Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-26 Thread Brandon Low
On 2009-12-19 (Sat) at 03:38:26 -0900, Mel Flynn wrote: Well, my first problem with it is obviously that I now need python, where I don't want python. In fact, my firewalls/gateways only have /bin/sh and /bin/csh as scripting languages. It's one reason I switched from custom sysutils/grok

Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-19 Thread Mel Flynn
On Thursday 17 December 2009 16:34:22 Brandon Low wrote: I'd love to hear other people's feedback on this approach of using FAM + auth.log to implement this and/or to hear of other superior approaches to achieving this result. Well, my first problem with it is obviously that I now need

Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-18 Thread Matthew Seaman
Robert Huff wrote: Brandon Low writes: Not sure why this didn't attach the first time. The FreeBSD mailing list software is set to scrub all attachments as a security measure. To makew material available, post it in-line, or post a URL. The attachment eater doesn't actually eat

Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-18 Thread Robert Huff
Matthew Seaman writes: The FreeBSD mailing list software is set to scrub all attachments as a security measure. To makew material available, post it in-line, or post a URL. The attachment eater doesn't actually eat *all* attachments. Just the ones with MIME types it thinks

RFC: Fam/Python based script for bruteforce blocking

2009-12-17 Thread Brandon Low
Hi, I'm pretty new to FreeBSD, but when I saw how neatly it supported file-backed tables for IP blocking I knew I'd finally want to build a bruteforce blocking script that I'd long wanted to create on Linux. This script is loosely based on the perl script for the same purpose from

Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-17 Thread Brandon Low
Not sure why this didn't attach the first time. #!/usr/bin/env python import errno import logging import optparse import os import re import select import signal import subprocess import sys import time import datetime import _fam def getUpdateBlocks(pfctl, expire_seconds, blacklist_filename,

Re: RFC: Fam/Python based script for bruteforce blocking

2009-12-17 Thread Robert Huff
Brandon Low writes: Not sure why this didn't attach the first time. The FreeBSD mailing list software is set to scrub all attachments as a security measure. To makew material available, post it in-line, or post a URL. Robert Huff