From: Panagiotis Atmatzidis Date: 2012-12-10T17:11:03+09:00 Subject: Re: Getting info from array --Apple-Mail=_5EE587DE-E349-4ED2-BFD7-1BA831B060DA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 10 =CE=94=CE=B5=CE=BA 2012, at 08:54 , Panagiotis Atmatzidis = wrote: > Hello, >=20 > On 9 =CE=94=CE=B5=CE=BA 2012, at 12:50 , Krzysztof Kowalski = wrote: >=20 >> I know that there is fail2ban but i would like to achieve it by my = self :) >>=20 >> 2012/12/9 tamouse mailing lists >> On Sat, Dec 8, 2012 at 7:35 PM, Krzysztof Kowalski = wrote: >> > Hello there. >> > I would like to make script that gets failed logging attempt ip, = when it >> > count that ip tried logging more than 5 times in row script will = write new >> > block rule with that ip to ipfilter in freebsd 8. >> > So I like to manage this by getting each line of file with logging = attempts >> > to arrays ( it makes array in array). I have a little problem with = obtaining >> > array with word "Failed" and passing it to new array with ip's that = i would >> > like to block. Next I get every 13th element (which is ipv6 = address) and >> > write new rule after counting it with hash. >> > Can someone show me how to make it happend? >> > >> > CODE: >> > #!/usr/local/bin/ruby19 >> > filename =3D '/var/log/auth.log' >> > falo =3D String.new >> > File.open(filename) { |f| falo =3D f.read } >> > words =3D falo.split('\n') >> > >> > $ ruby19 -v >> > ruby 1.9.3p327 (2012-11-10 revision 37606) [amd64-freebsd8] >> > $ uname -a >> > FreeBSD mc.pl.eu.org 8.3-STABLE FreeBSD 8.3-STABLE #0 r130: Mon Apr = 23 >> > 17:41:20 IRKST 2012 >> > = root@freebsd8-amd64.ispsystem.net:/root/src/roman-sys/amd64/compile/ISPSYS= TEM >> > amd64 >> > >> > thanks in advance >> > Krzysztof Kowalski >>=20 >> see fail2ban >>=20 >>=20 >=20 >=20 > You don't really need fail2ban, you can use 'pf' to archive this = easily under FreeBSD. >=20 > However sometime ago I wrote a script that gets stats from fail2ban, = I'm sure you can do what you want by taking a look at the code[1]. >=20 > Also, posting your domain name in mailing lists is not a good idea. >=20 > Cheers :-) >=20 >=20 >=20 > Panagiotis (atmosx) Atmatzidis >=20 > email: atma@convalesco.org > URL: http://www.convalesco.org > GnuPG ID: 0xE736C6A0 > gpg --keyserver x-hkp://pgp.mit.edu --recv-keys 0xE736C6A0 > -- > The wise man said: "Never argue with an idiot. They bring you down to = their level and beat you with experience." >=20 sorry here's the link [1] = https://github.com/atmosx/f2bread/blob/master/f2bread.rb Panagiotis (atmosx) Atmatzidis email: atma@convalesco.org URL: http://www.convalesco.org GnuPG ID: 0xE736C6A0 gpg --keyserver x-hkp://pgp.mit.edu --recv-keys 0xE736C6A0 -- The wise man said: "Never argue with an idiot. They bring you down to = their level and beat you with experience." --Apple-Mail=_5EE587DE-E349-4ED2-BFD7-1BA831B060DA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 atma@convalesco.org> = wrote:
krisik28@gmail.com> = wrote:

I know that there is fail2ban but i would like to achieve = it by my self :)

2012/12/9 tamouse = mailing lists <tamouse.lists@gmail.com>
On Sat, Dec 8, 2012 at = 7:35 PM, Krzysztof Kowalski <krisik28@gmail.com> = wrote:
> Hello there.
> I would like to make script that = gets failed logging attempt ip, when it
> count that ip tried = logging more than 5 times in row script will write new
> block = rule with that ip to ipfilter in freebsd 8.
> So I like to manage = this by getting each line of file with logging attempts
> to = arrays ( it makes array in array). I have a little problem with = obtaining
> array with word "Failed" and passing it to new array = with ip's that i would
> like to block. Next I get every 13th = element (which is ipv6 address) and
> write new rule after = counting it with hash.
> Can someone show me how to make it = happend?
>
> CODE:
> #!/usr/local/bin/ruby19
> = filename =3D '/var/log/auth.log'
> falo =3D String.new
> = File.open(filename) { |f| falo =3D f.read }
> words =3D = falo.split('\n')
>
> $ ruby19 -v
> ruby 1.9.3p327 = (2012-11-10 revision 37606) [amd64-freebsd8]
> $ uname -a
> = FreeBSD mc.pl.eu.org 8.3-STABLE FreeBSD 8.3-STABLE #0 = r130: Mon Apr 23
> 17:41:20 IRKST 2012
> root@freebsd8-amd64.isps= ystem.net:/root/src/roman-sys/amd64/compile/ISPSYSTEM
> = amd64
>
> thanks in advance
> Krzysztof = Kowalski

see = fail2ban



Y= ou don't really need fail2ban, you can use 'pf' to archive this easily = under FreeBSD.

However sometime ago I = wrote a script that gets stats from fail2ban, I'm sure you can do what = you want by taking a look at the code[1].

Also, = posting your domain name in mailing lists is not a good = idea.

Cheers = :-)



Panagiotis (atmosx) Atmatzidis

email: atma@convalesco.org
URL: http://www.convalesco.org
GnuPG = ID: 0xE736C6A0
gpg --keyserver x-hkp://pgp.mit.edu = --recv-keys 0xE736C6A0
--
The wise man said: "Never = argue with an idiot. They bring you down to their level and = beat you with experience."


sorry here's the = link [1] https://= github.com/atmosx/f2bread/blob/master/f2bread.rb

Panagiotis (atmosx) Atmatzidis

email: atma@convalesco.org
URL: = http://www.convalesco.org
GnuPG ID: 0xE736C6A0
gpg = --keyserver x-hkp://pgp.mit.edu --recv-keys 0xE736C6A0
--
The = wise man said: "Never argue with an idiot. They bring you = down to their level and beat you with experience."

= --Apple-Mail=_5EE587DE-E349-4ED2-BFD7-1BA831B060DA--