disloops / psadify Goto Github PK

This issue continues the discussion from

• https://gist.github.com/cdeck3r/5151c53b282431158a59091c0e26f27d#gistcomment-3856184
• https://gist.github.com/cdeck3r/5151c53b282431158a59091c0e26f27d#gistcomment-3857604

@disloops committed a change that addressed the issue and also corrected a rather serious error in the reporting on the "Last Attacks" page.

Code update to review and discuss: 6efb719

I came across the following situation: When PSAdify is started and there has been no attackers logged to far, the python script fails in L305, because the referenced slice top_ports[:rows/2] does not use an integer, if the array is empty. One could think so, because len(top_ports) is 0 and 0/2 is 0 again. However, it does not work like that.

There are actually two occurances of the rows/2 expression:

A simple patch would be to replace rows/2 by rows//2. The latter floors the result to the next lower integer.

Thank you for the cool tool. 👍

In tracking down an IP address from a series of enties in a NginX error log, I found your site. I left a reduced snippet on the RPi PSAD blog page, they were from the same address & "compaines" on your Top 10 lists. They were interesting because they showed URLS that allow backdoor entry via a web server (some of them are silly - poor security).

Can PSAD corelate more than just IPTables logs.

BTW I use RPi(s) with Alpine Linux, and RPiOS with Alpine Docker images