Добрый день! более удобная альтернатива так называемого port knocking.
//определяем локальные переменные
:local sysname [/system identity get name];
:local sysver [/system package get routeros version];
:local sysreso [:sys reso get uptime];
//отдельный журнал лога для уменьшения нагрузки на слабых микротах
:loc LoginList LoginSecurity;
# список плохишей
:loc LB LoginSecurity-;
# список хороших
:loc LA LoginSecurity+;
:loc ESMTP [:resolve "smtp.yandex.ru"];
:loc EUSER login@ya.ru;
:loc EPASS password;
:loc EPORT 587;
/if ([/tool/e-m/g address]=$ESMTP) do={} else={/tool/e-m/set address=$ESMTP;};/if ([/tool/e-m/g from]=$EUSER) do={} else={/tool/e-m/set from=$EUSER;};/if ([/tool/e-m/g port]=$EPORT) do={} else={/tool/e-m/set port=$EPORT;};/if ([/tool/e-m/g user]=$EUSER) do={} else={/tool/e-m/set user=$EUSER;};/if ([/tool/e-m/g password]=$EPASS) do={} else={/tool/e-m/set password=$EPASS;};/if ([/tool/e-m/g tls]="starttls") do={} else={/tool/e-m/set tls="starttls";};
/if ([/sys logg action/find name=$LoginList]="") do={/sys logg action add memory-lines=150 name=$LoginList target=memory;/sys logg add action=$LoginList topics=system,error,critical prefix="$sysnameLogin";/system logging add action=$LoginList topics=system,account,inf prefix="$sysnameLogin";};
:foreach line in=[/log find buffer=$LoginList message~"login failure"] do={:do {:loc message [/log get $line message];:loc LoginLogin [:pick "$message" [:put ([:find "$message" "user" -1]+5)] [:put ([:find "$message" "from" -1]-1)]];:loc LoginIP [:pick "$message" [:put ([:find "$message" "from" -1]+5)] [:put ([:find "$message" "via" -1]-1)]];:delay 1;/if ([/ip fir address-list find address=$LoginIP list=$LB]) do={ :log info "IP exits $LoginIP $LoginLogin"; } else={ :ip f a a address=$LoginIP list=$LB timeout=1d comment=$LoginLogin;/tool e-mail send to="kalugin66@ya.ru" subject="$sysname $sysver $sysreso LoginSecurity" body="$LB $LoginIP"; };/log error "[$LB] $LoginIP $LoginLogin";}};:foreach line in=[/log find buffer=$LoginList message~"logged"] do={:do {:loc message [/log get $line message];:loc LoginLogin [:pick "$message" [:put ([:find "$message" "user" -1]+5)] [:put ([:find "$message" "logged" -1]-1)]];:loc LoginIP [:pick "$message" [:put ([:find "$message" "from" -1]+5)] [:put ([:find "$message" "via" -1]-1)]];:delay 1;/if ([/ip fir address-list find address=$LoginIP list=$LA]) do={ /ip f a a address=$LoginIP list=$LA comment=$LoginLogin;/tool e-mail send to="kalugin66@ya.ru" subject="$sysname $sysver $sysreso LoginSecurity" body="$LA $LoginIP"; };/log error "[$LA] $LoginIP";}};
:sy lo ac set $LoginList memory-lines=1;:sy lo ac set $LoginList memory-lines=150;:log info "Good Finish LoginSecurity";
