Topic: Hack Attempts log parser

[apmuthu]

Here is a script to extract the files involved in SME server hack attempts whenever a "File does not exist" error occurs:

Code: [Select]

EXTIP=`curl -s ifconfig.me/ip`
grep "File does not exist" /var/log/httpd/error_log | sed -e 's#\: /#\n#' | grep "home" | sort -u | sed -e "s#$EXTIP#\<IP\>#g" > dict_err.txt
# grep "File does not exist" /var/log/httpd/admin_error_log | sed -e 's#\: /#\n#' | grep "home" | sort -u | sed -e "s#$EXTIP#\<IP\>#g" > dict_admin_err.txt

Maybe someone can make a contrib package to filter common errors like the above.

[ReetP]

Add them to the wiki please - I think there is a 'useful commands' bit (and note that ipconfig is being deprecated and you should use `ip`)

[apmuthu]

Please point me to where "ipconfig" is used and the actual url that is current now. I had used "ifconfig.me/ip".

Added it to the wiki at:
https://wiki.contribs.org/Useful_Commands#Log

[ReetP]

My typo.

ifconfig is being deprecated.

https://serverfault.com/questions/458628/should-i-quit-using-ifconfig

[apmuthu]

I only used the "ifconfig.me" web service and not the "ifconfig" command.

Anyway, thanks for the info on "ifconfig" deprecated state as also are arp, route and netstat.

There is a nice discussion on this deprecated state at:
https://serverfault.com/questions/458628/should-i-quit-using-ifconfig

Redhat Article:
https://www.redhat.com/sysadmin/ifconfig-vs-ip

The common commands in the new dispensation are:

Code: [Select]

ip addr show
ip addr show eth0
ip link show

"ip" provides much, much more features. Of course it is more complex. Anyway, many commands can be shortened. e.g. "ip addr show" can be shortened to "ip a", "ip link show" to "ip l", "ip link set eth0 up" to "ip l set eth0 up" and so on. This brings "ip" on par with "ifconfig".