From: Panagiotis Atmatzidis Date: 2012-12-10T16:54:20+09:00 Subject: Re: Getting info from array --Apple-Mail=_2808F1A8-7872-473B-B59C-E77F1BD9D620 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hello, On 9 =CE=94=CE=B5=CE=BA 2012, at 12:50 , Krzysztof Kowalski = wrote: > I know that there is fail2ban but i would like to achieve it by my = self :) >=20 > 2012/12/9 tamouse mailing lists > On Sat, Dec 8, 2012 at 7:35 PM, Krzysztof Kowalski = wrote: > > Hello there. > > I would like to make script that gets failed logging attempt ip, = when it > > count that ip tried logging more than 5 times in row script will = write new > > block rule with that ip to ipfilter in freebsd 8. > > So I like to manage this by getting each line of file with logging = attempts > > to arrays ( it makes array in array). I have a little problem with = obtaining > > array with word "Failed" and passing it to new array with ip's that = i would > > like to block. Next I get every 13th element (which is ipv6 address) = and > > write new rule after counting it with hash. > > Can someone show me how to make it happend? > > > > CODE: > > #!/usr/local/bin/ruby19 > > filename =3D '/var/log/auth.log' > > falo =3D String.new > > File.open(filename) { |f| falo =3D f.read } > > words =3D falo.split('\n') > > > > $ ruby19 -v > > ruby 1.9.3p327 (2012-11-10 revision 37606) [amd64-freebsd8] > > $ uname -a > > FreeBSD mc.pl.eu.org 8.3-STABLE FreeBSD 8.3-STABLE #0 r130: Mon Apr = 23 > > 17:41:20 IRKST 2012 > > = root@freebsd8-amd64.ispsystem.net:/root/src/roman-sys/amd64/compile/ISPSYS= TEM > > amd64 > > > > thanks in advance > > Krzysztof Kowalski >=20 > see fail2ban >=20 >=20 You don't really need fail2ban, you can use 'pf' to archive this easily = under FreeBSD. However sometime ago I wrote a script that gets stats from fail2ban, I'm = sure you can do what you want by taking a look at the code[1]. Also, posting your domain name in mailing lists is not a good idea. Cheers :-) Panagiotis (atmosx) Atmatzidis email: atma@convalesco.org URL: http://www.convalesco.org GnuPG ID: 0xE736C6A0 gpg --keyserver x-hkp://pgp.mit.edu --recv-keys 0xE736C6A0 -- The wise man said: "Never argue with an idiot. They bring you down to = their level and beat you with experience." --Apple-Mail=_2808F1A8-7872-473B-B59C-E77F1BD9D620 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 krisik28@gmail.com> = wrote:
I know that there is fail2ban but i would like to achieve = it by my self :)

2012/12/9 tamouse = mailing lists <tamouse.lists@gmail.com>
On Sat, Dec 8, 2012 at = 7:35 PM, Krzysztof Kowalski <krisik28@gmail.com> = wrote:
> Hello there.
> I would like to make script that = gets failed logging attempt ip, when it
> count that ip tried = logging more than 5 times in row script will write new
> block = rule with that ip to ipfilter in freebsd 8.
> So I like to manage = this by getting each line of file with logging attempts
> to = arrays ( it makes array in array). I have a little problem with = obtaining
> array with word "Failed" and passing it to new array = with ip's that i would
> like to block. Next I get every 13th = element (which is ipv6 address) and
> write new rule after = counting it with hash.
> Can someone show me how to make it = happend?
>
> CODE:
> #!/usr/local/bin/ruby19
> = filename =3D '/var/log/auth.log'
> falo =3D String.new
> = File.open(filename) { |f| falo =3D f.read }
> words =3D = falo.split('\n')
>
> $ ruby19 -v
> ruby 1.9.3p327 = (2012-11-10 revision 37606) [amd64-freebsd8]
> $ uname -a
> = FreeBSD mc.pl.eu.org 8.3-STABLE FreeBSD 8.3-STABLE #0 = r130: Mon Apr 23
> 17:41:20 IRKST 2012
> root@freebsd8-amd64.isps= ystem.net:/root/src/roman-sys/amd64/compile/ISPSYSTEM
> = amd64
>
> thanks in advance
> Krzysztof = Kowalski

see = fail2ban



Y= ou don't really need fail2ban, you can use 'pf' to archive this easily = under FreeBSD.

However sometime ago I = wrote a script that gets stats from fail2ban, I'm sure you can do what = you want by taking a look at the code[1].

Also, = posting your domain name in mailing lists is not a good = idea.

Cheers = :-)



Panagiotis (atmosx) Atmatzidis

email: atma@convalesco.org
URL: = http://www.convalesco.org
GnuPG ID: 0xE736C6A0
gpg = --keyserver x-hkp://pgp.mit.edu --recv-keys 0xE736C6A0
--
The = wise man said: "Never argue with an idiot. They bring you = down to their level and beat you with experience."

= --Apple-Mail=_2808F1A8-7872-473B-B59C-E77F1BD9D620--