forum.lissyara.su

Код: Выделить всё

while (<>) {
	chomp;
	if (/failed .*from (\d+\.\d+\.\d+\.\d+|[\da-fA-F:]+)/i ) { # IPv4 & IPv6
		$ip = $1;
1.		if ($list{$ip}{name}) {
2.			if ($list{$ip}{n} >= $MAX_COUNT) {
3.				syslog(LOG_ERR, "block for $ip not working!");
			} else {
6.				$list{$ip}{n}++;
				print "$ip found $list{$ip}{n} times\n";
7.				if (($list{$ip}{n} >= $MAX_COUNT) &&
				    (time() - $list{$ip}{time} <= $WITHIN_TIME)) {

					# Let's block it :)

					# Time should be measured from the trigging
					# login attempt, and not the 1st occurance
					$list{$ip}{time} = time();

					if($FIREWALL_TYPE =~ /^ipfw$/i) 
					{
						# Assign a rule number and do the actual block
						$list{$ip}{rulenr} = $ipfw_rulenr;
						system("$IPFW_CMD add $ipfw_rulenr deny tcp from $ip to me 21,22 > /dev/null");
						syslog(LOG_ERR, "BLOCKING $ip, rule $ipfw_rulenr\n");
						$ipfw_rulenr++;
						if ($ipfw_rulenr > $IPFW_RULE_END) { $ipfw_rulenr = $IPFW_RULE_START; }

					} elsif ($FIREWALL_TYPE =~ /^ipfw2$/i) {
					  	system("$IPFW2_CMD table $IPFW2_TABLE_NO add $ip");
						syslog(LOG_ERR, "BLOCKING $ip with ipfw2\n");

					} elsif ($FIREWALL_TYPE =~ /^pf$/i) {
					  	system("$PFCTL_CMD -t $PF_TABLE -Tadd $ip");
						syslog(LOG_ERR, "BLOCKING $ip with pf\n");
					}
				}
			}
4.		} else {

			# Add new entry in hash

			$list{$ip}{name} = $ip;		# ip address to watch
5.			$list{$ip}{n} = 1;		# first occurance
			$list{$ip}{time} = time();	# time of first occurance
			##print "keeping an eye on $ip...\n";
		}
	}
}

Код: Выделить всё

while (<>) {
	chomp;
	if (/failed .*from (\d+\.\d+\.\d+\.\d+|[\da-fA-F:]+)/i ) { # IPv4 & IPv6
		$ip = $1;

		# Add new entry in hash

		$list{$ip}{name} = $ip;		# ip address to watch
		$list{$ip}{n} = 1;		# first occurance
		$list{$ip}{time} = time();	# time of first occurance
		##print "keeping an eye on $ip...\n";
		if($FIREWALL_TYPE =~ /^ipfw$/i) 
		{
			# Assign a rule number and do the actual block
			$list{$ip}{rulenr} = $ipfw_rulenr;
			system("$IPFW_CMD add $ipfw_rulenr deny tcp from $ip to me 21,22 > /dev/null");
			syslog(LOG_ERR, "BLOCKING $ip, rule $ipfw_rulenr\n");
			$ipfw_rulenr++;
			if ($ipfw_rulenr > $IPFW_RULE_END) { $ipfw_rulenr = $IPFW_RULE_START; }

		} elsif ($FIREWALL_TYPE =~ /^ipfw2$/i) {
		  	system("$IPFW2_CMD table $IPFW2_TABLE_NO add $ip");
			syslog(LOG_ERR, "BLOCKING $ip with ipfw2\n");

		} elsif ($FIREWALL_TYPE =~ /^pf$/i) {
		  	system("$PFCTL_CMD -t $PF_TABLE -Tadd $ip");
			syslog(LOG_ERR, "BLOCKING $ip with pf\n");
		}

	}
}