2.txt;
sudo /home/amboxer21/Documents/warning
fi
and the UI
Code:
#include <glib/gstdio.h>
#include <gtk/gtk.h>
#include <glib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>
static void activate(GtkStatusIcon* status_icon, gpointer user_data) {
g_debug("'activate' signal triggered");
}
static void destroy_event(GtkWidget *widget, gpointer data) {
gtk_main_quit();
}
static gboolean delete_event(GtkWidget *widget, GdkEvent *event, gpointer data) {
gtk_main_quit();
return FALSE;
}
static void callback( GtkWidget *widget, gpointer data ) {
gtk_main_quit();
}
static void killed( GtkWidget *widget, GdkEvent *event, gpointer data ) {
execl("/usr/bin/killall", "killall", "watch", (char *)NULL);
gtk_main_quit();
}
//To compile append `pkg-config --cflags --libs gtk+-2.0`
int main(int argc, char *argv[]) {
GtkWidget *window;
GtkWidget *table;
GtkWidget *button;
GtkWidget *button2;
GtkWidget *frame;
GtkWidget *view;
GtkWidget *scrolledwindow;
GtkWidget *image;
GtkTooltips *tooltips;
GdkPixbuf *pixbuf;
GtkStatusIcon *status_icon;
GtkTextBuffer *buffer;
GtkTextIter iter;
gchar *array;
gchar *utf8;
GError *err = NULL;
gsize *bytes_read = NULL;
gsize *bytes_written = NULL;
gsize length;
gtk_init(&argc, &argv);
g_file_get_contents("/home/amboxer21/Documents/netstat2.txt", &array, &length, NULL);
window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
gtk_window_set_title(GTK_WINDOW(window), "SECURITY WARNING");
gtk_window_set_position(GTK_WINDOW(window), GTK_WIN_POS_CENTER);
gtk_window_set_default_size(GTK_WINDOW(window), 500, 400);
gtk_widget_show(window);
table = gtk_table_new(10, 10, TRUE);
gtk_container_add(GTK_CONTAINER(window), table);
gtk_widget_show(table);
view = gtk_text_view_new ();
//gtk_table_attach_defaults(GTK_TABLE(table), view, 1, 9, 2, 5);
buffer = gtk_text_view_get_buffer(GTK_TEXT_VIEW(view));
utf8 = g_convert(array, length, "UTF-8", "us-ascii", bytes_read, bytes_written, &err);
if (err != NULL) {
printf("G_CONVERT(!NULL) error --> %s \n", strerror(errno));
g_error_free(err);
}
gtk_text_buffer_get_iter_at_offset(buffer, &iter, 0);
gtk_text_buffer_insert(buffer, &iter, utf8, -1);
//gtk_text_buffer_set_text(buffer, utf8, -1);
gtk_widget_show(view);
scrolledwindow = gtk_scrolled_window_new(NULL, NULL);
gtk_container_add(GTK_CONTAINER(scrolledwindow), view);
gtk_table_attach_defaults(GTK_TABLE(table), scrolledwindow, 1, 9, 2, 5);
gtk_widget_show(scrolledwindow);
frame = gtk_frame_new("PORTS------------------------------PROCESS");
gtk_table_attach_defaults(GTK_TABLE(table), frame, 1, 9, 1, 9);
gtk_frame_set_shadow_type(GTK_FRAME(frame), GTK_SHADOW_IN);
gtk_widget_show(frame);
button = gtk_button_new_with_label("CONFIRM");
gtk_table_attach_defaults(GTK_TABLE(table), button, 2, 5, 6, 8);
gtk_widget_show(button);
tooltips = gtk_tooltips_new();
gtk_tooltips_set_tip(tooltips, button, "Click to confirm that you understand that there are suspicious ports open on your computer.", NULL);
button2 = gtk_button_new_with_label("KILL");
gtk_table_attach_defaults(GTK_TABLE(table), button2, 5, 8, 6, 8);
gtk_widget_show(button2);
tooltips = gtk_tooltips_new();
gtk_tooltips_set_tip(tooltips, button2, "Click to stop this program entirely.", NULL);
pixbuf = gdk_pixbuf_new_from_file("/home/amboxer21/Pictures/warning_icon.png", NULL);
image = gtk_image_new_from_pixbuf(pixbuf);
//gtk_table_attach_defaults(GTK_TABLE(table), image, 1, 3, 1, 3);
gtk_widget_show(image);
status_icon = gtk_status_icon_new_from_pixbuf(pixbuf);
gtk_status_icon_set_tooltip_text(GTK_STATUS_ICON(status_icon), "Suspicious ports are open.");
gtk_status_icon_set_visible(status_icon, TRUE);
//gtk_widget_show(status_icon);
g_debug("embedded: %s", gtk_status_icon_is_embedded(status_icon) ? "yes" : "no");
g_signal_connect_swapped(G_OBJECT(window), "destroy-event",
G_CALLBACK(destroy_event), NULL);
g_signal_connect_swapped(G_OBJECT(window), "delete-event",
G_CALLBACK(delete_event), NULL);
g_signal_connect(button, "clicked",
G_CALLBACK (callback), (gpointer) "button");
g_signal_connect_swapped(button2, "clicked",
G_CALLBACK(killed), (gpointer)"killed");
g_signal_connect_swapped(status_icon, "activate",
G_CALLBACK(activate), (gpointer)"activate");
gtk_main_iteration();
gtk_main();
return 0;
}
#include <gtk/gtk.h>
#include <glib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>
static void activate(GtkStatusIcon* status_icon, gpointer user_data) {
g_debug("'activate' signal triggered");
}
static void destroy_event(GtkWidget *widget, gpointer data) {
gtk_main_quit();
}
static gboolean delete_event(GtkWidget *widget, GdkEvent *event, gpointer data) {
gtk_main_quit();
return FALSE;
}
static void callback( GtkWidget *widget, gpointer data ) {
gtk_main_quit();
}
static void killed( GtkWidget *widget, GdkEvent *event, gpointer data ) {
execl("/usr/bin/killall", "killall", "watch", (char *)NULL);
gtk_main_quit();
}
//To compile append `pkg-config --cflags --libs gtk+-2.0`
int main(int argc, char *argv[]) {
GtkWidget *window;
GtkWidget *table;
GtkWidget *button;
GtkWidget *button2;
GtkWidget *frame;
GtkWidget *view;
GtkWidget *scrolledwindow;
GtkWidget *image;
GtkTooltips *tooltips;
GdkPixbuf *pixbuf;
GtkStatusIcon *status_icon;
GtkTextBuffer *buffer;
GtkTextIter iter;
gchar *array;
gchar *utf8;
GError *err = NULL;
gsize *bytes_read = NULL;
gsize *bytes_written = NULL;
gsize length;
gtk_init(&argc, &argv);
g_file_get_contents("/home/amboxer21/Documents/netstat2.txt", &array, &length, NULL);
window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
gtk_window_set_title(GTK_WINDOW(window), "SECURITY WARNING");
gtk_window_set_position(GTK_WINDOW(window), GTK_WIN_POS_CENTER);
gtk_window_set_default_size(GTK_WINDOW(window), 500, 400);
gtk_widget_show(window);
table = gtk_table_new(10, 10, TRUE);
gtk_container_add(GTK_CONTAINER(window), table);
gtk_widget_show(table);
view = gtk_text_view_new ();
//gtk_table_attach_defaults(GTK_TABLE(table), view, 1, 9, 2, 5);
buffer = gtk_text_view_get_buffer(GTK_TEXT_VIEW(view));
utf8 = g_convert(array, length, "UTF-8", "us-ascii", bytes_read, bytes_written, &err);
if (err != NULL) {
printf("G_CONVERT(!NULL) error --> %s \n", strerror(errno));
g_error_free(err);
}
gtk_text_buffer_get_iter_at_offset(buffer, &iter, 0);
gtk_text_buffer_insert(buffer, &iter, utf8, -1);
//gtk_text_buffer_set_text(buffer, utf8, -1);
gtk_widget_show(view);
scrolledwindow = gtk_scrolled_window_new(NULL, NULL);
gtk_container_add(GTK_CONTAINER(scrolledwindow), view);
gtk_table_attach_defaults(GTK_TABLE(table), scrolledwindow, 1, 9, 2, 5);
gtk_widget_show(scrolledwindow);
frame = gtk_frame_new("PORTS------------------------------PROCESS");
gtk_table_attach_defaults(GTK_TABLE(table), frame, 1, 9, 1, 9);
gtk_frame_set_shadow_type(GTK_FRAME(frame), GTK_SHADOW_IN);
gtk_widget_show(frame);
button = gtk_button_new_with_label("CONFIRM");
gtk_table_attach_defaults(GTK_TABLE(table), button, 2, 5, 6, 8);
gtk_widget_show(button);
tooltips = gtk_tooltips_new();
gtk_tooltips_set_tip(tooltips, button, "Click to confirm that you understand that there are suspicious ports open on your computer.", NULL);
button2 = gtk_button_new_with_label("KILL");
gtk_table_attach_defaults(GTK_TABLE(table), button2, 5, 8, 6, 8);
gtk_widget_show(button2);
tooltips = gtk_tooltips_new();
gtk_tooltips_set_tip(tooltips, button2, "Click to stop this program entirely.", NULL);
pixbuf = gdk_pixbuf_new_from_file("/home/amboxer21/Pictures/warning_icon.png", NULL);
image = gtk_image_new_from_pixbuf(pixbuf);
//gtk_table_attach_defaults(GTK_TABLE(table), image, 1, 3, 1, 3);
gtk_widget_show(image);
status_icon = gtk_status_icon_new_from_pixbuf(pixbuf);
gtk_status_icon_set_tooltip_text(GTK_STATUS_ICON(status_icon), "Suspicious ports are open.");
gtk_status_icon_set_visible(status_icon, TRUE);
//gtk_widget_show(status_icon);
g_debug("embedded: %s", gtk_status_icon_is_embedded(status_icon) ? "yes" : "no");
g_signal_connect_swapped(G_OBJECT(window), "destroy-event",
G_CALLBACK(destroy_event), NULL);
g_signal_connect_swapped(G_OBJECT(window), "delete-event",
G_CALLBACK(delete_event), NULL);
g_signal_connect(button, "clicked",
G_CALLBACK (callback), (gpointer) "button");
g_signal_connect_swapped(button2, "clicked",
G_CALLBACK(killed), (gpointer)"killed");
g_signal_connect_swapped(status_icon, "activate",
G_CALLBACK(activate), (gpointer)"activate");
gtk_main_iteration();
gtk_main();
return 0;
}
in order for the system icon to work you need to enable the all keyword in the whitelist. Just edit with dconf tools
What do y'all think?? It could def be built better! Maybe someone who wants a project could fix it up? I am done with it for now.
Here's a screen shot of the UI in the middle of the mess i call development lol
[img][800:452]http://i1236.photobucket.com/albums/ff455/amboxer21/warning_screenshot02.png[/img]
Sorry that the parsed output in the textview widget looks sloppy. I actually manually piped the output into the file just for this example/screen shot. Its not meant to look that sloppy.
