commit c28c0a6e13fd23240e9f516e2dde3df16b4c64c4 Author: swaits Date: Sat Mar 4 06:45:47 2006 +0000 1st add for sshbruted diff --git a/sshbruted.rb b/sshbruted.rb new file mode 100644 index 0000000..778b56a --- /dev/null +++ b/sshbruted.rb @@ -0,0 +1,9 @@ + +regexp = /(.+).+mailsystem sshd\[\d+\]: Failed ([\A ]+) for ([\A\s]+) from ([\d\.]+) port (\d+) ssh2/ +match = regexp.match(subject) +if match + result = match[1] +else + result = "" +end + diff --git a/test.log b/test.log new file mode 100644 index 0000000..4e77ad7 --- /dev/null +++ b/test.log @@ -0,0 +1,10 @@ +Mar 3 18:56:21 mailsystem sshd[19738]: Failed password for root from 125.251.21.2 port 46065 ssh2 +Mar 3 18:56:23 mailsystem sshd[19740]: Failed password for root from 125.251.21.2 port 46211 ssh2 +Mar 3 18:56:25 mailsystem sshd[19742]: Failed password for root from 125.251.21.2 port 46373 ssh2 +Mar 3 18:56:26 mailsystem sshd[19744]: Failed password for root from 125.251.21.2 port 46531 ssh2 +Mar 3 18:56:28 mailsystem sshd[19746]: Failed password for root from 125.251.21.2 port 46700 ssh2 +Mar 3 18:56:30 mailsystem sshd[19748]: Failed password for root from 125.251.21.2 port 46849 ssh2 +Mar 3 18:56:31 mailsystem sshd[19750]: Failed password for root from 125.251.21.2 port 47010 ssh2 +Mar 3 18:56:33 mailsystem sshd[19752]: Failed password for root from 125.251.21.2 port 47161 ssh2 +Mar 3 21:53:15 mailsystem sshd[20090]: Accepted password for swaits from 66.27.52.246 port 51310 ssh2 +Mar 3 21:53:26 mailsystem su: swaits to root on /dev/ttyp0