Creates out of failed SSH Logins with Python. Heavily inspired by /u/Ultradad
It relies on matplotlib and cartopy, so its quite a hassle to install properly - Sorry!
Furthermore, you need a CSV file which maps IPv4 subnetworks to geolocations, like they come from maxmind ("GeoLite2 City"). The only important thing is, that it has the fields network,latitude,longitude. The default filename is geolocation.csv, but that can be changed with the --geolocation-csv parameter.
On your Server, you need to read the auth.log files:
grep "Failed" /var/log/auth.log | grep -Po "[\d]+\.[\d]+\.[\d]+\.[\d]+" | sort | uniq -c > failed_logins.txtAs most of the computing time is used for the matching of IPs to a subnetwork, this result can be cached with the --cache-locations locations.csv parameter. So if the dataset did not change, it can be run with the --read-cache locations.csv parameter to directly start with drawing the map.
usage: ip-map.py [-h] [--input INPUT_FILE]
[--geolocation-csv GEOLOCATION_FILENAME]
[--cache-locations WRITE_LOCATIONS_FILE]
[--read-cache READ_LOCATIONS_FILE]
[--result-filename RESULT_FILENAME]
Create a Worldmap out of Numbers and IPv4 addresses
optional arguments:
-h, --help show this help message and exit
--input INPUT_FILE File with number of failed logins followed by IPv4
address, one per line, defaults to failed_logins.txt
--geolocation-csv GEOLOCATION_FILENAME
CSV file with subnet / location mapping, defaults to
geolocation.csv
--cache-locations WRITE_LOCATIONS_FILE
Cache predicted locations in a file
--read-cache READ_LOCATIONS_FILE
Read location data from cache rather then computing it
--result-filename RESULT_FILENAME
Filename of the resulting map, defaults to result.png
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent