Hej ng.
Jeg prøver at få følgende script til at virke med crontab, men jeg får
en fejl i min indbakke
Scriptet ser således ud:
?_ban_ssh_users.pl#!/usr/bin/perl use Date::Format; use Sys::Syslog; #
Intruder log file in /var/log to write in if we have future attacks
$intruderlog="?_intruder_alert"; $backup=0; $tmp=`grep "sshd"
/var/log/auth.log|grep "Illegal user"|awk -F" " '{print
\$8,\$10,\$6,\$7}'|uniq -c -f 1`; @tmpline = split(/\n/,$tmp); foreach
$tmp (@tmpline) { $_=$tmp; if (/.(\d+)/) { $nr=$1; if
(/.\d+.[a-z|0-9]+.\:\:ffff\:([a-z|0-9|\:|\.]+)/) { $client=$1; if
($nr>10) { &action; } } } } exit; sub action {
$deny="/etc/hosts.deny"; $chk=`grep " $client " $deny|wc -l`; if
($chk==0) { print time2str("%Y%m%d.%H%M%S",time)." - SSH attack -
$client - $nr \"Illegal user\" detected\n"; $line=$_; $line =~ s/^\s+//;
&actionbackup; open (F,">>/etc/hosts.deny") || die "Can't open
/etc/hosts.deny: $!\n"; print F "ALL: $client : spawn /bin/echo
`/bin/date` - ban ssh - %c - %d >> /var/log/$intruderlog\n"; close
(F); syslog("auth|info","$0: $client banned"); } } sub actionbackup { if
($backup<1) {
$backupcmd="/etc/!backup/hosts.deny.".time2str("%Y%m%d.%H%M%S",time);
$backupcmd=`cp /etc/hosts.deny $backupcmd`; $backup=1; } }
Min crontab -e ser således ud:
*/3 * * * * root if [ -x /root/bin/?_ban_ssh_users.pl ]; then
/root/bin/?_ban_ssh_users.pl >>/var/log/?_ban_users.log; fi
Fejlen jeg får ser således ud:
Subject:
Cron <root@neo> root if [ -x /root/bin/?_ban_ssh_users.pl ]; then
/root/bin/?_ban_ssh_users.pl >>/var/log/?_ban_users.log; fi
From:
CronDaemon <root@mejborn.dk>
Date:
Tue, 25 Jul 2006 21:15:01 +0200
To:
root@mejborn.dk
/bin/sh: -c: line 1: syntax error near unexpected token `then'
/bin/sh: -c: line 1: `root if [ -x /root/bin/?_ban_ssh_users.pl ]; then
/root/bin/?_ban_ssh_users.pl >>/var/log/?_ban_users.log; fi'
Nogen der har et bud på hvad der går galt?
--
Mvh
Mathias Mejborn
mathias@mejborn.dk
http://mejborn.dk