find-brute-force-logins.sh

find-brute-force-logins.sh

#!/bin/bash
BFDOMS=/root/.bf-doms
BFIPS=/root/.bf-ips
FINAL=/root/.bf-blacklist
DATE=$(date +%d/%b/%Y)
echo -n "Capturing for 30s.."
for S in {1..30}; do
        service httpd fullstatus | grep POST | grep login | awk '{print $1}' >> $BFDOMS
        sleep 1
        echo -n "."
done
echo "Done"
CNT=$(cat $BFDOMS | sed 's/^$//g' | wc -l)
if [ $CNT -gt 0 ]; then
echo "Collecting IP addresses"
for DOM in $(cat $BFDOMS | sort | uniq | sed 's/^$//g'); do
        #USER=$(grep -l "${DOM}" /var/cpanel/users/* 2>/dev/null | awk -F/ '{print $NF}')
        #DOMAIN=$(grep "${DOM}" /var/cpanel/users/* 2>/dev/null | grep "DNS" | awk -F: '{print $2}' | awk -F= '{print $NF}' | sed "s/.*\($DOM.*\) /\1/")
        if [ -f "/usr/local/apache/domlogs/${DOM}" ]; then
                grep "${DATE}" /usr/local/apache/domlogs/${DOM} | grep login | awk '{print $1}' >> $BFIPS
        else
                grep "${DATE}" /usr/local/apache/domlogs/${DOM}* | grep login | awk '{print $1}' >> $BFIPS
        fi
done
fi
sort $BFIPS | uniq > .bf-blacklist
rm -f $BFDOMS $BFIPS