denyhostsで記録したIPアドレスをGEO IPで国コードへ変換する

denyhosts.rb

# -*- coding: utf-8 -*-

# cjheath/geoip https://github.com/cjheath/geoip

require 'geoip'

def build_hosts(hosts_file)
  hosts ||= []
  lines = File.open(hosts_file).readlines()
  lines.each{|line|
    if line =~ /^sshd/
      hosts << line.gsub('sshd: ', '').chomp
    end
  }
  return hosts
end

def build_geoip(geoip_dat)
  return geoip = GeoIP.new(geoip_dat)
end

def main(argv)
  hosts_file = argv[0]
  geoip_dat = argv[1]
  
  hosts = build_hosts(hosts_file)
  geoip = build_geoip(geoip_dat)
  
  countries ||= {}
  countries.default = 0
  
  hosts.each{|host|
    c3 = geoip.country(host).country_code3
    countries[c3] += 1
  }
  
  countries.sort {|a, b| (b[1] <=> a[1]) }.each{|c|
    puts "#{c[0]} #{c[1]}"
  }
end

main(ARGV)