Kippo statistics extraction from kippo.log

#!/bin/bash

TOPIP=15
TOPUP=30
TOPU=30
TOPP=30
TOPLU=15
TOPLP=15
GEOLITEDB="/home/<username>/maxmind/GeoIPCountryWhois.db"

#================================

ip2dec () {
    local a b c d ip=$@
    IFS=. read -r a b c d <<< "$ip"
    printf '%d\n' "$(((a * 256 ** 3) + (b * 256 ** 2) + (c * 256) + d))"
}

#================================

# saca el ranking de IPs con mas intentos de fuerza bruta
echo "===================="
echo "= Top $TOPIP source IP ="
echo "===================="
iplist=$(grep "login attempt" kippo.log* kippo.log | cut -f 6,9 -d' ' | cut -f3 -d',' | sed s/\\]\\s\\[/:/g | tr -d ']' | cut -f1 -d: | gawk '{for(i=1;i<=NF;i++)a[$i]++}END{ for(o in a) printf "%s:%s\n ",o,a[o]}' | sort -t: -k2 -nr | tr -d ' ' | head -n $TOPIP)
for ip_and_count in $iplist
do
    country="<UNKNOWN COUNTRY>"
    if [[ -f $GEOLITEDB ]]; then
        ip=$(echo $ip_and_count | cut -d':' -f1)
        ipdec=$(ip2dec $ip)
        query="select cty_name from GeoIPCountryWhois where $ipdec between CAST(initipdec AS INTEGER) and CAST(endipdec AS INTEGER) limit 1;"
        country=$(sqlite3 $GEOLITEDB "$query")
    else
        echo "Can't find GeoIP database $GEOLITEDB"
    fi
    echo "$ip_and_count ($country)"
done

# saca el ranking de redes clase C con mas intentos de fuerza bruta
echo "========================="
echo "= Top $TOPIP source class C ="
echo "========================="
netlist=$(grep "login attempt" kippo.log* kippo.log | cut -f 6,9 -d' ' | cut -f3 -d',' | sed s/\\]\\s\\[/:/g | tr -d ']' | cut -f1 -d: | cut -f1,2,3 -d. | gawk '{for(i=1;i<=NF;i++)a[$i]++}END{ for(o in a) printf "%s:%s\n ",o,a[o]}' | sort -t: -k2 -nr | tr -d ' ' | head -n $TOPIP)
for net_and_count in $netlist
do
    country="<UNKNOWN COUNTRY>"
    if [[ -f $GEOLITEDB ]]; then
        net=$(echo $net_and_count | cut -d':' -f1)
        count=$(echo $net_and_count | cut -d':' -f2)
        ip="$net.1"
        ipdec=$(ip2dec $ip)
        query="select cty_name from GeoIPCountryWhois where $ipdec between CAST(initipdec AS INTEGER) and CAST(endipdec AS INTEGER) limit 1;"
        country=$(sqlite3 $GEOLITEDB "$query")
    else
        echo "Can't find GeoIP database $GEOLITEDB"
    fi
    echo "$net.0/24:$count ($country)"
done


echo "=========================="
echo "= Top $TOPUP user/passwords ="
echo "=========================="

grep  "login attempt" kippo.log* kippo.log  | awk '{print $9}' | tr -d ']' | tr -d '[' | sort | uniq -c | sort -nr  | head -n $TOPUP

echo "==================="
echo "= Top $TOPU users ="
echo "==================="

grep  "login attempt" kippo.log* kippo.log  | awk '{print $9}' | awk '{FS="/"}{print $1}' | tr -d ']' | tr -d '[' | sort | uniq -c | sort -nr  | head -n $TOPU

echo "======================="
echo "= Top $TOPP passwords ="
echo "======================="

grep  "login attempt" kippo.log*  kippo.log | awk '{print $9}' | awk '{FS="/"}{print $2}' | tr -d ']' | tr -d '[' | sort | uniq -c | sort -nr  | head -n $TOPP

echo "======================="
echo "= Last $TOPLU users ="
echo "======================="

# grep  "login attempt" kippo.log*  kippo.log | awk '{print $9}' | awk '{FS="/"}{print $1}' | tr -d ']' | tr -d '[' | tail -n $TOPLU
echo "" > .tmp.txt
for klog in `ls -ltr kippo* | awk '{print $9}'`
do
    grep -h  "login attempt" $klog | tail -n $TOPLU | awk '{print $9" ("$1" "$2")"}' | sed -r 's/\[(.*)\/(.*)\]( \(.*\))/\1\3/g' >> .tmp.txt
done
cat .tmp.txt | tail -n $TOPLU

echo "======================="
echo "= Last $TOPLP passwords ="
echo "======================="

# grep  "login attempt" kippo.log*  kippo.log | awk '{print $9}' | awk '{FS="/"}{print $2}' | tr -d ']' | tr -d '[' | tail -n $TOPLP
echo "" > .tmp.txt
for klog in `ls -ltr kippo* | awk '{print $9}'`
do
    grep  -h "login attempt" $klog | tail -n $TOPLP | awk '{print $9" ("$1" "$2")"}' | sed -r 's/\[(.*)\/(.*)\]( \(.*\))/\2\3/g' >> .tmp.txt
done
cat .tmp.txt | tail -n $TOPLP
rm .tmp.txt

echo "==================="
echo "= Fails / Success ="
echo "==================="
success=$(grep -E "login attempt \[.*/.*\] succeeded" kippo.log* kippo.log | wc -l)
fails=$(grep -E "login attempt \[.*/.*\] failed" kippo.log* kippo.log | wc -l)
echo "Nº Authenticatiuccess: $success"
echo "Nº Authentication Fails: $fails"
#percentage=$((($success / $fails)*100))
#echo "Percentage of success: $percentage"