Koozali.org: home of the SME Server

Obsolete Releases => SME Server 9.x => Topic started by: apmuthu on August 04, 2020, 08:37:02 AM

Title: Hack Attempts log parser
Post by: apmuthu on August 04, 2020, 08:37:02 AM

Here is a script to extract the files involved in SME server hack attempts whenever a "File does not exist" error occurs:

Code: [Select]

EXTIP=`curl -s ifconfig.me/ip`
grep "File does not exist" /var/log/httpd/error_log | sed -e 's#\: /#\n#' | grep "home" | sort -u | sed -e "s#$EXTIP#\<IP\>#g" > dict_err.txt
# grep "File does not exist" /var/log/httpd/admin_error_log | sed -e 's#\: /#\n#' | grep "home" | sort -u | sed -e "s#$EXTIP#\<IP\>#g" > dict_admin_err.txt

Maybe someone can make a contrib package to filter common errors like the above.

Title: Re: Hack Attempts log parser
Post by: ReetP on August 04, 2020, 09:05:49 PM

Add them to the wiki please - I think there is a 'useful commands' bit (and note that ipconfig is being deprecated and you should use `ip`)

Title: Re: Hack Attempts log parser
Post by: apmuthu on August 05, 2020, 03:48:55 AM

Please point me to where "ipconfig" is used and the actual url that is current now. I had used "ifconfig.me/ip".

Added it to the wiki at:
https://wiki.contribs.org/Useful_Commands#Log

Title: Re: Hack Attempts log parser
Post by: ReetP on August 05, 2020, 09:40:36 AM

My typo.

ifconfig is being deprecated.

https://serverfault.com/questions/458628/should-i-quit-using-ifconfig

Title: Re: Hack Attempts log parser
Post by: apmuthu on August 06, 2020, 03:20:48 AM

I only used the "ifconfig.me" web service and not the "ifconfig" command.

Anyway, thanks for the info on "ifconfig" deprecated state as also are arp, route and netstat.

There is a nice discussion on this deprecated state at:
https://serverfault.com/questions/458628/should-i-quit-using-ifconfig (https://serverfault.com/questions/458628/should-i-quit-using-ifconfig)

Redhat Article:
https://www.redhat.com/sysadmin/ifconfig-vs-ip

The common commands in the new dispensation are:

Code: [Select]

ip addr show
ip addr show eth0
ip link show

"ip" provides much, much more features. Of course it is more complex. Anyway, many commands can be shortened. e.g. "ip addr show" can be shortened to "ip a", "ip link show" to "ip l", "ip link set eth0 up" to "ip l set eth0 up" and so on. This brings "ip" on par with "ifconfig".