Freesco, NND, CDN, EOS

Oct 24 20:47:04 router_nnd sshd[14920]: Invalid user jeff from 202.9.98.225
Oct 24 20:47:04 router_nnd sshd[14920]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:05 router_nnd sshd[14920]: error: Could not get shadow information for NOUSER
Oct 24 20:47:05 router_nnd sshd[14920]: Failed password for invalid user jeff from 202.9.98.225 port 40919 ssh2
Oct 24 20:47:05 router_nnd sshd[14920]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:09 router_nnd sshd[14930]: Invalid user irc from 202.9.98.225
Oct 24 20:47:09 router_nnd sshd[14930]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:09 router_nnd sshd[14930]: error: Could not get shadow information for NOUSER
Oct 24 20:47:09 router_nnd sshd[14930]: Failed password for invalid user irc from 202.9.98.225 port 41016 ssh2
Oct 24 20:47:09 router_nnd sshd[14930]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:14 router_nnd sshd[14948]: Invalid user list from 202.9.98.225
Oct 24 20:47:14 router_nnd sshd[14948]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:14 router_nnd sshd[14948]: error: Could not get shadow information for NOUSER
Oct 24 20:47:14 router_nnd sshd[14948]: Failed password for invalid user list from 202.9.98.225 port 41115 ssh2
Oct 24 20:47:14 router_nnd sshd[14948]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:18 router_nnd sshd[14958]: Invalid user eleve from 202.9.98.225
Oct 24 20:47:18 router_nnd sshd[14958]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:18 router_nnd sshd[14958]: error: Could not get shadow information for NOUSER
Oct 24 20:47:18 router_nnd sshd[14958]: Failed password for invalid user eleve from 202.9.98.225 port 41217 ssh2
Oct 24 20:47:18 router_nnd sshd[14958]: Excess permission or bad ownership on file /var/log/btmp
Oct 24 20:47:22 router_nnd sshd[14974]: Invalid user proxy from 202.9.98.225

# Put hosts in here you never want blocked. This includes the IP addresses
# of all local interfaces on the protected host (i.e virtual host, mult-home)
# Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games.
#
# PortSentry can support full netmasks for networks as well. Format is:
#
# <IP Address>/<Netmask>
#
# Example:
#
# 192.168.2.0/24
# 192.168.0.0/16
# 192.168.2.1/32
# Etc.
#
# If you don't supply a netmask it is assumed to be 32 bits.
#
#

127.0.0.1/32
0.0.0.0
192.168.1.0/24
192.168.2.0/24
83.17.142.242

#!/bin/bash

. /etc/rc.conf
. /etc/rc.d/functions

case "$1" in
    start)
        stat_busy "Start Portsentry..."
        ps ax | grep -iw '/usr/sbin/portsentry -atcp' | grep -iv 'grep' > /dev/null
        [ $? != 0 ] && /usr/sbin/portsentry -atcp
            if [ $? = 0 ]; then
                atcp=0
            else
                atcp=1
            fi
        ps ax | grep -iw '/usr/sbin/portsentry -audp' | grep -iv 'grep' > /dev/null
        [ $? != 0 ] && /usr/sbin/portsentry -audp
            if [ $? = 0 ]; then
                audp=0
            else
                audp=1
            fi
        rezultat=$atcp$audp
        if [ $rezultat = 00 ]; then
            stat_done
        else
            stat_fail
        fi
        ;;
    stop)
        stat_busy "Zatrzymywanie Portsentry..."
        array=(`ps ax | awk '/\usr\/sbin\/portsentry/ {print $1}' | tr '\n' ' '`)
        element_count=${#array[@]}
        index=0
        while [ "$index" -lt "$element_count" ]; do
            kill -9 ${array[$index]}
            let "index = $index + 1"
        done
        if [ $index = 2 ]; then
            stat_done
        else
            stat_fail
        fi
;;
     restart)
        $0 stop  && sleep 3
        $0 start
        ;;
     *)
        echo "Stosuj: $0 {start|stop|restart}"
        exit 1
        ;;
esac
exit 0

ps aux