gistfile1.php

<?php

class newThreat {
	function __construct($this->ipAddress = '') {
		// configure parameters
		$this->coordinates_file = 'saved_addresses.php';

		// define constants for security include purposes
		define ('worldmap' , 'yes');

		// include coordinates
		require_once ($coordinates_file);
		$this->coordinates = $coordinates;

		/*if (empty($this->ipAddress)) {
			$this->ipAddress = $_SERVER ["REMOTE_ADDR"];
			if ($this->ipAddress == '127.0.0.1') {
				$this->ipAddress = '81.174.164.83';
			}
		}*/

		$this->bannedIPs = array();
	}

	function getLoc() {
		$ipInfo = geoip_record_by_name($this->ipAddress);
		$entry = "{$ipInfo['latitude']}|{$ipInfo['longitude']}";
		return $entry;
	}

	function writeEntry() {
		if ( !in_array ( $entry , $coordinates ) && ( $entry != "|" ) ) {
			$coordinates [] = $entry;
			unset ( $entry );
			$counter = 0;
			$save_file = fopen ( $coordinates_file , 'w+' );
			flock  ( $save_file , 2 );
			fwrite ( $save_file , "<?php\nif ( !defined ( \"worldmap\" ) ) { exit; }\n\$coordinates = array (\n" );
			foreach ( $coordinates as $value ) {
				fwrite ( $save_file , "\"".$value."\"" );
				$counter++;
				if ( $counter < count ( $coordinates ) ) {
					fwrite ( $save_file , ",\n" );
				}
			}
			fwrite ($save_file, "\n);\n?>\n");
			flock  ($save_file, 3 );
			fclose ($save_file);
			unset ($save_file);
		}
	}

	function checkThreat() {
		$hosts = $this->getHosts();
		foreach ($hosts as $host) {
			$this->getBannedIP($host);
		}
	}

	function getBannedIP($host) {
		$config = file_get_contents("/etc/nagiosql/hosts/$host");
		preg_match("/address\s+(.+?)\s/", $config, $matches);
		$hostname = $matches[1];
		$command = "/usr/lib64/nagios/plugins/check_nrpe -H ".escapeshellarg($hostname)."  -p 5666 -c check_fail2ban";
		$out = array();
		$output = ''; 
		exec($command, $out);
		foreach($out as $line) {
			$output .= "$line\n";
		}   
		preg_match_all('/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/', $output, $matches);

		foreach ($matches[0] as $ip) {
			array_push($this->bannedIPs, $ip);
		}   
	}

	function getHosts() {
		$hosts = scandir("/etc/nagiosql/hosts/");
		$hosts = array_diff($hosts, array('..', '.'));
		return $hosts;
	}

}


$threatCheck = newThreat();

$threatCheck->checkThreat();

var_dump($threatCheck->bannedIPs);





?>