Re: [ssfr] Pb avec un script recupere sur le net

[giggzounet <giggzounet@xxxxxxxxx>]

Le 18 juin 2010 09:36, steve <dlist@xxxxxxxxxx> a écrit :

Salut,

Pas lu ton script et tu ne dis pas où il s'arrête.
Tu peux mettre un -x en première ligne, parfois ça aide à débugguer :

#!/bin/bash -x

bonjour,

je mets le script en fin de message avec le modifs apportées par Thierry.

Le pb est tjs le même. si la variable $list est vide, le script boucle infiniment...et ce même avec la modif de thierry.

en mettant des echo $list, le script s'arrete dès le premier test sur ssh...

merci.

le script en question :

#!/bin/bash
# IPBLOCK v2
# v1 - First release
# v2 - All rules merged into 1 file

## PARAMETERS
# threshold parameters indicate the number of invalid attempt from an ip before to be banned
log_ssh="${1:-./auth.log}"
log_ftp="${1:-./proftpd.log}"
log_http="${1:-./auth.log}"

echo $log_ssh
echo $log_ftp
echo $log_http

#incorrect ssh user
threshold_ssh1=5
#incorrect ssh password
threshold_ssh2=5
#incorrect ftp user
threshold_ftp1=5
#incorrect ftp password
threshold_ftp2=5
#incorrect http user&password
threshold_http=5


## CHECKING
# Abort the script if the log file has not been modified since it has been read.
builtin test ! -N "$log_ssh" && builtin test ! -N "$log_ftp" && builtin test ! -N "$log_http" && exit 0


## SSH RULES
# RULE 1: invalid user
list=`grep 'invalid user' $log_ssh | cut -d' ' -f13`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
  [ $count -le $threshold_ssh1 ] && continue
  [ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
  (printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal user attempts via ssh)\n" "$ip" "$count") 
done
# RULE 2: invalid password
list=`grep 'Failed password for root' $log_file | cut -d' ' -f11`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
  [ $count -le $threshold_ssh2 ] && continue
  [ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
  (printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal password attempts via ssh)\n" "$ip" "$count") 
done


## FTP RULES
# RULE 1: invalid password
list=`grep 'no such user found' $log_ftp | cut -d' ' -f15`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
  [ $count -le $threshold_ftp1 ] && continue
  [ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
  (printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal user attempts via ftp)\n" "$ip" "$count") 
done
# RULE 2: invalid password
list=`grep 'Incorrect password' $log_file | sed 's/\[/ /g' | sed 's/\]/ /g' | cut -d' ' -f10`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
  [ $count -le $threshold_ftp2 ] && continue
  [ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
  (printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal password attempts via ftp)\n" "$ip" "$count") 
done


## HTTP RULES
# RULE 1: invalid user&password
list=`grep 'authentication failure' $log_http  | sed 's/=/ /g' | cut -d' ' -f20`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
  [ $count -le $threshold_http ] && continue
  [ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
  (printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal attempts via http)\n" "$ip" "$count") 
done