HOWTO use geoiplookup
Geolocalization of banned IPs
You may be interested in a quick summary of the countries where the attacks come from. This document explains how to find these information.
- Geoiplookup - http://www.maxmind.com/geoip/api/c.shtml
- Python (you should already have that...)
In Gentoo, the needed package is the following :
dev-libs/geoip Latest version available: 1.3.14 Latest version installed: [ Not Installed ] Size of downloaded files: 1,984 kB Homepage: http://www.maxmind.com/geoip/api/c.shtml Description: easily lookup countries by IP addresses, even when Reverse DNS entries don't exist License: GPL-2
This will install "geoiplookup" and "geoipupdate" to update the database (you need a license id to get a new db)
This small script will extract the banned IPs from fail2ban.log. It looks for lines such as "..... Ban 192.168.1.1", extracts the IP and runs geoiplookup. You may have to change the hardcoded paths in the script depending on your configuration.
# Fail2BanGeo.py import os import re f = open('fail2ban.log', 'r') pattern = r".*?Ban\s*?((25[0-5]|2[0-4][0-9]|?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|?[0-9][0-9]?))$" p = re.compile(pattern) for i in f: m = p.match(i) if m: ip = m.group(1) file = os.popen('geoiplookup %s' % ip) print file.read()
Note that there is a Geo-Ip binding for Python available.
myserver # python fail2bangeo.py GeoIP Country Edition: CI, Cote D'Ivoire
GeoIP Country Edition: FR, France
GeoIP Country Edition: CN, China
GeoIP Country Edition: KO, South Korea
GeoIP Country Edition: VN, Vietnam
For advanced results, you may be interested in :