80 lines
2.2 KiB
C
80 lines
2.2 KiB
C
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
#include <fcntl.h>
|
|
#include <string.h>
|
|
#include <time.h>
|
|
|
|
#define BUFFER 270
|
|
#define LONG_BUFFER 1024*100
|
|
#define TOP_IP 20
|
|
#define AWK "| awk -v num=%d '{a[$1]+=1;} END {for(i in a){if (a[i] >= num) {print i;}}}' "
|
|
#define GE_10 "grep -E \"^$(date \"+%h\").$(date \"+%d\")\" /var/log/auth.log | grep failure | grep rhost"
|
|
#define LE_10 "grep -E \"^$(date \"+%h\")..$(date | awk '{print $3}')\" /var/log/auth.log | grep failure | grep rhost"
|
|
#define IPTABLES "/sbin/iptables -I INPUT -s %s -j DROP"
|
|
|
|
int main(int argc, char *argv[], char **env)
|
|
{
|
|
FILE *fp, *fc;
|
|
char p[2], splice_command[LONG_BUFFER], command[LONG_BUFFER], *temp, buffer[BUFFER], awk[BUFFER], iptables[BUFFER];
|
|
|
|
time_t timep;
|
|
struct tm *tp;
|
|
time(&timep);
|
|
tp = localtime(&timep);
|
|
memset(splice_command, 0, LONG_BUFFER);
|
|
memset(command, 0, LONG_BUFFER);
|
|
memset(buffer, 0, BUFFER);
|
|
memset(awk, 0, BUFFER);
|
|
memset(iptables, 0, BUFFER);
|
|
fp = NULL;
|
|
fc = NULL;
|
|
|
|
if (tp->tm_mday >= 10) {
|
|
if ((fp = popen(GE_10, "r")) == NULL) {
|
|
return 1;
|
|
}
|
|
} else {
|
|
if ((fp = popen(LE_10, "r")) == NULL) {
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
while (fgets(buffer, BUFFER, fp) != NULL) {
|
|
temp = strstr(buffer, "rhost");
|
|
sscanf(temp, "rhost=%s", temp);
|
|
if (atoi(strncpy(p, temp, 1)) > 0) {
|
|
strcat(splice_command, temp);
|
|
strcat(splice_command, "\n");
|
|
}
|
|
}
|
|
printf("%s", splice_command); // 测试没问题
|
|
|
|
// 拼接命令
|
|
sprintf(awk, AWK, TOP_IP);
|
|
strcpy(command, "echo \"");
|
|
strcat(command, splice_command);
|
|
strcat(command, "\"");
|
|
strcat(command, awk);
|
|
//printf("%s", command); // 测试没问题
|
|
if ((fp = popen(command, "r")) == NULL) { // 执行命令
|
|
perror("popen");
|
|
return 1;
|
|
}
|
|
while (fgets(buffer, BUFFER, fp) != NULL) {
|
|
buffer[strlen(buffer) - 1] = '\0'; // 去除回车
|
|
sprintf(iptables, IPTABLES, buffer);
|
|
if ((fc = popen(iptables, "r")) == NULL) {
|
|
perror("popen");
|
|
return 1;
|
|
}
|
|
|
|
}
|
|
|
|
pclose(fp);
|
|
pclose(fc);
|
|
|
|
|
|
return 0;
|
|
}
|