MaRiOsGR
asked on
easy shell scripting question
I've made with the help of people here this script to filter the ssh attempts:
#!/bin/sh
cat /var/log/messages | grep "authentication failure;" | gawk -F: '{ print $4 }' > /tmp/ssh.txt
sort /tmp/ssh.txt | uniq > /tmp/sshfinal.txt
cat /tmp/sshfinal.txt | gawk -F"rhost=" '{ split($2, a, " |\r\n"); print a[1]; }' | uniq > /tmp/sshfinal.txt
i've added this line to get it via email after a cron setup.
echo -e "Subject:Firewall\nFrom:Se rver <senderemail\>\n"`cat /tmp/sshfinal.txt` | /usr/sbin/sendmail myemail
The sshfinal.txt file looks like this:
195.97.43.147
201.218.205.164
202.103.69.69
203.146.140.96
217.65.24.148
218.239.223.223
218.249.174.24
222.90.232.199
But ofcourse when I receive the email its like this :
195.97.43.147 201.218.205.164 202.103.69.69 203.146.140.96 217.65.24.148 218.239.223.223
it may sounds stupid but how can I change that ?
I know i could do that if i would use \n at the end of each ip in the sshfinal.txt file, but the file is generated by the script each time so I dont know how to do that.
#!/bin/sh
cat /var/log/messages | grep "authentication failure;" | gawk -F: '{ print $4 }' > /tmp/ssh.txt
sort /tmp/ssh.txt | uniq > /tmp/sshfinal.txt
cat /tmp/sshfinal.txt | gawk -F"rhost=" '{ split($2, a, " |\r\n"); print a[1]; }' | uniq > /tmp/sshfinal.txt
i've added this line to get it via email after a cron setup.
echo -e "Subject:Firewall\nFrom:Se
The sshfinal.txt file looks like this:
195.97.43.147
201.218.205.164
202.103.69.69
203.146.140.96
217.65.24.148
218.239.223.223
218.249.174.24
222.90.232.199
But ofcourse when I receive the email its like this :
195.97.43.147 201.218.205.164 202.103.69.69 203.146.140.96 217.65.24.148 218.239.223.223
it may sounds stupid but how can I change that ?
I know i could do that if i would use \n at the end of each ip in the sshfinal.txt file, but the file is generated by the script each time so I dont know how to do that.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
thank you veru much.