Skript kontrollib OpenSSH logist ebaõnnestunud autentimisi ning lävendi ületamisel blokeerib IP aadressi
From ICO wiki
#!/usr/bin/python
import smtplib
failures = {}
kir=open("/etc/hosts.deny",'r+')
fh = open("/home/risto/python/opensshsisend.py")
for rida in fh.readlines():
# IP-aadressid
if "Failed password" in rida:
r = rida.split()[12]
if failures.has_key(r):
failures[r] += 1
else:
failures[r] = 1
massiiv = failures.items()
massiiv.sort(key = lambda (failures, arv):-arv)
for failures, arv in massiiv:
# print failures, arv
if (arv > 9):
vana=kir.read()
kir.write(vana +'%s\n' % (failures))
kir.close()
fh.close()
sender = 'risto@siitan.com'
receivers = ['risto@siitan.com']
message = """From: From Person <from@fromdomain.com>
To: To Person <to@todomain.com>
Subject: Rünnakute teade
/etc/hosts.deny listi lisati uus IP aadress.
"""
try:
smtpObj = smtplib.SMTP('localhost')
smtpObj.sendmail(sender, receivers, message)
print "Email saadetud"
except smtplib.SMTPException:
print "Error: Ei saanud email-i saata"