To test multiple variables x, y, z against a value in Python, use the expression value in {x, y, z}. Checking membership in a set has constant runtime complexity. Thus, this is the most efficient way to test multiple variables against a value.

Here’s the code:

Exercise: Add a fourth variable and run the modified code!

---

In this article, you’ll learn about an interesting problem in programming. Interesting because a quick glance could give us a feeling of this problem being simple. However, diving into it can help us learn some fundamentals about Boolean operators and some data types in a way we might not have thought about earlier. In fact, you could find yourself in this situation if you’re a beginner. We will try and explore some solutions to this problem using Python taking into consideration three approaches.

• The Incorrect Approach
• The Correct Approach
• The Best Approach

Let’s see some code walkthrough to understand it.

Doing It The Wrong Way — The Incorrect Approach

Let’s consider the above lines of code. We have three variables, x = 0, y = 1 and z = 3 and want to print a list, “list1” as output which checks at line 9, 11, 13 and 15 respectively, if either of x, y or z equals to 0, 1, 2, or 3 and append to our output list – list1, the values, c, d, e, and f based on the output condition.

Pause for a moment, and observe. What should be the output for the above lines of code? Now run the above code snippet. If you were expecting the output – [‘c’, ‘d’, ‘f’], read along carefully.

Let’s find out what is happening with our code. To understand it clearly, we must appreciate a few things first. The logical operators in Python do not work in a way you would expect them to work in English. For instance, let us look at line 9 of the code snippet.

From Python documentation (Boolean operations), the expression “x or y” first evaluates x. If x is true, its value is returned. Otherwise, y is evaluated, and the resulting value is returned.

The second point to note here is about operator precedence. The “or” operator has lower precedence than “==” operator, and hence equality is evaluated first.

The line number 9 returns “1” (True) as output. So line number 9 and 10 simplifies to:

Similarly, line 11, 13, and 15 each return 1 as output and hence (therefore) “d”, “e” and “f” gets appended to the list. Below code snippet shows the output for all the conditions individually:

Operations and built-in functions that have a Boolean result always return 0 or False for a false and 1 or True for true, unless otherwise stated. Thus our final output to code snippet in fig1 returns [“c”, “d”, “e”, “f”]

Doing It The Right Way — The Correct Approach

Now we build upon our mistakes above and look at a solution that should give us the expected output. Let’s modify the above code snippet a little and see how it changes the expected output:

The difference is evident here as we use the statement “x == 0 or y == 0 or z == 0” instead of “x or y or z == 0”. In this case, each variable here i.e. x, y, z are checked for equivalence one after the other and if the condition satisfies, the corresponding alphabet i.e c, d, e, f is appended to our list 1 respectively. Run the above code and check the output.

Doing It The Better Way: A Better Approach

With Python, we get myriads of collection/sequence data types and some in-built keywords that we can work with. The original idea of different collection/sequence data types and the keywords available for our use is to simplify how we can create a collection/sequence of data and access them based on the problem statement we are dealing with. We will check two data structures – Tuples and Sets, which bring in a good use case for the scenario that we are dealing with.

The “in” keyword can be used along with sequences like lists, sets, and tuples. It returns True or False based on whether the operand on the left is found or not in the sequence. Let’s check out the code snippet below:

Using Tuples to Do it Better:

In this case, we define variables x, y, and z and then check for the specific value membership with tuples in the above case. Hence, on line 9 we check, 0 to be in the tuple (0, 1, 3), which is a membership check, and if the condition is True, we append alphabet “c” to our list1. Then the membership check is done for values 1, 2, and 3, respectively, and based on whether the condition is True or False, the respective alphabet values of “c”, “d”, “e”, “f” are appended to our list1.

To clarify further, on line 9 we get the output as True and hence “c” is appended to list1 whereas, on line 13, where we check for membership of 2 in the tuple (0, 1, 3), the condition is False and hence “e” is not appended to list1.

Using Sets to Do it Better:

Here’s the code for easier copy&pasting:

x = 0

y = 1

z = 3 list1 = [] if 0 in {x, y, z}: list1.append('c')

if 0 in {x, y, z}: list1.append('d')

if 0 in {x, y, z}: list1.append('e')

if 0 in {x, y, z}: list1.append('f') print(list1)

# ['c', 'd', 'e', 'f']

This solution is the same as the above solution with Tuples. The only difference is the data structure that we use here. With this solution we perform membership checks using Sets and based on the condition being True or False, appending the respective alphabet “c”, “d”, “e”, “f” to list1.

I hope this explanation helps. Try and get your hands dirty running the above code snippets, and you will have a better understanding by the time you are done.

Author

This article is contributed by Finxter Abhigyan Ojha. You can find his Upwork profile here.

Late last week CryTek released their development roadmap for the future of the CryEngine game engine.  Sadly it seems the next major release has been pushed back into 2021, although the feature list in the next version is pretty impressive.

Details from the CryEngine blog:

Mobile Support and Next-Generation Hardware: We’re working with Google and ARM to bring CRYENGINE to mobile and, of course, we‘re preparing CRYENGINE for upcoming hardware releases. We can’t wait to see what you can do with CRYENGINE on mobile, and, of course, we’re excited about seeing your CRYENGINE games running on more powerful consoles. Find out more about our mobile plan and register for our beta.

Scaleform 4 Update: CRYENGINE was previously limited to Scaleform 3, which meant that only older software and ActionScript 2 were viable methods for creating engaging UI. In the future, we are including Scaleform 4, which means you’ll be able to use both Adobe Animate and ActionScript 3.

Visual Scripting System: We’re as excited about this as you are. Almost all of our teams are working on and integrating with this new feature at the moment. As part of this process, we’re also undertaking a clean-up and separation of other systems, such as the Generic Reflection and Messaging systems.

Razer Chroma RGB Support: We’ve partnered with Razer to enable the Razer Chroma RGB effects API in CRYENGINE. This allows you to enhance the atmosphere and ambiance of your player’s experience by lighting up Razer Chroma-enabled hardware devices as the game is played.

More details, as well as future release features are available on the roadmap here.  They are running an early private beta available here.

GameDev News CryEngine

---

If you run a server with a public-facing SSH access, you might have experienced malicious login attempts. This article shows how to use two utilities to keep the intruder out of our systems.

To protect against repeated ssh login attempts, we’ll look at fail2ban. And if you don’t travel much, and perhaps stay in one or two countries, you can configure firewalld to only allow access from the countries you choose.

First let’s work through a little terminology for those not familiar with the various applications we’ll need to make this work:

fail2ban: Daemon to ban hosts that cause multiple authentication errors.

fail2ban will monitor the SystemD journal to look for failed authentication attempts for whichever jails have been enabled. After the number of failed attempts specified it will add a firewall rule to block that specific IP address for an amount of time configured.

firewalld: A firewall daemon with D-Bus interface providing a dynamic firewall.

Unless you’ve manually decided to use traditional iptables, you’re already using firewalld on all supported releases of Fedora and CentOS.

Assumptions

• The host system has an internet connection and is either fully exposed directly, through a DMZ (both REALLY bad ideas unless you know what you’re doing), or has a port being forwarded to it from a router.
• While most of this might apply to other systems, this article assumes a current version of Fedora (31 and up) or RHEL/CentOS 8. On CentOS you must enable the Fedora EPEL repo with
  
  sudo dnf install epel-release

Install & Configuration

Fail2Ban

More than likely whichever FirewallD zone is set already allows SSH access but the sshd service itself is not enabled by default. To start it manually and without permanently enabling on boot:

$ sudo systemctl start sshd

Or to start and enable on boot:

$ sudo systemctl enable --now sshd

The next step is to install, configure, and enable fail2ban. As usual the install can be done from the command line:

$ sudo dnf install fail2ban

Once installed the next step is to configure a jail (a service you want to monitor and ban at whatever thresholds you’ve set). By default IPs are banned for 1 hour (which is not near long enough). The best practice is to override the system defaults using *.local files instead of directly modifying the *.config files. If we look at my jail.local we see:

# cat /etc/fail2ban/jail.local

[DEFAULT] # "bantime" is the number of seconds that a host is banned.

bantime = 1d # A host is banned if it has generated "maxretry" during the last "findtime"

findtime = 1h # "maxretry" is the number of failures before a host get banned.

maxretry = 5

Turning this into plain language, after 5 attempts within the last hour the IP will be blocked for 1 day. There’s also options for increasing the ban time for IPs that get banned multiple times, but that’s the subject for another article.

The next step is to configure a jail. In this tutorial sshd is shown but the steps are more or less the same for other services. Create a configuration file inside /etc/fail2ban/jail.d. Here’s mine:

# cat /etc/fail2ban/jail.d/sshd.local

[sshd]

enabled = true

It’s that simple! A lot of the configuration is already handled within the package built for Fedora (Hint: I’m the current maintainer). Next enable and start the fail2ban service.

$ sudo systemctl enable --now fail2ban

Hopefully there were not any immediate errors, if not, check the status of fail2ban using the following command:

$ sudo systemctl status fail2ban

If it started without errors it should look something like this:

$ systemctl status fail2ban

● fail2ban.service - Fail2Ban Service

Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; disabled; vendor preset: disabled)

Active: active (running) since Tue 2020-06-16 07:57:40 CDT; 5s ago

Docs: man:fail2ban(1)

Process: 11230 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)

Main PID: 11235 (f2b/server)

Tasks: 5 (limit: 4630)

Memory: 12.7M

CPU: 109ms

CGroup: /system.slice/fail2ban.service

└─11235 /usr/bin/python3 -s /usr/bin/fail2ban-server -xf start

Jun 16 07:57:40 localhost.localdomain systemd[1]: Starting Fail2Ban Service…

Jun 16 07:57:40 localhost.localdomain systemd[1]: Started Fail2Ban Service.

Jun 16 07:57:41 localhost.localdomain fail2ban-server[11235]: Server ready

If recently started, fail2ban is unlikely to show anything interesting going on just yet but to check the status of fail2ban and make sure the jail is enabled enter:

$ sudo fail2ban-client status

Status

|- Number of jail:	1

`- Jail list:	sshd

And the high level status of the sshd jail is shown. If multiple jails were enabled they would show up here.

To check the detailed status a jail, just add the jail to the previous command. Here’s the output from my system which has been running for a while. I have removed the banned IPs from the output:

$ sudo fail2ban-client status sshd

Status for the jail: sshd

|- Filter

| |- Currently failed:	8

| |- Total failed:	4399

| `- Journal matches:	_SYSTEMD_UNIT=sshd.service + _COMM=sshd

`- Actions |- Currently banned:	101 |- Total banned:	684 `- Banned IP list: ...

Monitoring the fail2ban log file for intrusion attempts can be achieved by “tailing” the log:

$ sudo tail -f /var/log/fail2ban.log

Tail is a nice little command line utility which by default shows the last 10 lines of a file. Adding the “-f” tells it to follow the file which is a great way to watch a file that’s still being written to.

Since the output has real IPs in it, a sample won’t be provided but it’s pretty human readable. The INFO lines will usually be attempts at a login. If enough attempts are made from a specific IP address you will see a NOTICE line showing an IP address was banned. After the ban time has been reached you will see an NOTICE unban line.

Lookout for several WARNING lines. Most often this happens when a ban is added but fail2ban finds the IP address already in its ban database, which means banning may not be working correctly. If recently installed the fail2ban package it should be setup for FirewallD rich rules. The package was only switched from “ipset” to “rich rules” as of fail2ban-0.11.1-6 so if you have an older install of fail2ban it may still be trying to use the ipset method which utilizes legacy iptables and is not very reliable.

FirewallD Configuration

Reactive or Proactive?

There are two strategies that can be used either separately or together. Reactive or proactive permanent blacklisting of individual IP address or subnets based on country of origin.

For the reactive approach once fail2ban has been running for a while it’s a good idea to take a look at how “bad is bad” by running sudo fail2ban-client status sshd again. There most likely will be many banned IP addresses. Just pick one and try running whois on it. There can be quite a bit of interesting information in the output but for this method, only the country of origin is of importance. To keep things simple, let’s filter out everything but the country.

For this example a few well known domain names will be used:

$ whois google.com | grep -i country
Registrant Country: US
Admin Country: US
Tech Country: US

$ whois rpmfusion.org | grep -i country
Registrant Country: FR

$ whois aliexpress.com | grep -i country
Registrant Country: CN

The reason for the grep -i is to make grep non-case sensitive while most entries use “Country”, some are in all lower case so this method matches regardless.

Now that the country of origin of an intrusion attempt is known the question is, “Does anyone from that country have a legitimate reason to connect to this computer?” If the answer is NO, then it should be acceptable to block the entire country.

Functionally the proactive approach it not very different from the reactive approach, however, there are countries from which intrusion attempts are very common. If the system neither resides in one of those countries, nor has any customers originating from them, then why not add them to the blacklist now rather than waiting?

Blacklisting Script and Configuration

So how do you do that? With FirewallD ipsets. I developed the following script to automate the process as much as possible:

#!/bin/bash

# Based on the below article

# https://www.linode.com/community/questio...-blacklist # Source the blacklisted countries from the configuration file

. /etc/blacklist-by-country # Create a temporary working directory

ipdeny_tmp_dir=$(mktemp -d -t blacklist-XXXXXXXXXX)

pushd $ipdeny_tmp_dir # Download the latest network addresses by country file

curl -LO http://www.ipdeny.com/ipblocks/data/coun...nes.tar.gz

tar xf all-zones.tar.gz # For updates, remove the ipset blacklist and recreate

if firewall-cmd -q --zone=drop --query-source=ipset:blacklist; then firewall-cmd -q --permanent --delete-ipset=blacklist

fi # Create the ipset blacklist which accepts both IP addresses and networks

firewall-cmd -q --permanent --new-ipset=blacklist --type=hash:net \ --option=family=inet --option=hashsize=4096 --option=maxelem=200000 \ --set-description="An ipset list of networks or ips to be dropped." # Add the address ranges by country per ipdeny.com to the blacklist

for country in $countries; do firewall-cmd -q --permanent --ipset=blacklist \ --add-entries-from-file=./$country.zone && \ echo "Added $country to blacklist ipset."

done # Block individual IPs if the configuration file exists and is not empty

if [ -s "/etc/blacklist-by-ip" ]; then echo "Adding IPs blacklists." firewall-cmd -q --permanent --ipset=blacklist \ --add-entries-from-file=/etc/blacklist-by-ip && \ echo "Added IPs to blacklist ipset."

fi # Add the blacklist ipset to the drop zone if not already setup

if firewall-cmd -q --zone=drop --query-source=ipset:blacklist; then echo "Blacklist already in firewalld drop zone."

else echo "Adding ipset blacklist to firewalld drop zone." firewall-cmd --permanent --zone=drop --add-source=ipset:blacklist

fi firewall-cmd -q --reload popd

rm -rf $ipdeny_tmp_dir

This should be installed to /usr/local/sbin and don’t forget to make it executable!

$ sudo chmod +x /usr/local/sbin/firewalld-blacklist

Then create a configure file: /etc/blacklist-by-country:

# Which countries should be blocked?

# Use the two letter designation separated by a space.

countries=""

And another configuration file /etc/blacklist-by-ip, which is just one IP per line without any additional formatting.

For this example 10 random countries were selected from the ipdeny zones:

# ls | shuf -n 10 | sed "s/\.zone//g" | tr '\n' ' '

nl ee ie pk is sv na om gp bn

Now as long as at least one country has been added to the config file it’s ready to run!

$ sudo firewalld-blacklist % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed

100 142 100 142 0 0 1014 0 --:--:-- --:--:-- --:--:-- 1014

100 662k 100 662k 0 0 989k 0 --:--:-- --:--:-- --:--:-- 989k

Added nl to blacklist ipset.

Added ee to blacklist ipset.

Added ie to blacklist ipset.

Added pk to blacklist ipset.

Added is to blacklist ipset.

Added sv to blacklist ipset.

Added na to blacklist ipset.

Added om to blacklist ipset.

Added gp to blacklist ipset.

Added bn to blacklist ipset.

Adding ipset blacklist to firewalld drop zone.

success

To verify that the firewalld blacklist was successful, check the drop zone and blacklist ipset:

$ sudo firewall-cmd --info-zone=drop

drop (active) target: DROP icmp-block-inversion: no interfaces: sources: ipset:blacklist services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: $ sudo firewall-cmd --info-ipset=blacklist | less

blacklist type: hash:net options: family=inet hashsize=4096 maxelem=200000 entries: 

The second command will output all of the subnets that were added based on the countries blocked and can be quite lengthy.

So now what do I do?

While it will be a good idea to monitor things more frequently at the beginning, over time the number of intrusion attempts should decline as the blacklist grows. Then the goal should be maintenance rather than active monitoring.

To this end I created a SystemD service file and timer so that on a monthly basis the by country subnets maintained by ipdeny are refreshed. In fact everything discussed here can be downloaded from my pagure.io project:

https://pagure.io/firewalld-blacklist

Aren’t you glad you read the whole article? Now just download the service file and timer to /etc/systemd/system/ and enable the timer:

$ sudo systemctl daemon-reload

$ sudo systemctl enable --now firewalld-blacklist.timer

Nintendo Life

The day after EA Play Live, in an interview with GamesIndustry.biz, EA’s Chief Studios Officer Laura Miele spoke about how the third-party publisher wanted to make its games more widely available moving forward.

“We want players to be able to play our games where they want to, which is why we’re bringing more games to more platforms including Stadia, Steam, Switch and Epic Game Store.”

The Switch is obviously a big part of these plans – with EA noting how it would be bringing seven games to Nintendo’s hybrid platform over the next 12 months during its annual presentation.

In recent times, the publishing giant has also returned to Valve’s platform Steam, after dropping support for it in 2011 in favour of its own digital platform, Origin.

Part of its plan to expand is by making a “big push” on cross-play, to make titles like Apex Legends more accessible – with Miele explaining how playing games should be about connecting with others, regardless of platform, and that hardware is not necessarily a barrier nowadays.

“We’re also making a big push on cross-play, because we know a fundamental motivation in playing games is about connecting with friends and family who may choose to play on a different console or platform. The ecosystem in which we are operating has changed for the better, and we want to be everywhere players are.”

Miele also mentioned how EA was “listening” to its fans, citing the Skate 4 announcement as an example.

What EA series would you like to see show up on the Nintendo Switch in the future? Tell us down below.

On Friday, Nintendo announced it would be revealing the next fighter for Super Smash Bros. Ultimate in a broadcast next week.

The “roughly 35-minute-long” event will take place on place on Monday, 22nd June at 3pm BST / 4pm CEST / 7am PT / 10am ET and will be hosted by the series’ director Masahiro Sakurai.

What you might not know, though, is it will be taking place in Sakurai’s very own home. This was confirmed in a tweet by the Japanese Smash Twitter account. Nintendo Life contributor Robert Sephazon also translated Sakurai’s own tweet about it:

“Did I really do it? Yes! I filmed at home. This time there was no filmography staff, so I’m controlling the camera alone.”

So get ready for a special Masahiro Sakurai home broadcast!

The next fighter – based on Nintendo’s latest IP, ARMS – was first announced way back in March. This fighter will also be the first star to appear in the second Fighters Pass and is expected to arrive at some point this month – with any luck it’s not long after the presentation

Are you looking forward to tuning into Sakurai’s home broadcast – let us know down below.