Ver el código de «Ddos-attack»

[[Categoría: Linux]]
Detección del ataque

==='''SSH'''===
<pre>
journalctl --since "24 hour ago" | grep -i "Failed password for invalid user" | awk '{print $13}' | sort -n | uniq  </pre>

<pre> journalctl --since "24 hour ago" | grep -i "Failed password for root " | awk '{print $11}' | sort -n | uniq </pre>

==='''MYSQL'''===
'''En plesk''':
<pre> watch -n 0.5 'mysql -uadmin -p`cat /etc/psa/.psa.shadow` -e "show processlist;"' </pre>

==='''WEB'''===


==='''Postfix''' ===
Intentos fallidos de login
<pre>journalctl --since "4 hour ago" | grep "SASL LOGIN authentication failed:" |  awk '{print $7}'| cut -d [ -f2 | cut -d ] -f1 | sort -n | uniq -c | sort -n | awk '{print $2}'</pre>