#!/usr/bin/env python3
#-*- coding:utf8 -*-
'''腳本對登錄VPN失敗次數超過5次的用戶進行鎖定'''
import time
import re
import os
file = open('/etc/openvpn/openvpn.log', 'r')
failname = {} #使用字典對登錄失敗用戶次數進行統計
def get_blackname(line):
 blackname = []
 e = r"\'([\s\S]*)\'"  #過濾出登錄失敗的用戶名
 fail_name = re.findall(e, line)
 for i in fail_name:
  if i not in failname:
   failname[i] = 1
  else:
   failname[i] += 1
  if failname[i] >= 5: #登錄失敗次數超過5次使用mysql_ban函數進行處理
   mysql_ban(i)    
   failname.clear()  #禁用后清空字典
#定義處理登錄失敗用戶處理函數
def mysql_ban(blackname):
 cmd = 'mysql -uroot -pmysql -h 127.0.0.1 -P 4045 -e ' \
   '"update vpnuser set active=0 where name=\'%s\'" vpn ' % blackname
 os.system(cmd)
while 1: #監控openvpn的日志文件
 where = file.tell()
 line = file.readline()
 if not line: 
  time.sleep(1)
  file.seek(where)
 elif 'AUTH-PAM' in line:
  get_blackname(line)

          

            
> /etc/openvpn/openvpn.log
mysql -uroot -pmysql -h 127.0.0.1 -P 4045 -e "update vpnuser set active=1 where active=0" vpn