hmm/ips.go

25 lines
612 B
Go

package hmm
import (
"regexp"
)
// Failed password for root from 43.229.53.57 port 62954 ssh2
// message repeated 2 times: [ Failed password for root from 43.229.53.57 port 32871 ssh2]
var p = regexp.MustCompile(`Failed password for .* from (.*) port`)
// ParseIP finds the ip address from an sshd log line that contains a failed
// password attempt.
//
// A found IP address will be returned; an empty string returned indicates
// nothing was found.
func ParseIP(line string) string {
if m := p.FindStringSubmatch(line); m != nil {
if len(m) != 2 {
return ""
}
return string(m[1])
}
return ""
}