grep messages

willigiann · 02-05-2006, 05:33 PM

Hello everyone!
I am getting many attacks everyday and i start to get annoyed with it. I have open only SSHD and thats where i am receiving all the attacks. So i was thinking somehow to block those specific IP's when they attacking me. So i want somehow to automaticly put all the IPs (Only) into a file and then block them. The problem is that grep returns all the line and not only the IP.
For example if i run cat /var/log/messages | grep sshd | grep Failed
it will return Jan 31 15:33:48 server sshd[10982]: Failed password for named from 65.254.61.170 port 42024 ssh2
Now, i know a command "split" that i can use it to get back only the 65.254.61.170 but i have no idea how to use it!
Any ideas?

bulliver · 02-05-2006, 07:12 PM

First of all, you have RUOC going on (redundant use of 'cat')

Second, awk will do what you like:

Code:

$ grep sshd /var/log/messages | grep Failed | awk '{print $11}'
65.254.61.170

willigiann · 02-06-2006, 08:04 AM

thank you for your quick answer and your comments.
i tried but here is the output:
server:/home/billg # grep sshd /var/log/messages | grep Failed | awk '{print $11}' 65.254.61.170
awk: cmd. line:1: fatal: cannot open file `65.254.61.170' for reading (No such File or Folder)

I have SuSE 10

bulliver · 02-06-2006, 01:10 PM

I think you misunderstand, the '65.254.61.170' is just the output based on the logline you gave me.

Code:

grep sshd /var/log/messages | grep Failed | awk '{print $11}'

is the command you should use...