Cat
m (Reverted edits by 80.251.161.167 (Talk) to last revision by Jimbo) |
(→Related link) |
||
| Line 24: | Line 24: | ||
Without having to muck around with multiple steps or temporary files or any of that business, I told my server to load up the bzip archive of the last section of my auth log, decompress it, and send the results to [[grep]] so that I'd only see the entries related to "Illegal" users. And voila - I can see that the idiot at the APNIC address 218.38.28.136 is trying a [[Block repeated illegal or failed SSH logins|dictionary-style username attack]] on my server. | Without having to muck around with multiple steps or temporary files or any of that business, I told my server to load up the bzip archive of the last section of my auth log, decompress it, and send the results to [[grep]] so that I'd only see the entries related to "Illegal" users. And voila - I can see that the idiot at the APNIC address 218.38.28.136 is trying a [[Block repeated illegal or failed SSH logins|dictionary-style username attack]] on my server. | ||
| − | + | this post is fantastic | |
| − | + | ||
| − | + | ||
| − | + | ||
Revision as of 02:44, 2 July 2010
Found in /bin/cat, when cat is given a file as an argument, it will print out the file contents to your console, or it can be redirected to another file or process.
samizdata# cat /etc/fstab # Device Mountpoint FStype Options Dump Pass# /dev/da0b none swap sw 0 0 /dev/da1b none swap sw 0 0 /dev/da0a / ufs rw 1 1 /dev/da0d /tmp ufs rw 2 2 /dev/da1e /usr ufs rw 2 2 /dev/da1d /var ufs rw 2 2 /dev/cd0 /cdrom cd9660 ro,noauto 0 0
Related commands are zcat (aka gzcat) and bzcat, for use with gzipped and bzipped archives, respectively. Very useful for easily reading rotated, compressed logfiles - for example, let's say I'm tracking down some jackass that keeps trying to find a way into my server, and I want to look at one of the older sections of my auth log:
ph34r# bzcat auth.log.0.bz2 | grep Illegal Oct 19 20:47:47 ph34r sshd[35556]: Illegal user adam from 218.38.28.136 Oct 19 20:47:49 ph34r sshd[35558]: Illegal user alan from 218.38.28.136 Oct 19 20:47:52 ph34r sshd[35560]: Illegal user frank from 218.38.28.136 Oct 19 20:47:54 ph34r sshd[35562]: Illegal user george from 218.38.28.136 Oct 19 20:47:56 ph34r sshd[35564]: Illegal user henry from 218.38.28.136 Oct 19 20:47:59 ph34r sshd[35566]: Illegal user john from 218.38.28.136 Oct 19 20:48:14 ph34r sshd[35578]: Illegal user test from 218.38.28.136
Without having to muck around with multiple steps or temporary files or any of that business, I told my server to load up the bzip archive of the last section of my auth log, decompress it, and send the results to grep so that I'd only see the entries related to "Illegal" users. And voila - I can see that the idiot at the APNIC address 218.38.28.136 is trying a dictionary-style username attack on my server.
this post is fantastic
