Untitled

Python read ip address and if over 10 attempts save to file called failed.py

myFile = open('auth','r')

 

ips = {}

 

for line in myFile:

    parts = line.split(' ')

    if parts[3] == 'authentication failure':

        if parts[3] in ips:

            ips[parts[0]] += 1

        else:

            ips[parts[0]] = 0

 

with open('failed.py','w') as myFile:

    for ip in [k for k, v in ips.iteritems() if v >=10]:

        myFile.write(ip)

       

Jan 10 09:32:07 j4-be03 sshd[3876]: pam_unix(sshd:auth): authentication failure;    logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.173.35  user=root

Jan 10 09:32:09 j4-be03 sshd[3876]: Failed password for root from 218.241.173.35 port 47084 ssh2

       

from collections import defaultdict

ips = defaultdict(int)

with open('auth','r') as f:

  for line in f:

    if "authentication failure" in line:

      # split on multiple whitespace characters and use second-last element

      ip = line.split()[-2].split('=')[1]

      ips[ip] += 1

       

with open('failed.txt','w') as f:

  for ip in [k for k, v in ips.iteritems() if v >=10]:

    f.write(ip)