forum.lissyara.su

Код: Выделить всё

Sep 30 04:28:29 proxy proftpd[30310]: proxy.dom.local (85.15.207.111[85.15.207.111]) - USER Administrator (Login failed): Incorrect password.
Sep 30 04:28:37 proxy proftpd[30310]: proxy.dom.local (85.15.207.111[85.15.207.111]) - USER Administrator (Login failed): Incorrect password.
Sep 30 04:28:37 proxy proftpd[30310]: proxy.dom.local (85.15.207.111[85.15.207.111]) - USER Administrator (Login failed): Incorrect password.
Sep 30 04:28:37 proxy proftpd[30310]: proxy.dom.local (85.15.207.111[85.15.207.111]) - Maximum login attempts (3) exceeded, connection refused

Код: Выделить всё

#!/bin/sh
cat /var/log/auth.log | grep failed | awk '{print $7}' | sort | uniq -c  | sort
{
while read count_IP
do
count_deny=`echo ${count_IP} | awk '{print $1}'`
IP=`echo ${count_IP} | awk '{print $2}'`
if [ ${count_deny} -ge 10 ]
then
echo "IP address  = ${IP}      deny count =    ${count_deny}"
#/sbin/ipfw add 1 deny ip from ${IP} to me >/dev/null 2>&1
fi
done
}

Код: Выделить всё

zg# echo '85.15.207.111[85.15.207.111]' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | uniq
85.15.207.111
zg# 

Код: Выделить всё

zg# make search name=sshguard-ipfw
Port:   sshguard-ipfw-1.0_1
Path:   /usr/ports/security/sshguard-ipfw
Info:   Protect hosts from brute force attacks against ssh using ipfw
Maint:  mij@bitchx.it
B-deps:
R-deps:
WWW:    http://sshguard.sourceforge.net

zg#