Skip to content

Instantly share code, notes, and snippets.

@da2x

da2x/authlog-ip-counter.sh

Last active December 14, 2015 06:38
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save da2x/5043767 to your computer and use it in GitHub Desktop.
Save da2x/5043767 to your computer and use it in GitHub Desktop.
Download ZIP
Counts unique IP-addresses in /var/log/auth.* so you know who is brute-forcing you on SSH or other publicly exposed services. Also useful to run against other logs such as mail.* to look for attempted server abuse.
Raw
authlog-ip-counter.sh
#!/bin/sh
cat /var/log/auth.* | \
egrep --only-matching '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
sort | uniq --count | \
sort --general-numeric-sort
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment