search

robzr / dropBrute

Lightweight fail2ban alternative for OpenWRT - inspects ssh log for brute force attacks and blocks via iptables - w/ whitelist and blacklist support
20 stars 8 forks source link

Case sensitivity issue #1

Open enzomich opened 6 years ago

enzomich commented 6 years ago

At least in my version of dropbear (v2015.67), the message logged for a bad password attempt starts with a capital B, and therefore is not caught by "egrep 'login attempt for nonexistent user' ..." in the lines 90 and 91:

Mon Sep 24 15:25:27 2018 authpriv.warn dropbear[2177]: Bad password attempt for 'root' from 192.168.1.19:45424

I would suggest to add a "-i" option after "egrep".

enzomich commented 6 years ago

Also, today should include the day of week:

today=$(date +'%a %b %d')