Skip to content

Instantly share code, notes, and snippets.

@robmiller

robmiller/gist:6002038

Last active December 19, 2015 18:49
Show Gist options
  • Save robmiller/6002038 to your computer and use it in GitHub Desktop.
Save robmiller/6002038 to your computer and use it in GitHub Desktop.
Download ZIP
One-liner for finding out what usernames attackers are using when bruteforcing SSH on an OS X box
Raw
gistfile1.sh
sudo bzcat /var/log/secure*.bz2 \
| perl -ne '/authentication error for( illegal user)? (\S+) from/ && print "$2\n"' \
| sort | uniq -c | sed 's/^ *//' | sort -n
@robmiller
Copy link
Author

A RedHat equivalent:

sudo zcat /var/log/secure*.gz | grep 'Failed password' \
  | perl -n -e '/for (\S+)/ && print "$1\n"' | sort | uniq -c

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment