Commands by JohnQUnknown (2)

  • This command shows a sorted list of the IP addresses from which there have been authentication errors via SSH (possible script kiddies trying to gain access to your server), it eliminates duplicates so it's easier to read, but you can remove the "uniq" command at the end, or even do a "uniq -c" to have a count of how many times each IP address shows in the log (the path to the log may vary from system to system) Show Sample Output


    2
    cat /var/log/auth.log | grep -i "pam_unix(sshd:auth): authentication failure;" | cut -d' ' -f14,15 | cut -d= -f2 | sort | uniq
    JohnQUnknown · 2011-10-25 04:58:09 0
  • Provides a cleaner output plus some more details about the IP address. Also, a flaw was corrected where the URL provided the results in Spanish by default. Show Sample Output


    0
    function geoip() { curl -s "http://www.geoiptool.com/en/?IP=$1" | html2text | egrep --color "IP Address:|Country:|City:|Longitude:|Latitude:|Host Name:" }
    JohnQUnknown · 2011-10-25 04:49:25 0

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

Convert seconds to [DD:][HH:]MM:SS
Converts any number of seconds into days, hours, minutes and seconds. sec2dhms() { declare -i SS="$1" D=$(( SS / 86400 )) H=$(( SS % 86400 / 3600 )) M=$(( SS % 3600 / 60 )) S=$(( SS % 60 )) [ "$D" -gt 0 ] && echo -n "${D}:" [ "$H" -gt 0 ] && printf "%02g:" "$H" printf "%02g:%02g\n" "$M" "$S" }

Get your outgoing IP address
Instead of opening your browser, googling "whatismyip"... Also useful for scripts. dig can be found in the dnsutils package.

Kill all processes that don't belong to root/force logoff
explanation: grep -- displays process ids -v -- negates the matching, displays all but what is specified in the other options -u -- specifies the user to display, or in this case negate The process loops through all PIDs that are found by pgrep, then orders a forced kill to the processes in numerical order, effectively killing the parent processes first including the shells in use which will force the users to logout. Tested on Slackware Linux 12.2 and Slackware-current

Rename files in batch

access to last touched or created file with arrow_up_key immediately after displaying the file list
Display recursive file list (newest file displayed at the end) and be free to access last file in the list simply by pressing arrow_up_key i.e. open it with joe editor. BTW IMHO the list of files with newest files at the end is often more informative. Put this 'lsa' function somewhere in your .bashrc and issue $ . ~/.bashrc or $ source ~/.bashrc to have access to the 'lsa' command immediately. . (the function appends command "joe last_file_in_the_list" at the end of command history)

Count all the files in the directory and child directories

check open ports without netstat or lsof

get all Amazon cloud (amazonws etc) ipv6 subnets

See all the commits for which searchstring appear in the git diff

Convert seconds to [DD:][HH:]MM:SS
Converts any number of seconds into days, hours, minutes and seconds. sec2dhms() { declare -i SS="$1" D=$(( SS / 86400 )) H=$(( SS % 86400 / 3600 )) M=$(( SS % 3600 / 60 )) S=$(( SS % 60 )) [ "$D" -gt 0 ] && echo -n "${D}:" [ "$H" -gt 0 ] && printf "%02g:" "$H" printf "%02g:%02g\n" "$M" "$S" }


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: