Re: Nmap and xlogmaster

[Adam Shostack <adam () netect com>]

On Thu, Jan 28, 1999 at 05:41:04PM -0800, Max Vision wrote:

| Not that I would condone the use of your script above, but one way to at
| least limit scanning to just one host would be to change it to:
| tail /var/log/messages |grep -i "ssh connection atte"|awk '{print $10}'|\
| tail -1|xargs nmap -O -sS -p 22,25,53,80,139 >> /root/nmaplog

Why not link with libwrap, and use its execution to handle this?

not tested in /etc/hosts.allow
          sshd: ALL: (nmap -O -sS -p 22,25,53,80,139 %a >>...

Which loses many of the forks and all the 'got the wrong server' bugs?


Adam