-----Original Message-----
From: C. Ahmet MERCAN [mailto:ahmet.mercan@gmail.com]
Sent: Thu 10/26/2006 5:06 PM
To: Ertugrul ERZIN
Cc: debian-user-turkish@lists.debian.org
Subject: Re: SUSPECT: RE: SSH ve login ile bir programi tetiklemek: Nasil?
> Merhaba;
>
> IP bloklamak için de hazir bir program var: DenyHost.
>
>Sizin seçtiginiz kriterlere göre bloklama yapiyor, ve size mail atiyor:
Ben de bir süredir SSH ile baglantili olarak benzer
bir is icin fail2ban kullaniyorum:
http://fail2ban.sourceforge.net/wiki/index.php/Main_Page
http://packages.debian.org/unstable/net/fail2ban
--
Emre Sevinc
eMBA Yazilim Gelistirme
Istanbul Bilgi Universitesi
DenyHosts Report
---------------------------------------------
Added the following hosts to /etc/hosts.deny:
69.220.77.118 (unknown)
---------------------------------------------
Saygilarimla, Iyi Günler...
Cem Ahmet MERCAN
Ertugrul ERZIN yazmis:
> Merhabalar ,
>
> ---------------------------------------------------------------------------------------
>
> root@debian:~# cat /home/www/router/data_scriptler/ssh_accept_fail.sh
>
> #!/bin/bash
>
>
> PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>
>
> mailler="ee@ttnet.net.tr"
>
>
> touch /tmp/sshaccept_1 /tmp/sshfail_1
>
>
> cat /var/log/auth.log |grep sshd | grep "Accepted password" > /tmp/sshaccept_2
>
> cat /var/log/auth.log |grep sshd | grep "Failed password" > /tmp/sshfail_2
>
>
> diff /tmp/sshaccept_1 /tmp/sshaccept_2 | grep ">" |sed 's/> //g' >
> /tmp/sshaccept_3
>
> diff /tmp/sshfail_1 /tmp/sshfail_2 | grep ">" |sed 's/> //g' > /tmp/sshfail_3
>
>
> cp /tmp/sshaccept_2 /tmp/sshaccept_1
>
> cp /tmp/sshfail_2 /tmp/sshfail_1
>
>
> if [ $(cat /tmp/sshfail_3 |wc -c) -gt 0 ]
>
> then
>
> smbclient -M ERT -I 1.1.1.1 < /tmp/sshfail_3
>
> email -s "Hatali Sistem Girisi" -b ee@ttnet.net.tr -cc $mailler < /tmp/sshfail_3
>
> fi
>
>
> if [ $(cat /tmp/sshaccept_3 |wc -c) -gt 0 ]
>
> then
>
> smbclient -M ERT -I 1.1.1.1 < /tmp/sshaccept_3
>
> email -s "Normal Sistem Girisi" -b ee@ttnet.net.tr -cc $mailler <
> /tmp/sshaccept_3
>
> fi
>
> ----------------------------------------------------------------------------------
>
>
> Temel olarak bu script'i(Daha da gelistirilebilir) crontab'a yerlestiriseniz;
> hem hatali, hem de normal ssh girislerini winpopup'dan veya mail olarak
> görebilirsiniz.
> Hatta if else'lerin arasina yazacaginiz kontrollerle eger ayni IP'den atiyorum
> 5'den fazla fail gelirse iptables vasitasiyla o IP'yi bloklayabilirsiniz.
>
>
>
> Ertugrul ERZIN
>
>
> 26 Ekim 2006 Persembe
>
>
>
>
> -- To UNSUBSCRIBE, email to debian-user-turkish-REQUEST@lists.debian.org with a
> subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
--
To UNSUBSCRIBE, email to debian-user-turkish-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org