무차별 대입 공격 (Brute Force) 탐지 정규표현식 로직

표: 단순 문자열 매칭이 아닌 "빈도(Threshold)" 기반 탐지
핵심: grep, awk, sort, uniq를 조합하여 동일 IP에서 3회 이상 실패한 IP만 추출.

상황: SSH 접속 로그(auth.log). 비밀번호를 계속 틀리는 IP를 찾아 차단해야 한다. 3번 미만 실수는 보류.

 

*테스트 데이터 (auth.log):

Plaintext

 

Mar 10 10:00:01 server sshd[100]: Failed password for root from 192.168.0.100 port 22

Mar 10 10:00:02 server sshd[101]: Accepted password for admin from 10.0.0.5 port 2222

Mar 10 10:00:03 server sshd[102]: Failed password for root from 192.168.0.100 port 22

Mar 10 10:00:04 server sshd[103]: Failed password for user1 from 172.16.0.50 port 5432

Mar 10 10:00:05 server sshd[104]: Failed password for root from 192.168.0.100 port 22

Mar 10 10:00:06 server sshd[105]: Accepted password for user1 from 172.16.0.50 port 5432

Mar 10 10:00:07 server sshd[106]: Failed password for admin from 192.168.0.100 port 22

Mar 10 10:00:08 server sshd[107]: Failed password for invalid user guest from 192.168.0.100 port 22

Mar 10 10:01:00 server sshd[108]: Failed password for test from 10.10.10.10 port 3333

Mar 10 10:01:01 server sshd[109]: Failed password for test from 10.10.10.10 port 3333

Mar 10 10:01:02 server sshd[110]: Failed password for test from 10.10.10.10 port 3333

Mar 10 10:02:00 server sshd[111]: Failed password for dev from 1.1.1.1 port 4444

Mar 10 10:02:01 server sshd[111]: Failed password for dev from 1.1.1.1 port 4444

Mar 10 10:03:00 server sshd[112]: Accepted password for manager from 192.168.0.200 port 22

Mar 10 10:03:01 server sshd[113]: Failed password for manager from 192.168.0.200 port 22

Mar 10 10:03:02 server sshd[114]: Failed password for manager from 192.168.0.200 port 22

Mar 10 10:03:03 server sshd[115]: Failed password for manager from 192.168.0.200 port 22

Mar 10 10:04:01 server sshd[116]: Accepted password for admin from 8.8.8.8 port 22

Mar 10 10:04:02 server sshd[117]: Accepted password for admin from 8.8.8.8 port 22

Mar 10 10:04:03 server sshd[118]: Accepted password for admin from 8.8.8.8 port 22

Mar 10 10:05:01 server sshd[119]: Failed password for user2 from 172.16.100.100 port 22

Mar 10 10:05:02 server sshd[120]: Failed password for user2 from 172.16.100.100 port 22

Mar 10 10:05:03 server sshd[121]: Accepted password for user2 from 172.16.100.100 port 22

 

*탐지해야 할 ip

10.10.10.10

192.168.0.100

192.168.0.200

 

 

정답

 

 

 

 

 grep Failed auth.log | awk '{ print $(NF-2) }' | sort -n | uniq -c | sort | awk '$1 >=3 { print $2 }'