Re: [cobalt-users] Code Red

[Ted Behling <TBehling@xxxxxxxxxxxxx>]

Off the top of my head, something like this should work:

tail -f /home/log/httpd/access | grep "\.ida" | ipchains -A input --source
`sed...` -j DENY -l

Replace ... with the Sed expression to extract the IP address.

At 07:34 PM 8/9/01 +0100, Jason Vaughan wrote:
>There have been frequent threads about Code Red and even a few 
>scripts to check how many times it has attacked.
>
>Here is a challenge for any top scripters out there...
>
>Write a script which monitors the access log and if it sees tell tale 
>signs (e.g requests for .ida) it then blocks that IP address, using 
>IPCHAINS or similar.


--------------------------------------------------------------------------
Ted Behling, Web Application Developer - Monarch Information Systems, Inc.

43 Folly Field Road, Unit 4, Hilton Head Island, SC 29928-5434
E-mail: mailto:TBehling@xxxxxxxxxxxxx
Phone/Fax: 1-800-842-7894    Local or Outside the USA: 1-843-842-7894
Cell Phone (urgent issues): 843-816-7895
Cell Phone E-mail: mailto:TedPhone@xxxxxxxxxxxxx (116 letter limit)
Web site: http://www.MonarchIS.net
--------------------------------------------------------------------------