一次opencanary自定义实践

canaryLogger = logging.getLogger()

LOG_HOST = "127.0.0.1"
LOG_PORT = 7788


class SyslogHandler(SocketServer.BaseRequestHandler):

    def handle(self):
        addr = self.client_address
        data = self.request[0]
        self.handleLine(data)

    def handleLine(self, line):
        global canaryLogger
        self.logger = canaryLogger
        try:
            if 'canaryfw: ' in line:
                logtype = self.logger.LOG_PORT_SYN
                (rubbish, log) = line.split('canaryfw: ')
            elif "canarynmapNULL" in line:
                logtype = self.logger.LOG_PORT_NMAPNULL
                (rubbish, log) = line.split('canarynmapNULL: ')
            elif "canarynmapXMAS" in line:
                logtype = self.logger.LOG_PORT_NMAPXMAS
                (rubbish, log) = line.split('canarynmapXMAS: ')
            elif "canarynmapFIN" in line:
                logtype = self.logger.LOG_PORT_NMAPFIN
                (rubbish, log) = line.split('canarynmapFIN: ')
            elif 'canarynmap: ' in line:
                logtype = self.logger.LOG_PORT_NMAPOS
                (rubbish, log) = line.split('canarynmap: ')
        except ValueError:
            return
        tags = log.split(' ')
        kv = {}
        for tag in tags:
            if tag.find('=') >= 0:
                (key, val) = tag.split('=')
            else:
                key = tag
                val = ''
            kv[key] = val

        try:
            kv.pop('')
        except:
            pass

        data = {}
        data['src_host'] = kv.pop('SRC')
        data['src_port'] = kv.pop('SPT')
        data['dst_host'] = kv.pop('DST')
        data['dst_port'] = kv.pop('DPT')
        data['logtype'] = logtype
        data['logdata'] = kv

        canaryLogger.log(data)


class LogCollect:

    def start(self, logger):
        global canaryLogger
        canaryLogger = logger
        logging.basicConfig(
            level=logging.DEBUG, format='%(asctime)s %(filename)s[line:%(lineno)d] %(levelname)s %(message)s', datefmt='%a, %d %b %Y %H:%M:%S')
        try:
            logging.debug("slog start at %s : %d ", LOG_HOST, LOG_PORT)
            server = SocketServer.ThreadingUDPServer(
                (LOG_HOST, LOG_PORT), SyslogHandler)
            server.allow_reuse_address = True
            #server.request_queue_size = 60
            server.serve_forever(poll_interval=0.5)
        except Exception as ex:
            logging.debug("error start , exit .....")
        except KeyboardInterrupt:
            print ("Crtl+C Pressed. Shutting down.")

添加自定义模块收集服务器信息，发送到中心服务器

# coding=utf-8
# /usr/lib/python2.7/site-packages/opencanary/modules/host.py

from opencanary.modules import CanaryService
from twisted.internet import reactor

from datetime import datetime
from apscheduler.schedulers.twisted import TwistedScheduler
import psutil
import os
import json


class CanaryHost(CanaryService):
    NAME = "host"

    def __init__(self, config=None, logger=None):
        CanaryService.__init__(self, config, logger)

        self.hostname = config.getVal('device.node_id')
        self.localip = config.getVal('device.listen_addr')
        self.serverip = config.getVal('server.ip')
        self.last_time = datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")
        self.status = "online"
        self.logtype = logger.LOG_HOST

    def hoststatus(self):
        hostjson = json.dumps({
            "lasttime": datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f"),
            "hostname": self.hostname,
            "ip": self.localip,
            "status": self.status,
            "bindIp": self.bindIp()
        })
        try:
            import urllib2
            url = 'http://' + self.serverip + '/host/'
            req = urllib2.Request(
                url, hostjson, {'Content-Type': 'application/json'})
            f = urllib2.urlopen(req)
            response = f.read()
            f.close()
        except urllib2.URLError, e:
            e = {"Hoststatus urllib2 Error:": str(e)}
            self.logger.error(e)

    def bindIp(self):
        netcard_info = []
        info = psutil.net_if_addrs()
        for k, v in info.items():
            for item in v:
                if item[0] == 2 and item[1] != '127.0.0.1':
                    netcard_info.append({
                        "name": str(k),
                        "ip": str(item[1])
                    })

        return json.dumps(netcard_info)

    def startYourEngines(self):
        sched = TwistedScheduler()
        sched.start()
        if not sched.get_job('host_status'):
            sched.add_job(self.hoststatus, 'interval',
                          seconds=10, id='host_status')


CanaryServiceFactory = CanaryHost