first

getGitFails

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# pick the last 10 mins of the git.log (2000 lines should cover that) and count the auth failures 
+# format logfile:
+#   2020/12/29 15:41:45 ...xorm/session_find.go:199.........
+
+ERRORFILE='/tmp/gitea_error.log'
+
+tail -2000 /var/lib/gitea/log/gitea.log | grep 'Failed authentication' | ./last10mins gitea >${ERRORFILE}
+cat ${ERRORFILE} | while read -r LINE; do
+    IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
+    addEvent.sh "BLOCK,${IP},3,5,Unauthorized authorization attempt in Gitea"
+done
+
+cat ${ERRORFILE} | wc -l