Playing with the logs again

So, I've some logging going on. I typically look at my auth logs and my FW logs that reside within /var/log. I also archive my bruteforce blocking FW table (PF), as the table dumps when I reboot or when the system loses power.

I consolidated these logs into one massive file (333,603 IPs). Yes, there are probably many repeat IPs, but that's OK. Several (26 of them, consisting of two unique IPs) are when I accidentally blocked myself.

I took the resulting file and did this:

cat top10_1.txt | sort | uniq -c | sort -rn

which resulted in this file.

The IPs with a count of '238' are obviously part of a distributed brute forcing botnet...its intriguing the way it is depicted within this hack's output. Also, the actual number of unique IPs recorded is 2377.

Now, maybe I should script something to provide me something like this on a daily basis...meaning, I'd like to see only that day's activity (right now, I'm crunching logs from at least a year back).

Also, this is from my FreeBSD machine, which runs PF, has port 22 open to the world (locked down service, though), has port 3306 open, and is my security box.

Latest Happenings...

Hey all...it's been awhile.

What's been happening? I've upgraded my Slackware machine to v12.0, wiping my partitions and doing a fresh install. Why? I'd been upgrading my Slack install since v10.0 and the install was becoming rather stagnant, so I backed up the important things and did a reinstall with little issues. I'm not quite done setting things up yet (like grabbing the latest graphics drivers (Nvidia) and testing compiz). I'm quite happy with v12.0, although I've got my work cut out for me concerning learning the differences between this version and the last...I know there were some rather substantial changes, from what I've heard.

What else have I been doing? Devlving in FreeBSD and OpenBSD a bit more. I've converted my FreeBSD machine's firewall from ipf to pf. The .conf files use similar syntax but the command structure is quite different, along with the number of functions that pf can perform. pf appears quite a bit more robust than ipf...ipf appears to be a minor reflection of pf. I'm definitely learning things, but the machine that pf is running on only serves SSH connections, but that's quit enough for me at this point in time.

I've also decided to reflash my Linksys router to an opensource firmware called Tomato. It runs on the WRT54G/GS, some Buffalo, and Broadcom-based routers. It appears very robust and easy to set up. It is also easy to revert back to the original firmware. I recommend giving this one a shot. It is not meant to be something akin to OpenWRT or similar...it's designed to be and stay light and fast, which it is, but is also has plugins for functionality that may be mandatory for the above-average hacker.

I've also just returned from vacation in California. I think I may end up buying a home there, near the San Diego area, as that place is so much different than where I'm at now, plus we'll be close to relatives and nice vacation sites. I just have to start conducting employment research so I can see what that area can offer me, employment-wise. It may mean me going to a different part of the IT arena (sysadmin or something similar). I don't mind changing my job a bit, as long as I stay in some type of management position.

What projects do I have or plan on conducting? I intend to clean up my office and turning off some hardware or consolidating some server duties, because my office looks like a rat's nest. It's partly because there are no power outlets in my office (!!). Yeah, I'm renting and the prior owners finished the basement but appeared to be in such a rush that they neglected to put the power outlets back in place. I think I can do one (maybe with my father's help)...one may be enough. Right now, I've a beefy power cord running from the storage area to my office space...everything is attached to that one strip (yeah, a bit dangerous, but I spend a bit of money on beefy surge protection).

Well, I think this post more than makes up for the last few weeks/months of non-activity. I shall try to be more vigilant in posting in the future (famous last words).