forked from pronto/ssh-fail-watcher
-
Notifications
You must be signed in to change notification settings - Fork 0
Squidly1/ssh-fail-watcher
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
NOTE: This code does NOT currently work to create: http://vps2.pronto185.com/newfail ...but it will at some point... ^.^ ...also, a log file that shows changes in new attempts/ports open close,etc.. maybe format like: NEW IP: <ip> <rdns> <good/bad rdns?> <open ports> ATTEMPTS NEW <ip> New:<#of of new> Total:<total> PORTS CLOSED:<ip> <list of ports that were open last check, now closed> PORTS OPENED:<ip> <list of ports that were closed lask check, now open> RDNS CHANGE: <rdns changed?> do itas a funciont, something like def log(type, ip, rdns/data stuff?S). def logadd(Type,data): #types: IP_NEW, NEW_ATTEMPTS, PORT_OPENED, PORT_CLOSED currently only idea/thought process a) central config file, config.ini b) dirs for things eg: flask/, logs/, and scanner/ have it more or less be what it is now c) collect-data.py: run every <x time> (i do every hour) this script: if sees config[datafile_prev]: loads it for comparisoin sets compare to 1 parses auth.log ip=new make new dict: {'IP': '118.220.173.248', 'attempts': 1, 'geo': 'Korea, Republic of', 'IPCHECK': None, 'RDNS': None, 'age':1} if scan = on do port scan, save in another dict that gets dumps seprately get ports to scan from config.ini maybe use python-namp? why re-invent the wheel if nmap, have config.ini option for what nmap flags? ip=old 'attempts'+=1 ip dump the dict ####################################### notes kinda to self: list of functions that are used in more then one script: get_index() a
About
(old one, check out SSH-Rank)
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published