lkml.org 
[lkml]   [2011]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: kernel.org status: hints on how to check your machine for intrusion
From
Date
OK, I decided to attach the perl script anyway. It is very crude, and
really needs to be cleaned up for generic use.

I copy this file into /etc/cron.daily/01iptable-update and let the cron
daemon run it. I get nice little reports from cron when something is
added, like:

/etc/cron.daily/01iptables-update:
adding 8.25.218.88 to iptables blocked list
adding 116.125.124.20 to iptables blocked list
adding 38.99.131.171 to iptables blocked list

I officially announce that this file is being released under the GPLv2
license. If you want to fix it up. Feel free, but please send me a
copy ;)

Note, this was written for a Debian system. It reads
the /var/log/auth.log file. Your system may require a different read,
and maybe even different regex parsing.

-- Steve

[unhandled content-type:application/x-perl]
\
 
 \ /
  Last update: 2011-10-01 20:43    [W:0.110 / U:0.620 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site