Home › Forums › BlockHosts

BlockHosts doesn't seen anything -_-

Sat, 2008–Aug–30

I have these lines in my proftpd logs :
===========================================
aoû 30 16:28:52 Nirvana proftpd[17630] Nirvana (marauder.mech-linz.at[80.243.1664.10]): FTP session opened.
aoû 30 16:28:53 Nirvana proftpd[17630] Nirvana (marauder.mech-linz.at[80.243.1664.10]): no such user 'girard'
aoû 30 16:28:53 Nirvana proftpd[17630] Nirvana (marauder.mech-linz.at[80.243.1664.10]): USER girard: no such user found from marauder.mech-linz.at [80.243.164.10] to 192.168.0.1:21
aoû 30 16:28:53 Nirvana proftpd[17630] Nirvana (marauder.mech-linz.at[80.243.1664.10]): no such user 'girard'
aoû 30 16:28:53 Nirvana proftpd[17630] Nirvana (marauder.mech-linz.at[80.243.1664.10]): USER girard: no such user found from marauder.mech-linz.at [80.243.164.10] to 192.168.0.1:21
===========================================

When I run blockhosts, i got this :
===========================================
# blockhosts.py --dry-run --ignore-offset --verbose
blockhosts 2.4.0 started: 2008-08-30 18:54:54 CEST
... loaded /etc/hosts.allow, starting counts: blocked 0, watched 0
... loading log file /var/log/proftpd/proftpd.log, offset: 0
... discarding all host entries older than 2008-08-30 06:54:54 CEST
... final counts: blocked 0, watched 0
#---- BlockHosts Additions
#bh: logfile: /var/log/proftpd/proftpd.log
#bh: offset: 60311945
#bh: first line:aoû 24 04:02:02 Nirvana proftpd[23888] Nirvana (PLAYPEN.MIT.EDU[18.7.10.106]): FTP session opened.

#---- BlockHosts Additions

... no email to send.
===========================================
final count : 0 watched??? It is impossible.

Do you have any idea?

‹ blockhosts (and sshd) headache... geomapping and retaining records... ›
Mon, 2008-09-01 19:34 — Anonymous (not verified)

no pattern exists... and some errors in log?

The IP address in the log file has .1664 in it - that can't be a valid IPv4 address, so it won't match.

Moreover, is your computer using a non-english locale?
The first word is not matching \w\w\w in Python - aoû, so even if the above issue is fixed, current blockhosts won't match this.

Tue, 2008-09-02 21:57 — Anonymous (not verified)

No error in logs, french locales

Hi,

>>The IP address in the log file has .1664 in it - that can't be a valid IPv4 address, so it won't match
It was a display error, the IP address is 80.243.164.10 in my logs. One "6" does not exist.
My logs are correct with addresses

>>Moreover, is your computer using a non-english locale?
>>The first word is not matching \w\w\w in Python - aoû, so even if the above issue is fixed, current blockhosts won't match this.
Yes, my locales are fr_FR.UTF-8
We are now in septembre, no accent. I'll look after logs to see if all goes good and I'll tell you about.
Do you think an evolution is possible to catch special letters like é or û ?

Thanks.

Tue, 2008-10-14 14:15 — ac

matching \w based on locale

Python uses locale to match \w.

Therefore, if the locate is set correctly, and the accented characters are considered alphanumeric, it should have automatically worked - though I suspect I need to call setlocale

I'll fix this in a future release - I suspect I just need to add

import locale
locale.setlocale(locale.LC_ALL, '')

at the beginning of the script. If you know python and can edit the file, see if this change works on your system.
Just add the above lines just above the "import os" line in the file.