Does anyone have a script that will monitor the /var/log/secure and the /var/log/messages files and log the ip's of attempts to connect faster than once every second?

I am having a lot of people attempting to connect to my ftp server (anonymously) and also through telnet and I want to set up a script that will just add their ip's to my /etc/hosts.deny file so I don't have to worry about them again.

It gets annoying having to browse through 200 attempts from the same ip.

Is it just me or do most illegal attempts come from Europe?

Any ideas?

portsentry does. I am sure if you want to add them manually thru a web interface its easy to create a script to do so.

Wow, I posted that over a year ago !!

Where did you dig that one up :D

WOW :) hehe maybe he needs post count boost :D

Originally posted by tymonhall
portsentry does. I am sure if you want to add them manually thru a web interface its easy to create a script to do so.


Portsentry does that? I don't think so.

tabernack posted that when he was a newbie :)

anyway, locking thread..