first

getWalled

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# picks up iptables/ufw message from the kernel log
+# you need to enable the following line in /etc/rsyslog.conf
+#   module(load="imklog" permitnonkernelfacility="on")
+# and enable ufw logging:
+#   ufw logging on
+
+# pick the last 10 mins of the kern.log (2000 lines should cover that) and count the auth failures for ssh
+if [[ ${1} == '+22' ]]; then
+    tail -2000 /var/log/kern.log | grep '\[UFW BL' | grep 'DPT=22 ' |./last10mins | wc -l
+elif [[ ${1} == '-22' ]]; then
+    tail -2000 /var/log/kern.log | grep '\[UFW BL' | grep -v 'DPT=22 ' |./last10mins | wc -l
+else
+    # tail -2000 /var/log/kern.log | grep '\[UFW BL' | ./last10mins | wc -l
+    tail -2000 /var/log/kern.log | grep '\[UFW BL' | ./last10mins | sed "s/^.*SRC=\([0-9.]*\) .*$/\1/" >/tmp/scanning.tmp
+    cat /tmp/scanning.tmp | while read IP; do
+        addEvent.sh "BLOCK,${IP},5,5,Portscanning attempt"
+    done
+    cat /tmp/scanning.tmp | wc -l
+fi