Le 18 juin 2010 09:36, steve
<dlist@xxxxxxxxxx> a écrit :
Salut,
Pas lu ton script et tu ne dis pas où il s'arrête.
Tu peux mettre un -x en première ligne, parfois ça aide à débugguer :
#!/bin/bash -x
bonjour,
je mets le script en fin de message avec le modifs apportées par Thierry.
Le pb est tjs le même. si la variable $list est vide, le script boucle infiniment...et ce même avec la modif de thierry.
en mettant des echo $list, le script s'arrete dès le premier test sur ssh...
merci.
le script en question :
#!/bin/bash
# IPBLOCK v2
# v1 - First release
# v2 - All rules merged into 1 file
## PARAMETERS
# threshold parameters indicate the number of invalid attempt from an ip before to be banned
log_ssh="${1:-./auth..log}"
log_ftp="${1:-./proftpd.log}"
log_http="${1:-./auth.log}"
echo $log_ssh
echo $log_ftp
echo $log_http
#incorrect ssh user
threshold_ssh1=5
#incorrect ssh password
threshold_ssh2=5
#incorrect ftp user
threshold_ftp1=5
#incorrect ftp password
threshold_ftp2=5
#incorrect http user&password
threshold_http=5
## CHECKING
# Abort the script if the log file has not been modified since it has been read.
builtin test ! -N "$log_ssh" && builtin test ! -N "$log_ftp" && builtin test ! -N "$log_http" && exit 0
## SSH RULES
# RULE 1: invalid user
list=`grep 'invalid user' $log_ssh | cut -d' ' -f13`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
[ $count -le $threshold_ssh1 ] && continue
[ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
(printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal user attempts via ssh)\n" "$ip" "$count")
done
# RULE 2: invalid password
list=`grep 'Failed password for root' $log_file | cut -d' ' -f11`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
[ $count -le $threshold_ssh2 ] && continue
[ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
(printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal password attempts via ssh)\n" "$ip" "$count")
done
## FTP RULES
# RULE 1: invalid password
list=`grep 'no such user found' $log_ftp | cut -d' ' -f15`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
[ $count -le $threshold_ftp1 ] && continue
[ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
(printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal user attempts via ftp)\n" "$ip" "$count")
done
# RULE 2: invalid password
list=`grep 'Incorrect password' $log_file | sed 's/\[/ /g' | sed 's/\]/ /g' | cut -d' ' -f10`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
[ $count -le $threshold_ftp2 ] && continue
[ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
(printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal password attempts via ftp)\n" "$ip" "$count")
done
## HTTP RULES
# RULE 1: invalid user&password
list=`grep 'authentication failure' $log_http | sed 's/=/ /g' | cut -d' ' -f20`
echo "$list" | uniq -c | while [ -n $list ] && read count ip
do
[ $count -le $threshold_http ] && continue
[ 0 -ne `grep -c "$ip" /etc/hosts.deny` ] && continue
(printf "ALL: %12s # added `date +"%Y-%m-%d %R"` (%s Illegal attempts via http)\n" "$ip" "$count")
done