Nick Wantz stopandcatchfire
stopandcatchfire
/ ssh-attempts.txt
Created
February 27, 2016 07:43
— forked from gfoss/ssh-attempts.txt
grep IP addresses from auth logs to see attempted ssh attempts into your box w/ invalid creds {ubuntu}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #search for invalid logon attempts, pull out IP, remove dupes, sort... | |
| $ grep -rhi 'invalid' /var/log/auth.log* | awk '{print $10}' | uniq | sort > ~/ips.txt | |
| #look em up | |
| $ for i in `cat ~/ips.txt`; do @nslookup $i 2>/dev/null | grep Name | tail -n 1 | cut -d " " -f 3; done > ~/who.txt | |
| # :-) # | |
| $ do moar things... |