Membangun Sistem Log Monitoring & Security Terintegrasi ke Telegram

import os, time, requests, glob, re
from datetime import datetime

TELEGRAM_TOKEN = "8987973292:AAEWeJ0UHcEqKhqiwQcfDSB5hxiqy6nBaXM"
TELEGRAM_CHAT_ID = "1032303044"
NPM_LOG_DIR, SSH_LOG_PATH, DOMAIN_FILE_PATH = "/var/log/nginx", "/var/log/auth_os.log", "/app/domains.txt"
REKAP_INTERVAL = 600

CLIENT_IP_REGEX = re.compile(r'\[Client\s+([^\]]+)\]')
SSH_ACCEPTED_REGEX = re.compile(r'Accepted\s+(password|publickey)\s+for\s+(\S+)\s+from\s+(\S+)')
SSH_FAILED_REGEX = re.compile(r'Failed\s+password\s+for\s+(invalid\s+user\s+)?(\S+)\s+from\s+(\S+)')

web_data, ssh_data, TARGET_DOMAINS = {}, {'success_total': 0, 'failed_total': 0, 'ips': {}}, []

def load_target_domains():
    if os.path.exists(DOMAIN_FILE_PATH):
        with open(DOMAIN_FILE_PATH, "r") as f:
            global TARGET_DOMAINS
            TARGET_DOMAINS = [line.strip() for line in f if line.strip()]

def send_tg(msg):
    requests.post(f"https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage", json={"chat_id": TELEGRAM_CHAT_ID, "text": msg, "parse_mode": "Markdown"})

def generate_and_send_report():
    global web_data, ssh_data
    wib_now = datetime.now().strftime("%d-%m-%Y %H:%M:%S WIB")
    web_report = f"🌐 *[REKAP TRAFIK WEB - 10 MENIT]*\n⏰ Waktu: `{wib_now}`\n\n"
    has_web = False
    for domain, ips in web_data.items():
        if not ips: continue
        has_web = True
        web_report += f"📌 *Domain:* `{domain}`\n📊 Total Hit: `{sum(ips.values())}x` | 👤 Unique IP: `{len(ips)}`\n🔝 *Top Visitors:*\n"
        for ip, count in sorted(ips.items(), key=lambda x: x[1], reverse=True)[:3]:
            web_report += f"  ├ `{ip}` ➔ `{count}x hit`\n"
        web_report += "\n"
    if not has_web: web_report += "💤 Tidak ada aktivitas web.\n\n"

    ssh_report = f"🔒 *[REKAP KEAMANAN SSH - 10 MENIT]*\n📊 Sukses: `{ssh_data['success_total']}x` | Gagal: `{ssh_data['failed_total']}x`\n"
    if ssh_data['ips']:
        ssh_report += "⚠️ *Top Attackers:*\n"
        for ip, counts in sorted(ssh_data['ips'].items(), key=lambda x: x[1].get('failed', 0), reverse=True)[:3]:
            ssh_report += f"  ├ `{ip}` ➔ Gagal: `{counts.get('failed', 0)}x` | Sukses: `{counts.get('success', 0)}x`\n"
    else: ssh_report += "✅ Tidak ada aktivitas login SSH.\n"

    send_tg(f"{web_report}-----------------------------------------\n{ssh_report}")
    web_data.clear()
    ssh_data.clear(); ssh_data.update({'success_total': 0, 'failed_total': 0, 'ips': {}})

def main_monitor():
    load_target_domains()
    opened_web = {p: open(p, "r", errors="ignore") for p in glob.glob(f"{NPM_LOG_DIR}/proxy-host-*_access.log")}
    for f in opened_web.values(): f.seek(0, os.SEEK_END)
    opened_ssh = open(SSH_LOG_PATH, "r", errors="ignore") if os.path.exists(SSH_LOG_PATH) else None
    if opened_ssh: opened_ssh.seek(0, os.SEEK_END)
    
    last_rekap = time.time()
    while True:
        load_target_domains()
        for path, f in opened_web.items():
            while True:
                line = f.readline()
                if not line: break
                if any(kw in line.lower() for kw in [".css", ".js", ".png", ".jpg", ".jpeg", ".ico", ".svg", "/api/", "/_stcore/"]): continue
                for domain in TARGET_DOMAINS:
                    if domain in line:
                        ip = CLIENT_IP_REGEX.search(line).group(1) if CLIENT_IP_REGEX.search(line) else "Unknown"
                        if ip == "127.0.0.1" or (ip.startswith("172.") and 17 <= int(ip.split(".")[1]) <= 100): continue
                        if domain not in web_data: web_data[domain] = {}
                        web_data[domain][ip] = web_data[domain].get(ip, 0) + 1
        if opened_ssh:
            while True:
                line = opened_ssh.readline()
                if not line: break
                m_acc, m_fail = SSH_ACCEPTED_REGEX.search(line), SSH_FAILED_REGEX.search(line)
                if m_acc:
                    ip = m_acc.group(3)
                    ssh_data['success_total'] += 1
                    if ip not in ssh_data['ips']: ssh_data['ips'][ip] = {'success': 0, 'failed': 0}
                    ssh_data['ips'][ip]['success'] += 1
                elif m_fail:
                    ip = m_fail.group(3)
                    ssh_data['failed_total'] += 1
                    if ip not in ssh_data['ips']: ssh_data['ips'][ip] = {'success': 0, 'failed': 0}
                    ssh_data['ips'][ip]['failed'] += 1

        if time.time() - last_rekap >= REKAP_INTERVAL:
            generate_and_send_report()
            last_rekap = time.time()
        time.sleep(1)

if __name__ == "__main__": main_monitor()

version: '3.8'

services:
  rekap-monitor:
    image: python:3.11-alpine
    container_name: petroflexx-rekap-monitor
    restart: unless-stopped
    volumes:
      - /opt/data/docker/docker-hit-monitor/apprekap.py:/app/apprekap.py:ro
      - /opt/data/docker/docker-hit-monitor/domains.txt:/app/domains.txt:ro
      - /opt/data/docker/npm/data/logs:/var/log/nginx:ro
      - /var/log/secure:/var/log/auth_os.log:ro
    environment:
      - TZ=Asia/Jakarta
      - PYTHONUNBUFFERED=1
    working_dir: /app
    entrypoint: >
      sh -c "pip install --no-cache-dir requests && python apprekap.py"