#!/bin/bash
# Afrihost - ip block check script
# Author: Ruan Prinsloo
# Date: 11 April 2016
# Function: Look up blocked IPs on cpHulk, kernel firewall / IPTables and IPSets, and unblock or whitelist them if need be.
# # # # # # # # # # # #

redhatreleasever=$(/usr/local/afribin/configs/centos_version_check.sh)

if [[ $EUID -ne 0 ]]; then
   echo "Run script as root or use sudo" 
   exit 1
fi

#Pretty colours
colred=$(tput setaf 1)    #Red
colgrn=$(tput setaf 2)    #Green
colyel=$(tput setaf 3)    #Yellow
colblu=$(tput setaf 4)    #Blue
colmag=$(tput setaf 5)    #Magenta
colcya=$(tput setaf 6)    #Cyan
colwhi=$(tput setaf 7)    #white
colrst='\e[0m'            #Resets the colour to the terminal's standard colour
IPWHITELISTFILE="/etc/ipwhitelist.ini"

function statistics {

echo -e "`date -u`: [CHECKIP] -s requested." >> /var/log/checkip.log
minusa=$(grep "\-a" /var/log/checkip.log | wc -l)
minusb=$(grep "\-b" /var/log/checkip.log | wc -l)
minusc=$(grep "\-c" /var/log/checkip.log | wc -l)
minusf=$(grep "\-f" /var/log/checkip.log | wc -l)
minusl=$(grep "\-l" /var/log/checkip.log | wc -l)
minusm=$(grep "\-m" /var/log/checkip.log | wc -l)
minusp=$(grep "\-p" /var/log/checkip.log | wc -l)
minusq=$(grep "\-q" /var/log/checkip.log | wc -l)
minuss=$(grep "\-s" /var/log/checkip.log | wc -l)
minusw=$(grep "\-w" /var/log/checkip.log | wc -l)
minusx=$(grep "\-x" /var/log/checkip.log | wc -l)
minusz=$(grep "\-z" /var/log/checkip.log | wc -l)

echo -e "\nAccording to /var/log/checkip.log, the following flags were used this many times on this server\n"

echo -e "-a: $minusa"
echo -e "-b: $minusb"
echo -e "-c: $minusc"
echo -e "-f: $minusf"
echo -e "-l: $minusl"
echo -e "-m: $minusm"
echo -e "-p: $minusp"
echo -e "-q: $minusq"
echo -e "-s: $minuss"
echo -e "-w: $minusw"
echo -e "-x: $minusx"
echo -e "-z: $minusz"
echo

}

function whitelist {

if echo "$argument" | grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/..' ; then 
                /scripts/cphulkdwhitelist $argument 
                echo "$argument" | awk '{print $1}' >> /etc/ipwhitelist.ini.tmp
                cat /etc/ipwhitelist.ini >> /etc/ipwhitelist.ini.tmp
                cat /etc/ipwhitelist.ini.tmp | sort | uniq > /etc/ipwhitelist.ini
                ipset add client-whitelist.static_nets $argument
                if systemctl list-unit-files | grep enabled | grep -q  imunify360-wafd  ; then 
                  imunify360-agent blacklist ip delete $argument                 
                  imunify360-agent whitelist ip add $argument  --comment "checkipblock_added_$(date +"%Y%m%d_%H_%M_%S")" ; 
                fi
                if ! screen -ls | grep fwreload ; then screen -dmS fwreload /usr/local/afri*/maintenance/firewall install ; fi 
        else
                checkip
                /scripts/cphulkdwhitelist $argument 
                echo "$argument" | awk '{print $1}' >> /etc/ipwhitelist.ini.tmp
                cat /etc/ipwhitelist.ini >> /etc/ipwhitelist.ini.tmp
                cat /etc/ipwhitelist.ini.tmp | sort | uniq > /etc/ipwhitelist.ini
                ipset add client-whitelist.static $argument
#                if ! screen -ls | grep fwreload ; then screen -dmS fwreload /usr/local/afri*/maintenance/firewall install ; fi
                if systemctl list-unit-files | grep enabled | grep -q imunify360-wafd  ; then 
                 imunify360-agent whitelist ip add $argument  --comment "checkipblock_added_$(date +"%Y%m%d_%H_%M_%S")" 
                 imunify360-agent blacklist ip delete $argument
                fi
                echo -e "${colgrn}\n$argument has successfully been added to the cpHulk, IPTables and IPSets whitelists.${colrst}"
fi
}

function modsecprohibit {

echo -e "\nThis function has been deprecated. IPSets automatically mines Atomicorp Threat Intelligence Matches now.\n"

#Mine modsec hits in apache error log and prohibit those

#echo -e "Checking /usr/local/apache/logs/error_log for Threat Intelligence Matches ...\n"
#grep "Threat Intelligence Match" /usr/local/apache/logs/error_log* | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | xargs -i ip route add prohibit {}
#echo -e "`date -u`: [CHECKIP] -m requested for firewall. All IP addresses associated with mod_sec Threat Intelligence Matches have been prohibited." >> /var/log/checkip.log

}

function prohibitip {

#checkip
#checkproh=$(netstat -nr | grep $argument)

#read -p "Are you sure you want to prohibit $argument on the firewall? [y/N]: " prohibitc

#if [ $prohibitc = "y" ]; then
#  if ! [ "$checkproh" ]; then
#    datep=$(date)
#    read -p "Enter your name: " namep
#    read -p "Give a valid reason for prohibiting $argument: " reasonp
#    ip route add prohibit $argument
#    echo "$argument has been prohibited."
#    echo -e "`date -u`: [CHECKIP] -p requested. $argument has been prohibited by $namep for reason $reasonp" >> /var/log/messages
#    echo -e "`date -u`: [CHECKIP] -p requested. $argument has been prohibited by $namep for reason \"$reasonp\"" >> /var/log/checkip.log 
#  else
#    echo "$argument is already prohibited on the firewall."
#    echo -e "`date -u`: [CHECKIP] -p requested. Could not complete request. $argument is already prohibited on the firewall." >> /var/log/checkip.log

 # fi
#else
  echo -e "\nThis function has been deprecated. Use checkipblock to see if IPs are prohibited, not to prohibit new ones.\n"
#fi

}

function fluship {

checkip
checkproh=$(ip route ls | grep prohibit | grep $argument)

if [ "$checkproh" ]; then
  ip route flush $argument
  echo "$argument"| awk '{print $1}' >> /etc/ipwhitelist.ini      
  echo -e ${colgrn}"\n$argument successfully unprohibited from the kernel routing table.\n"${colrst}
  echo -e "`date -u`: [CHECKIP] -x requested. $argument has been flushed from the firewall." >> /var/log/checkip.log
else
  echo "$argument is not prohibited in the kernel routing table. Cannot flush $argument."
  echo -e "`date -u`: [CHECKIP] -x requested. $argument is not nulled on the firewall. Cannot flush $argument." >> /var/log/checkip.log
fi
}

function dfromhulkblacklist {

  checkip
  echo
  export perlarg=$argument #make env so perl can see it
  perl -e ' use strict;
  use LWP::UserAgent;
  use LWP::Protocol::https;
  use IO::All;
  use Socket;

  my $hash;
  io("/root/.accesshash") > $hash;
  $hash =~ s/\n//g;
  my $auth = "WHM root:" . $hash;
  $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;
  my $ua = LWP::UserAgent->new;
  my $request =
    HTTP::Request->new( GET => "https://127.0.0.1:2087/json-api/delete_cphulk_record?api.version=1&list_name=black&ip=$ENV'{perlarg}'" );
  $request->header( Authorization => $auth );
  my $response = $ua->request($request);'
  unset perlarg # Let us not leave thins messy
  echo -e ${colgrn}"IP $argument has been removed from the cpHulk blacklist. If this IP is part of a blacklisted range the blacklist removal will not be successful.\n"${colrst}

  echo -e "`date -u`: [CHECKIP] -d requested for $argument." >> /var/log/checkip.log

}

function blacklist {

echo -e "\nThis function has been deprecated. checkipblock should be used to look up blacklisted IPs, not blacklist new IPs."

#Blacklist on cpHulk

#checkip
#check_hulk_b=$(echo "select IP from blacklist where IP = '$argument'" | mysql cphulkd)

#read -p "Are you sure you want to blacklist $argument on cpHulk? [y/N]: " blackc

#if [ $blackc = "y" ]; then
#  if ! [ "$check_hulk_b" ]; then
#    read -p "Enter your name: " nameb
#    read -p "Give a valid reason for blacklisting $argument: " reasonb
#    /scripts/cphulkdblacklist $argument
#    echo -e "`date -u`: [CHECKIP] -b requested. $argument has been blacklisted on cpHulk by $nameb for reason \"$reasonb\"" >> /var/log/checkip.log
#  else
#    echo "$argument is already blacklisted on cpHulk."
#    echo -e "`date -u`: [CHECKIP] -b requested. Could not complete request. $argument is already blacklisted on cpHulk." >> /var/log/checkip.log
#  fi
#else
#  echo "This operation has been cancelled."
#fi

}

function zaips {

# Check if load is too high to run

echo -e "\n"
read -p "This action will whitelist all known South African IP ranges. It can take up to 10 minutes to complete and is resource intensive. It is recommended that you run this inside a screen. Would you like to continue? [y/N]: " zachoice

if [ $zachoice = "y" ]; then
  if [ -f /proc/loadavg ]; then
    read LOAD MORE < /proc/loadavg
    if [ ${LOAD/.*/} -ge 4 ] ; then
      echo "Load too high, not running."
      exit 1
    else  
      . /usr/local/afribin/paulo-scripts/bruteforcecheck
      echo -e "`date -u`: [CHECKIP] -z requested for cpHulk. All know South African IP ranges have been whitelisted in cpHulk." >> /var/log/checkip.log
    fi
  fi
else
  echo "This operation has been cancelled."
fi

}

function checkhulk {

checkip
  echo -e ${colyel}"\n================="${colrst}
  echo -e ${colyel}"Stage 1: cpHulk Lookup"${colrst}
logvar=$(grep -Fo "$argument" /usr/local/cpanel/logs/cphulkd.log)
countvar=$(echo "$logvar" | uniq -c | cut -c7)
echo -e "`date -u`: [CHECKIP] -a requested. Check $argument against cpHulk DB." >> /var/log/checkip.log
echo -e ${colblu}"Checking database cphulkd for matches to $argument"${colrst}

  #Check in table logins
  cph_logins_check=`perl -e '
  use strict;
  use LWP::UserAgent;
  use LWP::Protocol::https;
  use IO::All;
  use Socket;

  my $hash;
  io("/root/.accesshash") > $hash;
  $hash =~ s/\n//g;
  my $auth = "WHM root:" . $hash;
  $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;
  my $ua = LWP::UserAgent->new;
  my $request =
    HTTP::Request->new( GET => "https://127.0.0.1:2087/json-api/get_cphulk_failed_logins?api.version=1" );
  $request->header( Authorization => $auth );
  my $response = $ua->request($request);
  print $response->content; 
' | python -mjson.tool | grep -C 4 $argument`

  cph_logins_info=`perl -e '
  use strict;
  use LWP::UserAgent;
  use LWP::Protocol::https;
  use IO::All;
  use Socket;

  my $hash;
  io("/root/.accesshash") > $hash;
  $hash =~ s/\n//g;
  my $auth = "WHM root:" . $hash;
  $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;
  my $ua = LWP::UserAgent->new;
  my $request =
    HTTP::Request->new( GET => "https://127.0.0.1:2087/json-api/get_cphulk_failed_logins?api.version=1" );
  $request->header( Authorization => $auth );
  my $response = $ua->request($request);
  print $response->content; 
' | python -mjson.tool | grep -C 4 $argument | sort | uniq | grep -Ev "\-$" | grep -v "time" | grep -v "{" | grep -v "}" | grep -v "ip" | tr -s "," " " | tr -s "\"" " " `

  if ! [ "$cph_logins_check" ]; then
    echo -e ${colrst}"Checking Excessive Logins \t\t\t [${colgrn} Not found ${colrst}]"
  else
    echo -e "`date -u`: [CHECKIP] $argument found in cphulk failed logins." >> /var/log/checkip.log
    echo -e ${colrst}"Checking Excessive Logins \t\t\t [${colred} Listed ${colrst}]"
    echo -e ${colblu}"======================="${colrst}
    echo -e ${colblu}"++ INFORMATION SECTION"${colrst}
    echo -e ${colblu}"======================="${colrst}
    echo -e "Metadata for failed login:"
    echo -e "$cph_logins_info"
    echo -e "$argument found $countvar time(s) in cphulkd log files."
    echo -e ${colmag}"======================="${colrst}
    echo -e ${colmag}"++ SUGGESTION SECTION"${colrst}
    echo -e ${colmag}"======================="${colrst}
    echo -e "Run ${colcya}checkipblock -f${colrst} to flush cpHulk and clear one-day blocks for Excessive Logins."
  fi

  blacklisted=`
    perl -e '
      use strict;
      use LWP::UserAgent;
      use LWP::Protocol::https;
      use IO::All;
      use Socket;
      my $hash;
      io("/root/.accesshash") > $hash;
      $hash =~ s/\n//g;
      my $auth = "WHM root:" . $hash;
      $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;
      my $ua = LWP::UserAgent->new;
      my $request =
        HTTP::Request->new( GET => "https://127.0.0.1:2087/json-api/read_cphulk_records?api.version=1&list_name=black&ips_in_list" );
      $request->header( Authorization => $auth );
      my $response = $ua->request($request);
      print $response->content; 
  ' | python -mjson.tool | grep -o "[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" | grep -v requester | cut -d "\"" -f2`
   #Expand ranges, handle single IPs too, search for argument, store result in variable
   cph_blacklist_check=$(for i in $blacklisted
   do
    export checkip_range="$i" #Make env so that perl can see it
    perl -e '
      use Socket;
      my $charcount = $ENV'{checkip_range}' =~ tr/.//;
      if ( $charcount == 3) {
        print "$ENV'{checkip_range}'\n";
      } else {
        @addresses = split(/-/, $ENV'{checkip_range}');
        my $begin = $addresses[0];
        my $end = $addresses[1];
        my $ip = unpack N, inet_aton($begin);
        my $ip_end = unpack N, inet_aton($end);
        while ( $ip <= $ip_end ) {
        print inet_ntoa(pack N,$ip), "\n";
        $ip++;
        }
      }
    ' | grep -F $argument
    unset checkip_range #Let us not leave things messy
  done)
  
  #cph_blacklist_check=$(echo "SELECT IP from blacklist where IP = '$argument';" | mysql cphulkd)
  cph_blacklist_checkout=$(echo "$cph_blacklist_check found in cphulkd table 'blacklist'" | grep -v "IP")

  if ! [ "$cph_blacklist_check" ]; then
    echo -e "Checking cpHulk Blacklist \t\t\t [${colgrn} Not found ${colrst}]"
#    echo -e ${colyel}"=================\n"${colrst}
  else
    echo -e "`date -u`: [CHECKIP] $argument found in table blacklist." >> /var/log/checkip.log
    echo -e ${colrst}"\nChecking cpHulk Blacklist \t\t\t [${colred} Listed ${colrst}]"
#    echo -e ${colblu}"\n======================="${colrst}
    echo -e ${colblu}"++ INFORMATION SECTION"${colrst}
#    echo -e ${colblu}"=======================\n"${colrst}
    echo -e "$cph_blacklist_checkout\n"
#   echo -e ${colmag}"\n======================="${colrst}
    echo -e ${colmag}"++ SUGGESTION SECTION"${colrst}
    echo -e ${colmag}"=======================\n"${colrst}
    echo -e "Run ${colcya}checkipblock -d $argument ${colrst} to remove this IP from the cpHulk blacklist."
#    echo -e ${colyel}"=================\n"${colrst}
  fi

#Check cpHulk Logs
logvar=$(grep -Fo "$argument" /usr/local/cpanel/logs/cphulkd.log)
countvar=$(echo "$logvar" | uniq -c | cut -c7)

#  if ! [ "$logvar" ]; then
#    echo -e "\ncphulkd log files \t\t\t\t [${colgrn} Not found ${colrst}]\n"
#  else
#    echo -e "`date -u`: [CHECKIP] $argument found in /usr/local/cpanel/logs/cphulkd.log" >> /var/log/checkip.log
#    echo -e "\ncphulkd log files \t\t\t\t [${colyel} Found ${colrst}]"
#    echo -e "\n$argument found $countvar time(s) in cphulkd log files."
#  fi

}

function checkfw {

checkip

#echo -e ${colyel}"================="${colrst}
echo -e ${colyel}"\nStage 2: IPTables & Kernel Firewall Lookup"${colrst}
echo -e ${colblu}"Checking the firewall for matches to $argument"${colrst}

  ipchecki=$(netstat -nr | awk '{print $1}' | grep $argument)
  ipcheck=$(netstat -nr| awk '{print $1}' | grep $argument)
  iptype=$(netstat -nr | awk '{print $1}'| grep $argument | awk '{print $4}')
  varlogmessages=$(grep -F $argument /var/log/messages | grep -v ftp)
  varlogbruteblock=$(grep -F $argument /var/log/brute_block.log)

  if ! [ "$ipchecki" ]; then
          echo -e ${colgrn}"IP not null-routed on firewall\n"${colrst}
  #elif [[ "$ipcheck" =~ "255.255.255.255" ]]; then
  #        echo -e ${colred}"Cannot check a netmask. Bad things will happen.\n"${colrst}
  else
          if [[ $iptype =~ "!H" ]] ; then
            echo -e ${colred}"IP null-routed!"${colrst}
            echo -e ${colbld} "$ipcheck" ${colrst}
            echo -e ${colred}"Checking /var/log/messages:"${colrst}
            if ! [ "$varlogmessages" ] ; then
              echo -e "No message."
              echo -e ${colred}"Checking /var/log/brute_block.log:"${colrst}
              if ! [ "$varlogbruteblock" ] ; then
                echo -e "No message."
              else
                echo -e ${colmag}"::: IP Nulled by Server Admin. Unblock IP if client requests it, but refer this IP address along with this server's hostname and the client's domain name to ${colred}paulo@afrihost.com${colrst} :::" 2>/dev/null
              fi
            else
             echo -e ${colyel} "$varlogmessages"${colrst}
            fi
            echo -e "To unblock this IP, run ${colcya}checkipblock -x $argument${colrst}"
          else
            echo -e ${colgrn}"IP not null-routed on firewall"${colrst}
         fi
  fi
#echo -e ${colyel}"=================\n"${colrst}
}


function check_ipset {


#echo -e ${colyel}"================="${colrst}
echo -e ${colyel}"Stage 3: IPSets Lookup"${colrst}

echo -e ${colblu}"Checking IPSets for matches to $argument"${colrst}

ipset_ip_whitelisted=$(for i in $(ipset list | grep Name  | grep -i whitelist  | awk  '{print $2}') ; do 
            echo "$i $(ipset list $i | grep -F $argument )" | grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | awk '{print $2}'
done)

if [ "$ipset_ip_whitelisted" ]; then
  echo -e ${colgrn}":::: NOTE :::: IP $argument is whitelisted so this supercedes any ipset blacklists, so blacklist does not apply, if still blocked it's exim RBL lookup :::"${colrst}
fi

ipset_ip=$(for i in $(ipset list | grep Name  | grep -v -i whitelist  | awk  '{print $2}') ; do 
            echo "$i $(ipset list $i | grep -F $argument )" | grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | awk '{print $2}'
done)
ipset_group=$(for i in $(ipset list | grep Name  | grep -v -i whitelist  | awk  '{print $2}') ; do 
            echo "$i $(ipset list $i | grep $argument )" | grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | awk '{print $1}'
done)
if ! [ "$ipset_ip" ]; then
  echo -e ${colgrn}"IP $argument is not blocked by ipsets."${colrst}
#  echo -e ${colyel}"================="${colrst}
else
  echo -e ${colred}"$(/usr/local/afribin/ips lb $argument| grep -v whitelist)"${colrst}
#  echo -e ${colyel}"=================\n"${colrst}
fi  

case $ipset_group in
  #GLOBAL BLOCKS
  ylmf_helo_threats)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked across all shared servers because it initiated a smtp helo using ylmf which we do not accept."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  clamscan_threats.static)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked across all shared servers because it has been involved in accessing malicious files picked up by clamscan."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  exim_RBL_threats)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked across all shared servers because it's listed on RBLs used by Exim and found to be accessing our servers."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  ipset_crypto_threats.static)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked across all shared servers because it has been identified as a known cryptoPHP home callback IP."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  atomicorp_apache_threats)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked across all shared servers because it is listed as a known mod_sec threat and found to be accessing our servers."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  #LOCAL BLOCKS
  exim_RBL_threats_local)
    echo -e "${colred}LOCAL BLOCK: ${colrst}This IP is blocked on this server because it is listed on RBLs used by Exim and found to be accessing this server."
    echo -e "${colcya}::: NOTE ::: IF $argument IN exim_RBL_threats_local GROUP THE IP IS BLACKLISTED AT zen.spamhaus.org or bl.spamcop.net RBL.\nThis is a global setting and client must contact their dsl provider and ask them to handle this with the RBL maintainers.\nWe will white list in exim for now but the change is not permanent ${colrst}."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    if ! grep -q "$argument" /etc/skipsmtpcheckhosts ; then 
                echo -e "$argument" >> /etc/skipsmtpcheckhosts; /scripts/restartsrv_exim
        else 
                echo -e "IP already in /etc/skipsmtpcheckhosts"
    fi
    ;;
  sysadmin_added)
    echo -e "${colred}LOCAL BLOCK: ${colrst}This IP is blocked on this server because it was manually blacklisted. Please contact Server Admin."
    echo -e "Do not unblock this IP. If you believe it should not be blocked, speak to Server Admin."
    ;;
  ylmf_helo_threats_local)
    echo -e "${colred}LOCAL BLOCK: ${colrst}This IP is blocked on this server because it initiated a smtp helo using ylmf on this local server which we do not accept."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
    ;;
  atomicorp_apache_threats_local)
    echo -e "${colred}GLOBAL: ${colrst}This IP is blocked on this server because it matches an Atomicorp mod_sec threat which has hit this particular server."
    echo -e "Run ${colcya}checkipblock -i $argument ${colrst}to unblock this. A notification will be sent to server admin."
esac

}

function unblock_ipset {

  checkip
  ssh_user=$(grep SSH /var/log/messages | cut -d " " -f 8 | tail -n3)
  for i in $(ipset list | grep Name | grep -v -i whitelist | awk '{print $2}') ; do
    echo "$i $(ipset list $i | grep $argument | awk '{print $1}')" | grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' |
    while read IPSETG pIP ; do echo "$(date) IP rule Removed $IPSETG $pIP. Last three users to log in via SSH on this box are: $ssh_user"  |
      tee | mail -s ":: `hostname` ipset-checkipblock ::" "paulo@afrihost.com"  ; ipset del $IPSETG $pIP ; echo "$pIP" | tee "$IPWHITELISTFILE"
    done
  done

  echo -e ${colgrn}"\n$argument has been successfully removed from the IPSets blocklist on this server. A notification has been sent to server admin, and the authenticity and relevance of the block will be reviewed.${colrst}\n"
  
echo -e "`date -u`: [CHECKIP] -i requested for $argument that is blocked by IPSets." >> /var/log/checkip.log

}

function check_apache {

  checkifdenied=$(grep $argument /usr/local/apache/logs/error_log | grep "denied by server configuration" | egrep -v "proxy:error|proxy_http:error|always_populate_raw_post_data|OCSP responder|collections_remove_stale|proxy_fcgi:error" | egrep -i "$argument|modsec" || grep $argument /usr/local/apache/logs/error_log | egrep -v "proxy_fcgi:error|proxy:error|proxy_http:error|always_populate_raw_post_data|OCSP responder|collections_remove_stale" | egrep -i "modsec")
  #checkuserdenied=$(echo $checkifdenied | cut -d ":" -f4 | cut -d "/" -f3 | sort | uniq)

#  echo -e ${colyel}"================="${colrst}
  echo -e ${colyel}"\nStage 4: Apache Lookup"${colrst}

  echo -e ${colblu}"Checking Apache logs for matches to $argument"${colrst}

  if ! [ "$checkifdenied" ]; then
    echo -e ${colgrn}"$argument does not seem to be denied by any .htaccess configuration or modsecurity rule"${colrst}
  else
    echo -e ${colred}"$argument is being denied either by /home/username/public_html/.htaccess or modsecurity."${colrst}
    echo -e ${colred}"\n$(grep "$argument"  /usr/local/apache/logs/error_log|head -1)"${colrst}
  fi
#  echo -e ${colyel}"=================\n"${colrst}

}

function check_imunify {
  #echo -e ${colyel}"================="${colrst}
  checkifimunified=$(imunify360-agent blacklist ip list --by-ip $argument | grep $argument)
  echo -e ${colyel}"\nStage 5: Imunify Lookup"${colrst}

  echo -e ${colblu}"Checking Imunify360 for matches to $argument"${colrst}

  if ! [ "$checkifimunified" ]; then
    echo -e ${colgrn}"$argument does not appear to be blocked by imunify360 on this server."${colrst}
  else
    echo -e ${colred}"$argument is currently blacklisted by imunify360 on this server.."${colrst}
    echo -e ${cddolred}"To unblock run  # checkipblock -w $argument"${colrst}
  fi
  echo -e ${colyel}"=================\n"${colrst}
}


function flushhulk {

  #Flush cpHulk Brutes and Logins.
  
  echo -e "`date -u`: [CHECKIP] -f requested. Flushing cpHulk excessive incorrect logins and one day blocks." >> /var/log/checkip.log
  echo -e "Flushing all Excessive Logins and  One-Day Blocks...\n"
  iptables -F cphulk && mysql -e "Delete from cphulkd.login_track;"
  echo -e "Done.\n"

}

function checkip {

#Do we have a valid IP address?
octet="(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])"
ip4="^$octet\\.$octet\\.$octet\\.$octet$"
ip4_net="^$octet\\.$octet\\.$octet\\.$octet/..$"
ip_valid="$ipcheck is a valid IPv4 address"
ip_invalid="$ipcheck is not a valid IPv4 address"


  if [[ $ipcheck =~ $ip4 ]] ||  [[ $ipcheck =~ $ip4_net ]]; then
    argument="$ipcheck"
  else
    echo -e ${colred}"$ip_invalid"${colrst}
    echo -e "`date -u`: [CHECKIP] Invalid argument \"$ipcheck\" provided." >> /var/log/checkip.log
    exit 1
  fi

}

#Check arguments
while getopts ":a:b:d:fi:lmp:sw:x:z" opt; do
  case $opt in
    a)
      #Check if IP is nulled on cpHulk database or on the firewall
      ipcheck="$OPTARG"
      checkhulk
      checkfw
      check_ipset
      check_apache
      check_imunify
      ;;
    b)
      #Blacklist on cpHulk
      ipcheck="$OPTARG"
      blacklist
      ;;
    d)
      #Delete IP from cpHulk Blacklist
      ipcheck="$OPTARG"
      dfromhulkblacklist
      ;;
    f)
      #Flush all cpHulk databases
      flushhulk
      ;;
    i)
      #Unblock IPs blocked by IPSets
      ipcheck="$OPTARG"
      unblock_ipset
      ;;
    l)
      #Shows last 100 lines of /var/log/checkip.log
      tail -n 100 /var/log/checkip.log
      ;;
    m)
      #Mine all IPs associated with Threat Intelligence Matches from Apache error log and null them on the firewall
      modsecprohibit
      ;;
    p)
      #Interactively prohibit IP on Firewall
      ipcheck="$OPTARG"
      prohibitip
      ;;
     s)
      #Stats
      statistics 
      ;;
    w)
      #Whitelist interactively on cpHulk, the firewall or both
      ipcheck="$OPTARG"
      whitelist
      ;;
    x)
      #Flush IP from IPTables / kernel firewall
      ipcheck="$OPTARG"
      fluship
      ;;
    z)
      #Whitelist all known South African IPs on cpHulk
      zaips
      ;;
    \?)
      echo "Invalid option: -$OPTARG" >&2
      ;;
     :)
      echo "Option -$OPTARG requires an argument." >&2
      exit 1
      ;;
     *)
      ipcheck="$OPTARG"
      checkhulk
      checkfw
      ;;
  esac
done

if [ $# -eq 0 ]; then
  echo -e "\nUsage: \n"
  echo -e "checkipblock [OPTION] [IP]\n"
  echo -e "-a \t Reports whether an IP is blocked by cpHulk, kernel firewall / IPTables, and IPSets"
  echo -e "-d \t Removes an IP from the cpHulk Blacklist."
  echo -e "-f \t Flushes all cpHulk reports. Does not require a specified IP."
  echo -e "-i \t Removes an IP from the IPSets group it is blocked in."
  echo -e "-l \t Shows the last 100 lines of the checkip logfile."
  echo -e "-w \t Whitelists IP on cpHulk, kernel firewall / IPTables, and IPSets."
  echo -e "-x \t Flushes IP from the firewall."
  echo -e "-z \t Whitelists all known ZA IP addresses on cpHulk. Does not require a specified IP.\n"
fi