#!/bin/bash
TotalData=$(grep dove /var/log/auth.log | grep "authentication failure" | awk '// {print $13 "," $14}' | replace "ruser=" "" | replace "rhost=" "")
$(iptables -F input-pop-hack-blocked)
for i in $TotalData
do
UserName=$(echo $i | cut -d"," -f 1)
UserIp=$(echo $i | cut -d"," -f 2)
echo "UserName = $UserName , UserIp = $UserIp "
if [ -d "/home/$UserName" ]; then
{
(echo "User $UserName Exist")
}
else
{
(echo "User $UserName does not Exist")
if [$(iptables -L input-pop-hack-blocked -vn | grep $UserIp)]; then
{
(echo "iptables -A input-pop-hack-blocked -i eth1 -s $UserIp -p tcp --dport 110 -j DROP")
$(iptables -A input-pop-hack-blocked -i eth1 -s $UserIp -p tcp --dport 110 -j LOG --log-level 4 --log-prefix " FW POP $UserIP DROP")
$(iptables -A input-pop-hack-blocked -i eth1 -s $UserIp -p tcp --dport 110 -j DROP)
$(echo "iptables -A input-pop-hack-blocked -i eth1 -s $UserIp -p tcp --dport 110 -j DROP") >> /var/log/HackPopAuthMessage
}
else
{
(echo " IP Address $UserIp for Username $UserName aleeady added to firewall ")
}
fi
}
fi
done
Bookmarks