Was just dicking around in Python today:
Python:
import re
import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry
with open('invalid_users') as f:
lines = f.readlines()
for line in lines:
m = re.search(r'Invalid user (?P<username>[^\s]+) from (?P<ip_address>[^\s]+)', line)
ip_address = m.group('ip_address')
session = requests.Session()
retry = Retry(connect=3, backoff_factor=0.5)
adapter = HTTPAdapter(max_retries=retry)
session.mount('http://', adapter)
session.mount('https://', adapter)
response = session.get(f'https://geolocation-db.com/json/{ip_address}&position=true').json()
print(response.get('country_name'))
invalid_users
is a file that I made on my Digital Ocean Droplet from concatenating all the
/var/log/auth*
files and selecting first only the lines that contain "sshd" and then in a second round that go "Invalid user blahblahblah". You can easily achieve the same outcome with
cat
and
grep
but may have to alter or get rid of a few lines where the username is blank or contains whitespace. You might ask why I didn't use the
username
capture and didn't just get the IP addresses. I might analyze those in the future. Right now I'm just concerned with where these requests are coming from. There are a lot of the usual suspects (e.g. India, Huezil) but I'm even seeing a few surprises like some nigger from Angola that just went by on the terminal.
In a period spanning a little over three weeks there were over
53,000 such failed attempts.