This is a multi-part message in MIME format. -- [ Picked text/plain from multipart/alternative ]
autoban.sh -------------- #!/bin/bash cd ~hl3/steam_hlds/cstrike/logs grep "%n" * |grep -v say |cut -d "<" -f3-|cut -d ">" -f -1|grep -i steam|uniq -c|cut -d " " -f 5- > exploit.txt for i in `cat ~hl3/dir/cstrike/logs/exploit.txt`;do echo "banid 0 $i" > auto-ban.cfg done ------------------- Check the wrapping there. There's only 5 lines. I'm sure there's an easier way to do this, but I'll be honest, my shell scripting is a lot rusty and I don't have much time to do this type of thing during my work day. This will parse the standard source logs and peel out only the steamid's and dump them to exploit.txt file. Which, in turn is parsed to add the banid string into an auto-ban.cfg file that is loaded into the server.cfg. Yea, I know it's not pretty, and I know it's not a "real time" corrective action. However, as I found out last night, you can't kick the %n nicks from rcon either. The nick doesn't appear properly and if you ban/kick the steam ID, it causes the server to crash just the same. All we can do is be reactive on this until a patch comes out. This file will need to be adjusted for the halflife user account, the directories and such. If you use this, I can't guarantee that it will function for you. It's just something that I'm doing personally and it does work for me. Again, it's not in real time, but it will keep them from coming back once the map changes. I cron this every 4 minutes to update the ban file, and it's updated on the server at map change. -- Micheal Patterson Senior Communications Systems Engineer 405-917-0600 Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ----- Original Message ----- From: "Marco Balle" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, October 19, 2004 5:33 AM Subject: [hlds_linux] %n Ban list > Hi, > > here are my ban list of people who crashed servers with the %n bug: > > banid 0.0 STEAM_0:0:101977 > banid 0.0 STEAM_0:0:133399 > banid 0.0 STEAM_0:0:142203 > banid 0.0 STEAM_0:0:1487576 > banid 0.0 STEAM_0:0:1665040 > banid 0.0 STEAM_0:0:18422 > banid 0.0 STEAM_0:0:3565540 > banid 0.0 STEAM_0:0:3766290 > banid 0.0 STEAM_0:0:3865452 > banid 0.0 STEAM_0:0:38984 > banid 0.0 STEAM_0:0:4079 > banid 0.0 STEAM_0:0:4247073 > banid 0.0 STEAM_0:0:4497360 > banid 0.0 STEAM_0:0:4549738 > banid 0.0 STEAM_0:0:4554653 > banid 0.0 STEAM_0:0:4586436 > banid 0.0 STEAM_0:0:4617023 > banid 0.0 STEAM_0:0:4647206 > banid 0.0 STEAM_0:0:53033 > banid 0.0 STEAM_0:0:705555 > banid 0.0 STEAM_0:0:73053 > banid 0.0 STEAM_0:1:1017187 > banid 0.0 STEAM_0:1:1203752 > banid 0.0 STEAM_0:1:1663069 > banid 0.0 STEAM_0:1:1914503 > banid 0.0 STEAM_0:1:225579 > banid 0.0 STEAM_0:1:2441082 > banid 0.0 STEAM_0:1:2508858 > banid 0.0 STEAM_0:1:2650 > banid 0.0 STEAM_0:1:272049 > banid 0.0 STEAM_0:1:3045459 > banid 0.0 STEAM_0:1:3055278 > banid 0.0 STEAM_0:1:3118127 > banid 0.0 STEAM_0:1:33068 > banid 0.0 STEAM_0:1:3955671 > banid 0.0 STEAM_0:1:4062327 > banid 0.0 STEAM_0:1:4237193 > banid 0.0 STEAM_0:1:4580390 > banid 0.0 STEAM_0:1:4595753 > banid 0.0 STEAM_0:1:4597220 > banid 0.0 STEAM_0:1:4608051 > banid 0.0 STEAM_0:1:4635342 > banid 0.0 STEAM_0:1:4670278 > banid 0.0 STEAM_0:1:4688504 > banid 0.0 STEAM_0:1:531148 > > > Here a peace of the logs: > > L 10/17/2004 - 15:55:03: "%n<1707><STEAM_0:0:101977><TERRORIST>" say > "CRAAAAAAAAAAAAAAAAAAAAAAAAAAAASH!" > L 10/17/2004 - 15:55:03: "%n<1707><STEAM_0:0:101977><TERRORIST>" committed > suicide with "world" > > L 10/19/2004 - 01:06:15: "%n<115><STEAM_0:0:3565540><TERRORIST>" say "PLZ > KILL ME I AM A MYGOT PLZ KILL ME I AM A MYGOTY" > L 10/19/2004 - 01:06:31: "%n<115><STEAM_0:0:3565540><TERRORIST>" committed > suicide with "world" > > L 10/18/2004 - 13:10:47: "%n<131><STEAM_0:1:4062327><CT>" say "crash time > every one leave now !!!!!!" > > L 10/17/2004 - 15:54:57: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:54:58: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:54:59: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:55:00: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:55:01: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:55:02: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:55:03: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > say "This server crash brought to you by [myg0t]????????" > L 10/17/2004 - 15:55:03: "[myg0t]....<1707><STEAM_0:0:101977><TERRORIST>" > changed name to "%n" > L 10/17/2004 - 15:55:03: "%n<1707><STEAM_0:0:101977><TERRORIST>" say > "CRAAAAAAAAAAAAAAAAAAAAAAAAAAAASH!" > L 10/17/2004 - 15:55:03: "%n<1707><STEAM_0:0:101977><TERRORIST>" committed > suicide with "world" > ... > and so on. Many times a day. > > > - > Marco > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds_linux > -- _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
