Perl Programming Chia-Hung Tsai chiahung.na@csie.nctu.edu.tw Li-an Lee lianlee.na@csie.nctu.edu.tw

Subject Use perl to parse the files, ftp log, auth.log, and httpd-access.log Show some analysis information in your DocumentRoot Find out some bad guys’ IP and add the deny rules in your firewall

Prerequisite Firewall Ftp server Apache server Base on hwk1 You can use the FreeBSD default ftp server, ftpd, or use the others ftp server in the ports, like proftpd, pure-ftpd, etc. Apache server Build up a web server. You can use the apache1.3 or apache2 for your apache server

Detail Ftp Use perl to parse the ftp log, and show the rank of the client IP about the statistics of the total download flow on your DocumentRoot If some guys’ total download flow over a threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot auth.log Use perl to parse the auth.log, and show the rank of the client IP about the density value of the guessing password times on your DocumentRoot If some guys’ density value of the guessing password times are over the threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot

Detail (con’d) Apache DocumentRoot Use perl to parse the httpd-access.log, and show the rank of the client IP about the access times on your DocumentRoot If some guys’ access times are over the threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot DocumentRoot Show your result about the statistics and denied IP to a static page Put this static page on your DocumentRoot The showing way of this page is depended on you, and just remember to include the statistics and denied IP

Due day Before 4/10, you all must email to chiahung.na@csie.nctu.edu.tw and the title is like this, “[NA_HWK2 9317561 蔡佳宏]”, and the content is your log files path, like “/var/log/httpd-access.log” And 4/17 is the due day

Demo Demo For apache, TAs will use a script to fetch files on your apache server, maybe more than number of 10 thousands For FTP, TAs will go to your ftp server to fetch a big file, so you must set your ftp threshold a lower value For auth.log, TAs will be a bad guys to try your machines account and password, so you must set your auth density threshold a lower value TAs will use the different IP to access your service, and connect to your DocumentRoot to observe your result on 4/18 and 4/19 If you have any question, you can post on the newsgroup “csie.course.netadm”, and then TAs or other students can help you to solve it