Re: kernel.org status: hints on how to check your machine forintrusion

[Steven Rostedt]

OK, I decided to attach the perl script anyway. It is very crude, and
really needs to be cleaned up for generic use.

I copy this file into /etc/cron.daily/01iptable-update and let the cron
daemon run it. I get nice little reports from cron when something is
added, like:

/etc/cron.daily/01iptables-update:
adding 8.25.218.88 to iptables blocked list
adding 116.125.124.20 to iptables blocked list
adding 38.99.131.171 to iptables blocked list

I officially announce that this file is being released under the GPLv2
license. If you want to fix it up. Feel free, but please send me a
copy ;)

Note, this was written for a Debian system. It reads
the /var/log/auth.log file. Your system may require a different read,
and maybe even different regex parsing.

-- Steve

Attachment: iptables-examine-logs.pl
Description: Perl program