Exploit-DB updates

Monday, October 17, 2011

Python script to parse syslog/audit.log for ssh activity.

I wrote this quick script to parse through my audit log for ssh login attempts and than decided to make it usable on my ubuntu-based box too. Below you can find the source code;

logmon.py


sshmon.py

http://pastebin.com/ehkm5syX

It's pretty strightforward, you run the logmon.py and type in ssh to run the sshmon module for your distro (Detects Ubuntu and Red Hat as of right now, you can easily tweak it to meet your needs). I made this for my own use so it's not perfect, and I plan on improving it and adding more modules to suit my needs. If I do than I'll post updates.

No comments:

Post a Comment