+SET FOREIGN_KEY_CHECKS=0;
+SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
+SET time_zone = "+00:00";
+
+/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
+/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
+/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
+/*!40101 SET NAMES utf8 */;
+
+
+DROP TABLE IF EXISTS `ctracker_config`;
+CREATE TABLE IF NOT EXISTS `ctracker_config` (
+ `ctracker_config` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+ `ctracker_db_version` bigint(20) unsigned NOT NULL DEFAULT '0',
+ `ctracker_min_sleep` smallint(5) unsigned NOT NULL DEFAULT '10',
+ `ctracker_max_sleep` smallint(5) unsigned NOT NULL DEFAULT '30',
+ `ctracker_alert_user` enum('Y','N') NOT NULL DEFAULT 'Y',
+ `ctracker_language` char(2) NOT NULL DEFAULT 'en',
+ PRIMARY KEY (`ctracker_config`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+INSERT INTO `ctracker_config` (`ctracker_config`, `ctracker_db_version`, `ctracker_min_sleep`, `ctracker_max_sleep`, `ctracker_alert_user`, `ctracker_language`) VALUES
+(1, 9, 10, 30, 'Y', 'en');
+
DROP TABLE IF EXISTS `ctracker_data`;
CREATE TABLE IF NOT EXISTS `ctracker_data` (
- `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT COMMENT 'Running id number',
- `remote_addr` varchar(15) NOT NULL COMMENT 'Remote address',
- `user_agent` tinytext NOT NULL COMMENT 'User agent string',
- `post_data` tinytext NOT NULL COMMENT 'Serialized POST data',
- `check_worm` tinytext NOT NULL COMMENT 'Serialized GET data',
- `check_post` tinytext NOT NULL COMMENT 'Serialized GET data',
- `server_name` tinytext NOT NULL COMMENT 'Server''s host name',
- `script_name` varchar(255) NOT NULL COMMENT 'Full script name',
- `referer` varchar(255) NOT NULL COMMENT 'Referer',
- `first_attempt` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00' COMMENT 'First attempt',
- `last_attempt` timestamp NOT NULL COMMENT 'Last attempt',
- `count` bigint(20) unsigned NOT NULL DEFAULT '0' COMMENT 'Counter',
- PRIMARY KEY (`id`),
- KEY `remote_addr` (`remote_addr`)
-) TYPE=InnoDB COMMENT='Gathered data of attack';
+ `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT COMMENT 'Running id number',
+ `remote_addr` varchar(15) NOT NULL COMMENT 'Remote address',
+ `proxy_addr` varchar(15) DEFAULT NULL COMMENT 'Detected IP behind proxy',
+ `user_agent` tinytext NOT NULL COMMENT 'User agent string',
+ `get_data` tinytext NOT NULL COMMENT 'Serialized GET data',
+ `post_data` tinytext NOT NULL COMMENT 'Serialized POST data',
+ `check_ua` tinytext NOT NULL COMMENT 'User-agent string after check',
+ `check_get` tinytext NOT NULL COMMENT 'GET data after check',
+ `check_post` tinytext NOT NULL COMMENT 'POST data after check',
+ `server_name` tinytext COMMENT 'Server''s host name',
+ `script_name` varchar(255) DEFAULT NULL COMMENT 'Full script name',
+ `referer` varchar(255) NOT NULL COMMENT 'Referer',
+ `request_method` varchar(255) DEFAULT NULL COMMENT 'HTTP request method',
+ `proxy_used` enum('Y','N') NOT NULL DEFAULT 'N' COMMENT 'Proxy used?',
+ `first_attempt` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00' COMMENT 'First attempt',
+ `last_attempt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT 'Last attempt',
+ `count` bigint(20) unsigned NOT NULL DEFAULT '1' COMMENT 'Counter',
+ PRIMARY KEY (`id`),
+ KEY `remote_addr` (`remote_addr`),
+ KEY `remote_proxy_last` (`remote_addr`,`proxy_addr`),
+ KEY `request_method` (`request_method`),
+ KEY `count` (`count`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 ROW_FORMAT=COMPACT COMMENT='Gathered data of attack';
+
+DROP TABLE IF EXISTS `ctracker_ticket`;
+CREATE TABLE IF NOT EXISTS `ctracker_ticket` (
+ `ctracker_ticket` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+ `ctracker_ticket_remote_addr` varchar(15) NOT NULL,
+ `ctracker_ticket_user_agent` tinytext NOT NULL,
+ `ctracker_ticket_name` varchar(255) NOT NULL,
+ `ctracker_ticket_email` varchar(255) NOT NULL,
+ `ctracker_ticket_comment` tinytext NOT NULL,
+ `ctracker_ticket_proxy_addr` varchar(15) DEFAULT NULL,
+ PRIMARY KEY (`ctracker_ticket`),
+ UNIQUE KEY `ctracker_ticket_remote_addr` (`ctracker_ticket_remote_addr`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+DROP TABLE IF EXISTS `ctracker_ticket_data`;
+CREATE TABLE IF NOT EXISTS `ctracker_ticket_data` (
+ `ctracker_ticket_data_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+ `ctracker_ticket_id` bigint(20) unsigned NOT NULL DEFAULT '0',
+ `ctracker_data_id` bigint(20) unsigned NOT NULL DEFAULT '0',
+ PRIMARY KEY (`ctracker_ticket_data_id`),
+ UNIQUE KEY `ctracker_ticket_data` (`ctracker_ticket_id`,`ctracker_data_id`),
+ KEY `ctracker_data_id` (`ctracker_data_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+DROP VIEW IF EXISTS `view_attack_distribution`;
+CREATE TABLE IF NOT EXISTS `view_attack_distribution` (
+`Rows` bigint(21)
+,`remote_addr` varchar(15)
+);DROP VIEW IF EXISTS `view_most_attacked_domains`;
+CREATE TABLE IF NOT EXISTS `view_most_attacked_domains` (
+`Rows` bigint(21)
+,`server_name` tinytext
+);DROP VIEW IF EXISTS `view_most_attacked_scripts`;
+CREATE TABLE IF NOT EXISTS `view_most_attacked_scripts` (
+`Rows` bigint(21)
+,`script_name` varchar(255)
+);DROP VIEW IF EXISTS `view_most_attacking_agents`;
+CREATE TABLE IF NOT EXISTS `view_most_attacking_agents` (
+`Rows` bigint(21)
+,`user_agent` tinytext
+);DROP VIEW IF EXISTS `view_proxy_addresses`;
+CREATE TABLE IF NOT EXISTS `view_proxy_addresses` (
+`remote_addr` varchar(15)
+,`proxy_addr` varchar(15)
+);DROP VIEW IF EXISTS `view_proxy_attackers`;
+CREATE TABLE IF NOT EXISTS `view_proxy_attackers` (
+`Rows` bigint(21)
+,`has_used_proxy` enum('Y','N')
+);DROP VIEW IF EXISTS `view_proxy_ip_usage`;
+CREATE TABLE IF NOT EXISTS `view_proxy_ip_usage` (
+`total_proxy_ips` decimal(42,0)
+,`distinct_proxy_ips` bigint(21)
+);DROP VIEW IF EXISTS `view_spreaded_attacks`;
+CREATE TABLE IF NOT EXISTS `view_spreaded_attacks` (
+`time_diff` bigint(11)
+,`id` bigint(20) unsigned
+,`remote_addr` varchar(15)
+,`user_agent` tinytext
+,`server_name` tinytext
+,`get_data` tinytext
+,`check_get` tinytext
+,`proxy_used` enum('Y','N')
+,`first_attempt` timestamp
+,`last_attempt` timestamp
+,`count` bigint(20) unsigned
+);DROP VIEW IF EXISTS `view_total_attacks`;
+CREATE TABLE IF NOT EXISTS `view_total_attacks` (
+`total_attacks` decimal(42,0)
+,`distinct_attacks` bigint(21)
+,`max_attack_repeat` bigint(20) unsigned
+);DROP TABLE IF EXISTS `view_attack_distribution`;
+
+CREATE VIEW `view_attack_distribution` AS select count(0) AS `Rows`,`ctracker_data`.`remote_addr` AS `remote_addr` from `ctracker_data` group by `ctracker_data`.`remote_addr` order by count(0) desc;
+DROP TABLE IF EXISTS `view_most_attacked_domains`;
+
+CREATE VIEW `view_most_attacked_domains` AS select count(0) AS `Rows`,`ctracker_data`.`server_name` AS `server_name` from `ctracker_data` group by `ctracker_data`.`server_name` order by count(0) desc;
+DROP TABLE IF EXISTS `view_most_attacked_scripts`;
+
+CREATE VIEW `view_most_attacked_scripts` AS select count(0) AS `Rows`,`ctracker_data`.`script_name` AS `script_name` from `ctracker_data` group by `ctracker_data`.`script_name` order by count(0) desc;
+DROP TABLE IF EXISTS `view_most_attacking_agents`;
+
+CREATE VIEW `view_most_attacking_agents` AS select count(0) AS `Rows`,`ctracker_data`.`user_agent` AS `user_agent` from `ctracker_data` group by `ctracker_data`.`user_agent` order by count(0) desc;
+DROP TABLE IF EXISTS `view_proxy_addresses`;
+
+CREATE VIEW `view_proxy_addresses` AS select distinct `ctracker_data`.`remote_addr` AS `remote_addr`,`ctracker_data`.`proxy_addr` AS `proxy_addr` from `ctracker_data` where (`ctracker_data`.`remote_addr` <> `ctracker_data`.`proxy_addr`) order by `ctracker_data`.`remote_addr` limit 1;
+DROP TABLE IF EXISTS `view_proxy_attackers`;
+
+CREATE VIEW `view_proxy_attackers` AS select count(0) AS `Rows`,`ctracker_data`.`proxy_used` AS `has_used_proxy` from `ctracker_data` group by `ctracker_data`.`proxy_used` order by `ctracker_data`.`proxy_used`;
+DROP TABLE IF EXISTS `view_proxy_ip_usage`;
+
+CREATE VIEW `view_proxy_ip_usage` AS select sum(`ctracker_data`.`count`) AS `total_proxy_ips`,count(`ctracker_data`.`id`) AS `distinct_proxy_ips` from `ctracker_data` where (`ctracker_data`.`remote_addr` <> `ctracker_data`.`proxy_addr`);
+DROP TABLE IF EXISTS `view_spreaded_attacks`;
+
+CREATE VIEW `view_spreaded_attacks` AS select (unix_timestamp(`ctracker_data`.`last_attempt`) - unix_timestamp(`ctracker_data`.`first_attempt`)) AS `time_diff`,`ctracker_data`.`id` AS `id`,`ctracker_data`.`remote_addr` AS `remote_addr`,`ctracker_data`.`user_agent` AS `user_agent`,`ctracker_data`.`server_name` AS `server_name`,`ctracker_data`.`get_data` AS `get_data`,`ctracker_data`.`check_get` AS `check_get`,`ctracker_data`.`proxy_used` AS `proxy_used`,`ctracker_data`.`first_attempt` AS `first_attempt`,`ctracker_data`.`last_attempt` AS `last_attempt`,`ctracker_data`.`count` AS `count` from `ctracker_data` group by `ctracker_data`.`remote_addr` order by (unix_timestamp(`ctracker_data`.`last_attempt`) - unix_timestamp(`ctracker_data`.`first_attempt`)) desc;
+DROP TABLE IF EXISTS `view_total_attacks`;
+
+CREATE VIEW `view_total_attacks` AS select sum(`ctracker_data`.`count`) AS `total_attacks`,count(`ctracker_data`.`id`) AS `distinct_attacks`,max(`ctracker_data`.`count`) AS `max_attack_repeat` from `ctracker_data` limit 1;
+
+CREATE VIEW `view_most_request_methods` AS SELECT SQL_CALC_FOUND_ROWS COUNT(`request_method`) AS `total_rows`, `request_method` FROM `ctracker_data` GROUP BY `request_method`;
+
+ALTER TABLE `ctracker_ticket_data`
+ ADD CONSTRAINT `ctracker_ticket_data_ibfk_1` FOREIGN KEY (`ctracker_ticket_id`) REFERENCES `ctracker_ticket` (`ctracker_ticket`) ON DELETE CASCADE,
+ ADD CONSTRAINT `ctracker_ticket_data_ibfk_2` FOREIGN KEY (`ctracker_data_id`) REFERENCES `ctracker_data` (`id`) ON DELETE CASCADE;
+SET FOREIGN_KEY_CHECKS=1;
+
+/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
+/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
+/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
projects / ctracker.git / blobdiff