views:

15

answers:

1

I have the following line in my proftpd log (line 78 to be precise)

Deny from 1.2.3.4

I also have a script which rolls through my logs for people using brute force attacks and then stores their IP (ready for a black listing). What i'm struggling with is inserting (presume with sed) at the end of that specific line - this is what I've got so far:

sed "77i3.4.5.6" /opt/etc/proftpd.conf >> /opt/etc/proftpd.conf

Now one would presume this would work perfectly, however it actually does the following (lines 77 through 78):

3.4.5.6
Deny from 1.2.3.4

I suspect this is due to my dated version of sed, are there any other ways of acheiving the same thing? Also the >> causes the config to be duplicated at the end of the fole (again i'm sure this is a limitation of my version of sed). This is running a homebrew linux kernel on my nas. Sed options below:

root@NAS:~# sed BusyBox v1.7.0 (2009-04-29 19:12:57 JST) multi-call binary

Usage: sed [-efinr] pattern [files...]

Options: -e script Add the script to the commands to be executed -f scriptfile Add script-file contents to the commands to be executed -i Edit files in-place -n Suppress automatic printing of pattern space -r Use extended regular expression syntax

If no -e or -f is given, the first non-option argument is taken as the sed script to interpret. All remaining arguments are names of input files; if no input files are specified, then the standard input is read. Source files will not be modified unless -i option is given.

Cheers for your help guys.

A: 

This has nothing to do with the version of sed; this is just plain old Doing It Wrong.

sed -i '77s/$/,3.4.5.6/' /opt/etc/proftpd.conf
Ignacio Vazquez-Abrams
You bloody smart arse, thanks. Would you mind explaining this a bit? Is it just a case of a search on line 77 and then replaching '$' (presume this means nothing) with back ticked IP address?
keeer
`$` is the end of the string/line. So this basically just appends the address to the end of line 77. Also, `s` is substitute, not search.
Ignacio Vazquez-Abrams