function WOOT() { TMPNAME=$(mktemp)
[ -f $TMPNAME ] || return 1;
for i in `ls /var/log/apache2/access.*`;
do
case $(file $i | cut -d" " -f2)
in
ASCII)
CAT=cat
;;
gzip)
CAT=zcat
;;
*) break
;;
esac
$CAT $i | grep -i w00tw00t | awk '{print $1}' | sort -n | uniq >> $TMPNAME;
done
for j in $(cat $TMPNAME | sort -nr | uniq );
do
iptables -A INPUT -s $j -j DROP;
done;
rm $TMPNAME;
iptables -A INPUT -s 0/0 -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP;
iptables -A INPUT -s 0/0 -p tcp --dport 443 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP;
}
Вариант для распечатки
