notify_edu.py

#!/usr/bin/python

import sys
import pygeoip
import dns.resolver
from IPy import IP
import pytz
import smtplib
import datetime

def main():
    if len(sys.argv) != 3:
        usage()
        sys.exit(-1)

    notify(sys.argv[1], sys.argv[2])

def notify(ip_string, comment):
    ip = IP(ip_string)
    name = ip.reverseName().replace("in-addr.arpa.", "abuse-contacts.abusix.org")
    answer = str(dns.resolver.query(name, 'TXT').response.answer[0])
    abuse_contact = answer.split(" ")[-1].replace('"', '')

    if (not abuse_contact or len(abuse_contact.split('.')) < 2 or abuse_contact.split('.')[-1] != "edu"):
        print "Abuse contact '%s' not a notifiable contact." % abuse_contact
        return

    now = pytz.timezone("US/Eastern").localize(datetime.datetime.now())

    sender = 'security@miskatonic.edu'
    receivers = [abuse_contact, "security@miskatonic.edu"]
    message = """From: Information Security Office <security@miskatonic.edu>
To: <%s>
cc: <security@miskatonic.edu>
Subject: Potentially Compromised Host Temporarily Blocked

Hello,

The Information Security Office at Miskatonic University has detected a potentially compromised host in your network IP space. As a precaution, this host has been temporarily blocked from being able to reach any University resources. This block will automatically be lifted after 8 hours, but the host may be re-blocked in the event that the observed activity continues. Please investigate whether or not this host is indeed compromised. If you feel this detection was incorrect, please let us know.

Details:
  IP: %s
  Comment: %s
  Timestamp: %s

Thank you,

Miskatonic University
Information Security Office
security@miskatonic.edu


-------
The recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here:

http://abusix.com/global-reporting/abuse-contact-db

abusix.com is neither responsible nor liable for the content or accuracy of this message.
""" % (abuse_contact.replace('"', ''), ip_string, comment, now.strftime("%a %b %d %H:%M:%S %Y %z"))

    try:
        smtpObj = smtplib.SMTP('localhost')
        smtpObj.sendmail(sender, receivers, message)
        print "Abuse contact notified."
    except SMTPException:
        print "Unable to send e-mail."

def usage():
    print """Usage: %s ip comment

Args:
  ip - Currently only IPv4 in dotted-quad
  comment - In quotes, if it has spaces.
""" % sys.argv[0]

if __name__ == "__main__":
    main()