1. Perl Programming Chia-Hung Tsai chiahung.na@csie.nctu.edu.tw Li-an Lee

2. Subject
Use perl to parse the files, ftp log, auth.log, and httpd-access.log
Show some analysis information in your DocumentRoot
Find out some bad guys’ IP and add the deny rules in your firewall

3. Prerequisite Firewall Ftp server Apache server Base on hwk1
You can use the FreeBSD default ftp server, ftpd, or use the others ftp server in the ports, like proftpd, pure-ftpd, etc.
Apache server
Build up a web server. You can use the apache1.3 or apache2 for your apache server

4. Detail
Ftp
Use perl to parse the ftp log, and show the rank of the client IP about the statistics of the total download flow on your DocumentRoot
If some guys’ total download flow over a threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot
auth.log
Use perl to parse the auth.log, and show the rank of the client IP about the density value of the guessing password times on your DocumentRoot
If some guys’ density value of the guessing password times are over the threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot

5. Detail (con’d) Apache DocumentRoot
Use perl to parse the httpd-access.log, and show the rank of the client IP about the access times on your DocumentRoot
If some guys’ access times are over the threshold, add the deny rules in your firewall rule, and also show the denied client IP on your DocumentRoot
DocumentRoot
Show your result about the statistics and denied IP to a static page
Put this static page on your DocumentRoot
The showing way of this page is depended on you, and just remember to include the statistics and denied IP

6. Due day
Before 4/10, you all must to and the title is like this, “[NA_HWK 蔡佳宏]”, and the content is your log files path, like “/var/log/httpd-access.log”
And 4/17 is the due day

7. Demo
Demo
For apache, TAs will use a script to fetch files on your apache server, maybe more than number of 10 thousands
For FTP, TAs will go to your ftp server to fetch a big file, so you must set your ftp threshold a lower value
For auth.log, TAs will be a bad guys to try your machines account and password, so you must set your auth density threshold a lower value
TAs will use the different IP to access your service, and connect to your DocumentRoot to observe your result on 4/18 and 4/19
If you have any question, you can post on the newsgroup “csie.course.netadm”, and then TAs or other students can help you to solve it