It-slav.net provides temperature measurement for STHLM/Huddinge area in Sweden to the very popular site temperatur.nu

The measurment is done by a 1-wire temperature probe DS18S20.

The script that collects the temperature and stores it in a file that is presented as a webpage, the webpage is polled regularly by temperatur.nu

#!/usr/bin/perl
 #
 # rrd_tempsensor.pl

#use lib qw(/usr/local/rrdtool-1.2.15/lib/perl);
 use RRDs;
 use OW;

# define location of rrdtool databases
 my $rrd = '/root/owfs/script/rrd_db';
 # define location of images
 my $img = '/home/peter/public_html/temps';

# process data for each interface (add/delete as required)
 &ProcessSensor(0, "Temperatur_Huddinge", "op5.mynet",3001,"10.DEF05F010800");

sub ProcessSensor
 {
 # process sensor
 # inputs: $_[0]: sensor number (ie, 0/1/2/etc)
 #         $_[1]: sensor description
 print "number:$_[0] desc:$_[1], server:$_[2] port:$_[3], id: $_[4]\n";
 my $owserver = "$_[2]:$_[3]";

unless(OW::init($owserver)) {
 $status = $ERRORS{CRIT};
 $message = "OWServer not running at $owserver\n";
 exit $status;
 }

# get temperature from sensor
 my $handle = OW::get("$_[4]/temperature");
 #    print "handle=$handle\n";
 $handle =~ s/^\s*(.*?)\s*$/$1/;
 ## Check if input is an integer or decimal
 unless (($handle =~ /^-?(?:\d+(?:\.\d*)?|\.\d+)$/) || ($handle =~ /^[+-]?\d+$/))
 {
 print "Not an integer or a decimal\n";
 return($ERRORS{CRITICAL});
 }

$temp=$handle;
 # remove eol chars
 chomp($temp);

print "sensor $_[0]: $temp degrees C\n";

# check for error code from temp sensor
 if (int $temp eq 85)
 {
 print "failed to read value from sensor $_[0]\n";
 }
 else
 {
 #Create webpage
 open WEBPAGE, ">$img/$_[1]"
 or die "Cannot create $img/$_[1]: $!";
 print WEBPAGE "$temp\n";
 }
 }

Links:

• http://www.temperatur.nu temperatures from alot of places in Sweden
• My info page at temperatur.nu
• Temperature graphs made by data from me
• The “webpage” that the script  create
• More information about 1-wire at this blog

This is a typical log message in /var/log/authlog

Feb  9 20:15:49 pedro sshd[30934]: Failed password for root from 67.205.85.119 port 35603 ssh2
Feb  9 20:15:49 pedro sshd[2656]: Received disconnect from 67.205.85.119: 11: Bye Bye
Feb  9 20:15:51 pedro sshd[15299]: Failed password for root from 67.205.85.119 port 35753 ssh2
Feb  9 20:15:51 pedro sshd[15791]: Received disconnect from 67.205.85.119: 11: Bye Bye
Feb  9 20:15:53 pedro sshd[9043]: Failed password for root from 67.205.85.119 port 35882 ssh2
Feb  9 20:15:53 pedro sshd[31484]: Received disconnect from 67.205.85.119: 11: Bye Bye
Feb  9 20:15:54 pedro sshd[27717]: Failed password for root from 67.205.85.119 port 36030 ssh2
Feb  9 20:15:55 pedro sshd[30185]: Received disconnect from 67.205.85.119: 11: Bye Bye
Feb  9 20:15:56 pedro sshd[27718]: Failed password for root from 67.205.85.119 port 36164 ssh2
Feb  9 20:15:56 pedro sshd[28005]: Received disconnect from 67.205.85.119: 11: Bye Bye
Feb  9 20:15:58 pedro sshd[30648]: Failed password for root from 67.205.85.119 port 36314 ssh2
Feb  9 20:15:58 pedro sshd[21087]: Received disconnect from 67.205.85.119: 11: Bye Bye

Of course this is a script kiddie that tries to break into my firewall just because it answers on port 22 and it is annoying. One way of make it a little harder to break in is by let the packetfilter drop all packages that comes from an ip-address that did this.

This one way of doing it.

Create a pf blacklist /etc/pf.conf

–snipp–

table <ssh_blacklist> persist file "/var/pf/ssh_blacklist"
...

block in quick log on $ext_if from <ssh_blacklist> to any

–snipp–

Create a script that detects failed ssh breakin attempts and updates the blacklist

root@pedro:/var/log# cat /root/scripts/blockbadssh.sh
#!/bin/sh
logger "Check for bad ssh behavior"
PATH=/bin:/usr/bin
BL=/var/pf/ssh_blacklist
TEMPFILE=$(mktemp /tmp/bl_XXXXXX) || exit 1
TEMPFILE2=$(mktemp /tmp/bl2_XXXXXX) || exit 1

#cp $BL $TEMPFILE
grep "Invalid user" /var/log/authlog | awk '{print $10}' | sort | uniq > $TEMPFILE2
grep "Failed password for invalid" /var/log/authlog | awk '{print $13}' | sort | uniq  >> $TEMPFILE2
grep "Failed password for root" /var/log/authlog | awk '{print $11}' | sort | uniq  >> $TEMPFILE2

sort $TEMPFILE2 |uniq > $TEMPFILE
#echo "Nu är TEMPFILE"
#cat $TEMPFILE

#cat $BL >> $TEMPFILE
for i in `cat $TEMPFILE`
do
  grep $i $BL>/dev/null
  if [ "$?" == "1" ]
  then
    logger "Added $i to ssh-blacklist"
    echo "Added $i to ssh-blacklist"
  fi
done

cat $BL >> $TEMPFILE
sort $TEMPFILE | uniq > $BL

rm $TEMPFILE
rm $TEMPFILE2

/sbin/pfctl -t ssh_blacklist -Treplace -f $BL 2>&1 | grep -v "no changes"

Make it run every minute

root@pedro:/var/log# crontab -l 

*     *       *       *       *       /root/scripts/blockbadssh.sh

I know this is a dirty way of doing it and it is a good idea to have another pf rule that accept traffic from well known hosts so you do not get blocked because you failed a login.

My Nagios based op5 Monitor system discovered this directly and reported to me. I forgot to schedule this as planed downtime so I have to work with my processes .

This is how the test of pinging my host www.it-slav.net looks like:

 location                  result               min. rrt  avg. rrt  max. rrt 
 Santa Clara, U.S.A.       Okay                    190.9     192.3     193.8 
 Florida, U.S.A.           Okay                    162.3     163.3     164.6 
 New York, U.S.A.          Okay                    126.5     127.8     129.1 
 Austin1, U.S.A.           Okay                    172.6     173.2     174.2 
 Austin, U.S.A.            Okay                    171.4     172.0     173.0 
 Vancouver, Canada         Okay                    197.5     198.0     198.9 
 Amsterdam2, Netherlands   Okay                     49.9      50.5      51.2 
 San Francisco, U.S.A.     Okay                    224.9     227.9     231.2 
 Amsterdam3, Netherlands   Okay                     67.4      73.6      82.3 
 Chicago, U.S.A.           Okay                    140.6     141.5     142.2 
 Stockholm, Sweden         Okay                     32.2      32.8      34.0 
 London, United Kingdom    Okay                     62.5      63.1      64.8 
 Cologne, Germany          Okay                     80.6      86.7      93.2 
 Krakow, Poland            Okay                     82.2      83.6      86.0 
 Copenhagen, Denmark       Okay                     50.0      50.6      52.5 
 Amsterdam, Netherlands    Okay                     48.8      49.5      51.4 
 Madrid, Spain             Okay                     87.5      88.2      89.0 
 Munchen, Germany          Okay                     84.3      89.8      97.6 
 Lille, France             Okay                     67.9      69.9      74.2 
 Cagliari, Italy           Okay                     85.4      86.4      88.0 
 Groningen, Netherlands    Okay                     52.2      53.1      54.9 
 Sydney, Australia         Okay                    359.9     362.6     375.4 
 Hong Kong, China          Okay                    320.1     329.3     335.8 
 Zurich, Switzerland       Okay                     80.9      83.5      85.4 
 Nagano, Japan             Okay                    301.3     302.0     302.9 
 Antwerp, Belgium          Okay                     61.8      62.7      65.3 
 Singapore, Singapore      Okay                    349.3     355.0     359.4 
 Porto Alegre, Brazil      Okay                    309.8     314.3     321.2 
 Melbourne, Australia      Okay                    383.9     385.0     386.0 
 Mumbai, India             Okay                    198.6     199.5     202.0 
 Shanghai, China           Okay                    440.3     441.8     443.3 
 Haifa, Israel             Okay                    142.7     144.3     145.9 
 Auckland, New Zealand     Packets lost (10%)      375.7     378.3     384.6 
 Johannesburg, South AfricaOkay                    334.9     337.4     340.5 

But today I noticed that I’ve only got 1 mail so something must be wrong. I did send an email from my job to my private adress and got the email back with the following message:

<peter@it-slav.net>: cannot update mailbox /var/mail/peter for user peter.
    error writing message: File too large

After some troubleshooting I found the following in the postfix documentation:

mailbox_size_limit (default: 51200000)

The maximal size of any local(8) individual mailbox or maildir file, or zero (no limit). In fact, this limits the size of any file that is written to upon local delivery, including files written by external commands that are executed by the local(8) delivery agent.

This limit must not be smaller than the message size limit.

So I changed the mailbox_size_limit = 0 and now everything seems alright again.

Thanks once again for copying a winner.

For reference see my other blog about Copy Cat.

Now I found that a “new” doamin exist, it-slav.se.

According to whois it was registred Jan 2007

domain: it-slav.se
created: 2007-01-18
modified: 2008-06-17
expires: 2009-01-18

And it-slav.net
Record created: 31 MAY 2000
Record last changed: 31 MAR 2008
Record expires: 31 MAY 2017

So after seven years someone found it worth to copy a winner, thanks!!