Messages in this thread | | | Subject | Re: kernel.org status: hints on how to check your machine for intrusion | From | Steven Rostedt <> | Date | Sat, 01 Oct 2011 14:40:07 -0400 |
| |
OK, I decided to attach the perl script anyway. It is very crude, and really needs to be cleaned up for generic use.
I copy this file into /etc/cron.daily/01iptable-update and let the cron daemon run it. I get nice little reports from cron when something is added, like:
/etc/cron.daily/01iptables-update: adding 8.25.218.88 to iptables blocked list adding 116.125.124.20 to iptables blocked list adding 38.99.131.171 to iptables blocked list
I officially announce that this file is being released under the GPLv2 license. If you want to fix it up. Feel free, but please send me a copy ;)
Note, this was written for a Debian system. It reads the /var/log/auth.log file. Your system may require a different read, and maybe even different regex parsing.
-- Steve
[unhandled content-type:application/x-perl] | |