From nobody@FreeBSD.org  Sun Feb 11 14:00:26 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id CC16716A400
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 11 Feb 2007 14:00:26 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id BB58A13C47E
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 11 Feb 2007 14:00:26 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l1BE0QDG007823
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 11 Feb 2007 14:00:26 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l1BE0Q3F007822;
	Sun, 11 Feb 2007 14:00:26 GMT
	(envelope-from nobody)
Message-Id: <200702111400.l1BE0Q3F007822@www.freebsd.org>
Date: Sun, 11 Feb 2007 14:00:26 GMT
From: Tim<cyberlord@cyber-wizard.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: cut utility reads off by one place when day (date) is a double digit
X-Send-Pr-Version: www-3.0

>Number:         109047
>Category:       bin
>Synopsis:       cut(1) reads off by one place when day (date) is a double digit
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Feb 11 14:10:05 GMT 2007
>Closed-Date:    Mon Feb 12 15:58:31 GMT 2007
>Last-Modified:  Mon Feb 12 16:00:16 GMT 2007
>Originator:     Tim
>Release:        FreeBSD 5.4-RELEASE
>Organization:
n/a
>Environment:
FreeBSD hercmud.net 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Sun Sep 18 21:04:28 UTC 2005
>Description:
When the day (date) reaches double digits the cut utility/program
somehow reads the field as off by one. I'm not sure if this is a problem
with the auth.log or with cut itself but my bet is on cut. 

I have a script that reads auth.log and filters out bad login attempts
and writes to hosts.allow. When the date reaches double digits I have to
adjust my script accordingly.

Here is the offending line in my script.

for IP in `grep sshd /var/log/auth.log|grep "illegal user"|cut -d " " -f14` 0.0.0.0; do

I have to change the -f14 to -f13 during double digit days and then again
when the month rolls over set it back to -f14.

Not only is having to edit the script twice a month annoying, it shortens
the length of time one can deny a host that attempts login during the
single digit days. Once I adjust the offending line to compensate for the
double digit day it incorrectly reads the single digit day lines.
>How-To-Repeat:

>Fix:
Run the following script on single and double days:

#!/usr/local/bin/bash
LAST_IP=0.0.0.0
COUNT=1

# Set MAXCOUNT to the maximum failures allowed before blacklisting
# Remember though, the script gets run once per minute from cron, so
# tecnically the hacker has about 1 minute at maximum to attempt login
# and that really is the limiting factor in limiting the length of the attack
MAXCOUNT=5

for IP in `grep sshd /var/log/auth.log|grep "illegal user"|cut -d " " -f14` 0.0.0.0; do
  if [ ${LAST_IP} == ${IP} ]; then
     let COUNT=${COUNT}+1
  else
     if [ ${COUNT} -ge ${MAXCOUNT} ]; then
#        echo "sshd: ${LAST_IP} : deny"
# Now echo some output for crontab to email to you once in a while - comment it out if you don't care
        echo ${COUNT} attempts from ${LAST_IP}
    fi
     LAST_IP=${IP}
     COUNT=1
  fi
done
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: kris 
State-Changed-When: Mon Feb 12 15:58:01 UTC 2007 
State-Changed-Why:  
Not a bug, this is just how cut(1) works. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=109047 

From: Kris Kennaway <kris@obsecurity.org>
To: Tim <cyberlord@cyber-wizard.com>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: misc/109047: cut utility reads off by one place when day (date) is a double digit
Date: Mon, 12 Feb 2007 10:57:02 -0500

 On Sun, Feb 11, 2007 at 02:00:26PM +0000, Tim wrote:
 
 > When the day (date) reaches double digits the cut utility/program somehow reads the field as off by one. I'm not sure if this is a problem with the auth.log or with cut itself but my bet is on cut. 
 > 
 > I have a script that reads auth.log and filters out bad login attempts and writes to hosts.allow. When the date reaches double digits I have to adjust my script accordingly.
 > 
 > Here is the offending line in my script.
 > 
 > for IP in `grep sshd /var/log/auth.log|grep "illegal user"|cut -d " " -f14` 0.0.0.0; do
 > 
 > I have to change the -f14 to -f13 during double digit days and then again when the month rolls over set it back to -f14.
 
 I think this is a bug in your expectation of how to use cut :-)
 
 As you have found (also how it is documented to work), cut treats each
 instance of the delimiter (" ") as separating a new field, so when
 spacing changes so does its idea of field counting.  This is by
 design.
 
 If you want to extract a word without worrying about whitespace, use a
 different tool, a convenient one is
 
 awk '{print $14}'
 
 Kris
>Unformatted:
