25 lines
847 B
Bash
25 lines
847 B
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
IPSFILE="/tmp/lastIPs.txt"
|
||
|
|
|
||
|
|
if [[ $1 == 'count' ]] ; then
|
||
|
|
# pick the last 10 mins of the auth.log (2000 lines should cover that) and count the auth failures for ssh
|
||
|
|
rm -f ${IPSFILE}
|
||
|
|
NOW=$(date +"%s")
|
||
|
|
tail -2000 /var/log/auth.log | grep sshd | grep -e "failure" -e "invalid" | ./last10mins | while read LINE; do
|
||
|
|
# send the ip-address to a temp file
|
||
|
|
echo "$LINE" | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" >>${IPSFILE}
|
||
|
|
done
|
||
|
|
# count the number of lines found
|
||
|
|
cat ${IPSFILE} | wc -l
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [[ $1 == 'block' ]] ; then
|
||
|
|
cat ${IPSFILE} | sort -u | while read LINE; do
|
||
|
|
IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
|
||
|
|
addEvent.sh "BLOCK,${IP},0,0,Unauthorized authorization attempt in SSH"
|
||
|
|
# ufw deny from $LINE
|
||
|
|
done
|
||
|
|
cat ${IPSFILE} | sort -u | wc -l
|
||
|
|
fi
|