python - Python中检查是否存在奇怪IP(不在白名单中的IP)的脚本函数

Question

我有一个如下所示的日志文件:

Aug 25 10:22:28 iZk1a211s8hkb4hkecu7w1Z sshd[17386]: Invalid user tmp from 10.148.0.13 port 33470
Aug 25 10:22:30 iZk1a211s8hkb4hkecu7w1Z sshd[17386]: Failed password for invalid user tmp from 10.148.0.13 port 33470 ssh2
Aug 25 10:23:33 iZk1a211s8hkb4hkecu7w1Z sshd[17481]: Invalid user ed from 10.148.0.13 port 33474
Aug 25 10:23:35 iZk1a211s8hkb4hkecu7w1Z sshd[17481]: Failed password for invalid user ed from 10.148.0.13 port 33474 ssh2
Aug 25 10:23:39 iZk1a211s8hkb4hkecu7w1Z sshd[17496]: Invalid user ssz from 10.148.0.13 port 33476
Aug 25 10:23:40 iZk1a211s8hkb4hkecu7w1Z sshd[17496]: Failed password for invalid user ssz from 10.148.0.13 port 33476 ssh2
Aug 25 10:23:43 iZk1a211s8hkb4hkecu7w1Z sshd[17502]: Invalid user ubuntu from 10.148.0.13 port 33478
Aug 25 10:23:45 iZk1a211s8hkb4hkecu7w1Z sshd[17506]: Failed password for root from 10.148.0.13 port 33480 ssh2
Aug 25 10:23:45 iZk1a211s8hkb4hkecu7w1Z sshd[17502]: Failed password for invalid user ubuntu from 10.148.0.13 port 33478 ssh2

你如何检查是否有外部 IP 试图在 Python 中访问你的服务器？脚本的输出可能会提取奇怪的 IP 或引发一些标志等

到目前为止我只能创建它，如果您传递的 IP 与 .txt 中的 IP 匹配，它只会引发 true 或 false:

def check_ip(ip_address):
    whitelist = open('untitled.txt')
    for ip in whitelist.readlines():
        if ip_address == ip:
            return True
    return False

如果我在日志中尝试:

file = open('auth_filter.log', 'r')

check_ip(file)

它会返回 False

Answer 1

根据我对问题的理解，您有两个输入:包含白名单 IP 地址列表的文件包含日志的文件 - 'auth_filter.log'

我假设你的 while 列表文件看起来像这样

10.148.0.13
10.148.0.14

我修改了您的“auth_filter.log”示例数据以创建一些不属于白名单 IP 的 IP。

我的“auth_filter.log”文件如下所示:

Aug 25 10:22:28 iZk1a211s8hkb4hkecu7w1Z sshd[17386]: Invalid user tmp from 10.148.0.13 port 33470
Aug 25 10:22:30 iZk1a211s8hkb4hkecu7w1Z sshd[17386]: Failed password for invalid user tmp from 10.148.0.13 port 33470 ssh2
Aug 25 10:23:33 iZk1a211s8hkb4hkecu7w1Z sshd[17481]: Invalid user ed from 10.148.0.13 port 33474
Aug 25 10:23:35 iZk1a211s8hkb4hkecu7w1Z sshd[17481]: Failed password for invalid user ed from 10.148.0.13 port 33474 ssh2
Aug 25 10:23:39 iZk1a211s8hkb4hkecu7w1Z sshd[17496]: Invalid user ssz from 10.148.0.16 port 33476
Aug 25 10:23:40 iZk1a211s8hkb4hkecu7w1Z sshd[17496]: Failed password for invalid user ssz from 10.148.0.16 port 33476 ssh2
Aug 25 10:23:43 iZk1a211s8hkb4hkecu7w1Z sshd[17502]: Invalid user ubuntu from 10.148.0.14 port 33478
Aug 25 10:23:45 iZk1a211s8hkb4hkecu7w1Z sshd[17506]: Failed password for root from 10.148.0.14 port 33480 ssh2
Aug 25 10:23:45 iZk1a211s8hkb4hkecu7w1Z sshd[17502]: Failed password for invalid user ubuntu from 10.148.0.15 port 33478 ssh2

这里注意，我有2个IP不在白名单中。它们是 10.148.0.15 和 10.148.0.16

提取所有不在白名单中的IP的代码如下:

whitelist = [] #list that will store the whitelist IPs from the whitelist file
blacklist = []

with open('whitelist.txt','r') as w, open('auth_filter.log','r') as f:

    #first read the whitelist IPs and store them into a list : whitelist
    for wlist in w:
        whitelist.append(wlist.strip())

    #now read each line in the log file
    for line in f:
        x = line.find(' from ') #Assumption: IP always follows ' from '
        if x != -1:
            y = line.find(' port')  #Assumption: port always follows IP

            if line[x+6:y] not in whitelist:
                blacklist.append(line[x+6:y]) #extract IP and store in blacklist

blacklist = list(set(blacklist)) #remove duplicates by converting it to a set and back. set removes duplicates

print ('whitelist :', whitelist)
print ('blacklist :', blacklist)

输出:

whitelist : ['10.148.0.13', '10.148.0.14']
blacklist : ['10.148.0.16', '10.148.0.15']