failed-logins.py - analisi login falliti

# Con file default /var/log/auth.log
python3 failed_logins.py

# Con file specificato
python3 failed_logins.py /percorso/altro/auth.log

Da 2026-03-24T23:56:53.354973+00:00 a 2026-03-24T23:57:08.887877+00:00
Totale tentativi falliti: 4
  192.168.64.1: 4 tentativi

#!/usr/bin/env python3
from collections import Counter
import re
import sys

def parse_auth_log(filepath="/var/log/auth.log"):
    failed = []
    pattern = r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)"
    first_ts = None
    last_ts = None
    with open(filepath, "r") as f:
        for line in f:
            match = re.search(pattern, line)
            if match:
                if first_ts is None:
                    first_ts = line.split()[0]
                failed.append(match.group(1))
                last_ts = line.split()[0]
    return Counter(failed), first_ts, last_ts

if __name__ == "__main__":
    filepath = sys.argv[1] if len(sys.argv) > 1 else "/var/log/auth.log"
    counts, first_ts, last_ts = parse_auth_log(filepath)
    print(f"Da {first_ts} a {last_ts}")
    print(f"Totale tentativi falliti: {sum(counts.values())}")
    for ip, count in counts.most_common(5):
        print(f"  {ip}: {count} tentativi")

pattern = r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)"
# regex che matcha righe tipo:
# "Failed password for invalid user pippo from 192.168.1.1 port 22"
# il gruppo () cattura solo l'IP

first_ts = None
last_ts = None
# traccia primo e ultimo timestamp
# first_ts viene impostato solo una volta (la prima)
# last_ts viene aggiornato ad ogni match (rimane l'ultimo)

failed.append(match.group(1))
# aggiunge l'IP (gruppo 1) alla lista
# Counter poi conta quante volte compare ogni IP

counts, first_ts, last_ts = parse_auth_log(filepath)
# Python restituisce piu' valori separati da virgola
# vengono ricevuti con unpacking