Sponsored Content
Special Forums Cybersecurity Processing btmp with PHP for iptables Post 303028032 by Neo on Sunday 30th of December 2018 04:06:51 AM
Old 12-30-2018
Here is the current file created from our little PHP program to process btmp. Note how much brute-force activity is from China.... Smilie

Code:
www:~/logs$ cat btmp_block_logs.txt
iptables -A INPUT -s 111.9.9.193/24  -j DROP #  btmp count 87 Country: CN desc CMNET
iptables -A INPUT -s 113.10.156.129/24  -j DROP #  btmp count 45 Country: HK desc NWTiDC-HK
iptables -A INPUT -s 125.4.193.107/24  -j DROP #  btmp count 39 Country: JP desc JCN
iptables -A INPUT -s 149.56.10.119/24  -j DROP #  btmp count 28 Country: UA desc OVH-CUST-5024201
iptables -A INPUT -s 150.109.48.10/24  -j DROP #  btmp count 30 Country: SG desc ACEVILLEPTELTD-SG
iptables -A INPUT -s 177.11.121.15/24  -j DROP #  btmp count 35 Country:  desc 
iptables -A INPUT -s 185.139.21.20/24  -j DROP #  btmp count 28 Country: FR desc FR-AGORAVITA-20160216
iptables -A INPUT -s 187.188.191.39/24  -j DROP #  btmp count 29 Country: MX desc 
iptables -A INPUT -s 193.112.98.66/24  -j DROP #  btmp count 62 Country: EU desc NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
iptables -A INPUT -s 218.92.1.190/24  -j DROP #  btmp count 7302 Country: CN desc CHINANET-JS
iptables -A INPUT -s 220.249.112.225/24  -j DROP #  btmp count 28 Country: CN desc Wuhan-University
iptables -A INPUT -s 43.231.184.203/24  -j DROP #  btmp count 61 Country: HK desc ANCHGLOBAL-HK
iptables -A INPUT -s 58.16.251.128/24  -j DROP #  btmp count 87 Country: CN desc GuiYang-Communications-administration
iptables -A INPUT -s 58.250.79.7/24  -j DROP #  btmp count 26 Country: CN desc UNICOM-GD
iptables -A INPUT -s 60.12.13.98/24  -j DROP #  btmp count 51 Country: CN desc UNICOM-ZJ
iptables -A INPUT -s 61.220.207.241/24  -j DROP #  btmp count 28 Country: TW desc HINET-NET
iptables -A INPUT -s 66.135.33.133/24  -j DROP #  btmp count 323 Country: US desc SERVER-ALLOC-1
iptables -A INPUT -s 77.249.249.244/24  -j DROP #  btmp count 39 Country: NL desc UPC-NL
iptables -A INPUT -s 83.244.80.102/24  -j DROP #  btmp count 73 Country: PS desc CALL-U-INTERNET-SERVICE-PROVIDER

 

7 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Parllel Processing

In simple words of the scenario. I have some set of files that are to loaded into a table in parallel Loading part would be taken care of the Abintio graph. I must develop a script which instructs this graph about how to process the files like wat files to process and how to process by... (1 Reply)
Discussion started by: nagrcm
1 Replies

2. What is on Your Mind?

Linux Centos 5.4 BTMP file size

Dear fellows, I have Centos 5.4 linux with DNS server, all logs are normal, in my /var/log/ btmp files is getting larger day by day. What is this btmp file for? How can i reduce the file siez or control file size. Waiting. MAZ (1 Reply)
Discussion started by: maz
1 Replies

3. Shell Programming and Scripting

How to make parallel processing rather than serial processing ??

Hello everybody, I have a little problem with one of my program. I made a plugin for collectd (a stats collector for my servers) but I have a problem to make it run in parallel. My program gathers stats from logs, so it needs to run in background waiting for any new lines added in the log... (0 Replies)
Discussion started by: Samb95
0 Replies

4. Shell Programming and Scripting

help with file processing

Hi , I have a memory file like this with two columns: @C010 AA @C011 AA @C012 FE @C013 FF @C014 F7 @C015 FF first is memory add, second is the data. I wan to convert into a serial sequence starting from '00000' all the way to 'FFFFF' with those fields from the above file... (15 Replies)
Discussion started by: return_user
15 Replies

5. Programming

awk processing / Shell Script Processing to remove columns text file

Hello, I extracted a list of files in a directory with the command ls . However this is not my computer, so the ls functionality has been revamped so that it gives the filesizes in front like this : This is the output of ls command : I stored the output in a file filelist 1.1M... (5 Replies)
Discussion started by: ajayram
5 Replies

6. Fedora

/var/log/btmp size 2.2Gb daily

Hello, One Fedora server is facing the issue that daily /var/log/btmp grows to 2.2Gb or more. I need your help to determine the cause and isolate it. Thank you! (6 Replies)
Discussion started by: feroccimx
6 Replies

7. Shell Programming and Scripting

File processing

Hi, i have multiple files in a Input directory Say eg: 50 files. I want to process all the fifty files and put it in 5 different files (basically each 5 file contain 10 10 files data total of fifty files). Is there any script available. pls help. I tried using the for loop, eg: cat *.txt... (1 Reply)
Discussion started by: satms
1 Replies
LAST, LASTB(1)							   User Commands						    LAST, LASTB(1)

NAME
last, lastb - show a listing of last logged in users SYNOPSIS
last [options] [username...] [tty...] lastb [options] [username...] [tty...] DESCRIPTION
last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0. When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created. lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts. OPTIONS
-a, --hostlast Display the hostname in the last column. Useful in combination with the --dns option. -d, --dns For non-local logins, Linux stores not only the host name of the remote host, but its IP number as well. This option translates the IP number back into a hostname. -f, --file file Tell last to use a specific file instead of /var/log/wtmp. The --file option can be given multiple times, and all of the specified files will be processed. -F, --fulltimes Print full login and logout times and dates. -i, --ip Like --dns , but displays the host's IP number instead of the name. -number -n, --limit number Tell last how many lines to show. -p, --present time Display the users who were present at the specified time. This is like using the options --since and --until together with the same time. -R, --nohostname Suppresses the display of the hostname field. -s, --since time Display the state of logins since the specified time. This is useful, e.g., to easily determine who was logged in at a particular time. The option is often combined with --until. -t, --until time Display the state of logins until the specified time. --time-format format Define the output timestamp format to be one of notime, short, full, or iso. The notime variant will not print any timestamps at all, short is the default, and full is the same as the --fulltimes option. The iso variant will display the timestamp in ISO-8601 format. The ISO format contains timezone information, making it preferable when printouts are investigated outside of the system. -w, --fullnames Display full user names and domain names in the output. -x, --system Display the system shutdown entries and run level changes. TIME FORMATS
The options that take the time argument understand the following formats: YYYYMMDDhhmmss YYYY-MM-DD hh:mm:ss YYYY-MM-DD hh:mm (seconds will be set to 00) YYYY-MM-DD (time will be set to 00:00:00) hh:mm:ss (date will be set to today) hh:mm (date will be set to today, seconds to 00) now yesterday (time is set to 00:00:00) today (time is set to 00:00:00) tomorrow (time is set to 00:00:00) +5min -5days NOTES
The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configu- ration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp). FILES
/var/log/wtmp /var/log/btmp AUTHOR
Miquel van Smoorenburg <miquels@cistron.nl> AVAILABILITY
The last command is part of the util-linux package and is available from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util- linux/>. SEE ALSO
login(1), wtmp(5), init(8), shutdown(8) util-linux October 2013 LAST, LASTB(1)
All times are GMT -4. The time now is 04:26 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy