Difference between revisions of "HOWTO use geoiplookup"

From Fail2ban
Jump to: navigation, search
(Script)
(fixed bug due to execv not returning..)
Line 33: Line 33:
 
         if m:
 
         if m:
 
                 ip = m.group(1)
 
                 ip = m.group(1)
                 os.execv('/usr/bin/geoiplookup', ['/usr/bin/geoiplookup', ip])
+
                 file = os.popen('geoiplookup %s' % ip)
 +
                print file.read()
 +
 
  
 
</nowiki>
 
</nowiki>
Line 43: Line 45:
 
  myserver # python fail2bangeo.py
 
  myserver # python fail2bangeo.py
 
  GeoIP Country Edition: CI, Cote D'Ivoire
 
  GeoIP Country Edition: CI, Cote D'Ivoire
 +
 
  GeoIP Country Edition: FR, France
 
  GeoIP Country Edition: FR, France
 +
 
  GeoIP Country Edition: CN, China
 
  GeoIP Country Edition: CN, China
 +
 
  GeoIP Country Edition: KO, South Korea
 
  GeoIP Country Edition: KO, South Korea
 +
 
  GeoIP Country Edition: VN, Vietnam
 
  GeoIP Country Edition: VN, Vietnam
  

Revision as of 21:09, 16 February 2008

Geolocalization of banned IPs

You may be interested in a quick summary of the countries where the attacks come from. This document explains how to find these information.

Requierements

In Gentoo, the needed package is the following :

dev-libs/geoip
     Latest version available: 1.3.14
     Latest version installed: [ Not Installed ]
     Size of downloaded files: 1,984 kB
     Homepage:    http://www.maxmind.com/geoip/api/c.shtml
     Description: easily lookup countries by IP addresses, even when Reverse DNS entries don't exist
     License:     GPL-2

This will install "geoiplookup" and "geoipupdate" to update the database (you need a license id to get a new db)

Script

This small script will extract the banned IPs from fail2ban.log. It looks for lines such as "..... Ban 192.168.1.1", extracts the IP and runs geoiplookup. You may have to change the hardcoded paths in the script depending on your configuration.


# Fail2BanGeo.py
import os
import re
f = open('fail2ban.log', 'r')    
pattern = r".*?Ban\s*?((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$"
p = re.compile(pattern)
for i in f:
        m = p.match(i)
        if m:
                ip = m.group(1)
                file = os.popen('geoiplookup %s' % ip)
                print file.read()



Note that there is a Geo-Ip binding for Python available.

Output

myserver # python fail2bangeo.py
GeoIP Country Edition: CI, Cote D'Ivoire
GeoIP Country Edition: FR, France
GeoIP Country Edition: CN, China
GeoIP Country Edition: KO, South Korea
GeoIP Country Edition: VN, Vietnam

Other interesting links

For advanced results, you may be interested in :