if statement with two column output

Question

I do have an output as shown below. My plan is to get the first column and do a if statement greater than n value it will get the IP second column and drop the connection.

cat file| egrep "invalid|password" | egrep -v "Accepted|preauth" | awk '{print $13}' |sort | uniq -c

   6 61.177.172.35
4083 61.177.172.22
   3 69.28.94.192
  10 80.2.33.180

I can extract the first column and do the if statement but don't know how can attribute the value with a corresponding IP.

What do you want to do with the `if` statement part ? Just print depending on `n` value ? If that's so, I think what you want can be done in just one awk line instead of several pipes — Sergiy Kolodyazhnyy, Feb 02 '18 at 03:40
*"Can someone guide me on what is the best approach?"* Please **look into `iptables`** as you're reinventing the wheel. With iptables you can set up maximum connections per IP address quite easily; for a starting point, see https://unix.stackexchange.com/q/139285/135943 — Wildcard, Feb 02 '18 at 03:47
@Wildcard thanks but I am not using iptables instead its firewall-cmd — hasslefree, Feb 02 '18 at 05:32

Gilles Quénot · Answer 1 · 2018-02-02T03:31:15.750

0

Try this :

#!/bin/bash

value=1 # to be defined

egrep "invalid|password" file |
egrep -v "Accepted|preauth" |
awk '{print $13}' |
sort |
uniq -c | 
while read -r num ip; do
    if ((num > value)); then
        doSomethingWith "$ip"
    fi
done

edited Feb 02 '18 at 03:31

answered Feb 02 '18 at 03:25

Gilles Quénot

31,569
7
64
82

Is it bash? `If (`? `$num`? – Weijun Zhou Feb 02 '18 at 03:28
Yes it's bash code (arithmetic) – Gilles Quénot Feb 02 '18 at 03:29
If it is `bash` I would expect `((num>value))` or `[ $num -ge $value ]`, also `if` without `then`? C-style brackets? – Weijun Zhou Feb 02 '18 at 03:30
Oops, good catch ! – Gilles Quénot Feb 02 '18 at 03:31
Below is the script I did. I can get the desired value for $brute but I need its corresponding value in badip. >#!/bin/bash brute=$(cat /var/log/secure | egrep "invalid|password" | awk '{print $13}' |sort | uniq -c | awk '{print $1}') badip=$(cat /var/log/secure | egrep "invalid|password" | awk '{print $13}' |sort | uniq -c | awk '{print $2}') for i in $brute; do #### Check all the line of the output of variable $brute if [ $i -gt 10 ]; then echo $i fi done – hasslefree Feb 02 '18 at 05:47
Never paste a script in a comment. I recommend to use `fail2ban`, don't reinvent the wheel – Gilles Quénot Feb 02 '18 at 13:45
https://www.fail2ban.org/wiki/index.php/Main_Page – Gilles Quénot Feb 02 '18 at 13:46

if statement with two column output

1 Answers1