grep IP addresses from auth logs to see attempted ssh attempts into your box w/ invalid creds {ubuntu}

ssh-attempts.txt

#search for invalid logon attempts, pull out IP, remove dupes, sort...
$ grep -rhi 'invalid' /var/log/auth.log* | awk '{print $10}' | uniq | sort > ~/ips.txt

#look em up
$ for i in `cat ~/ips.txt`; do @nslookup $i 2>/dev/null | grep Name | tail -n 1 | cut -d " " -f 3; done > ~/who.txt

# :-) #
$ do moar things...

@gfoss this also includes

exceeded
[preauth]

on the ips.txt

is there a way to specify a regex to get just IPs?

another thing is the duplicates, not sure if in a sh duplicates can be checked though.

@gfloss the second command just creates an empty file, something might not be right.