Bashscripts.org

#!/bin/bash
###
# My simple cracker detector and banner script
# runs from crontab every 5 minutes
# compares the last 100 lines of the vsftp.log to find
# matches of 5 subsequent fails within those last 100 lines and activates a
# dynamic block in iptables (not a permanent rule)
###

tail -100

tail -100 vsftp.log | grep 'FAIL LOGIN' | awk '{print $12}' | sort > /tmp/failedips
# read in /tmp/failedips and compare each entry to the next keeping count to 5 and
# banning that IP if the count of 5 is reached for a single IP address.

#!/bin/bash
########################################
##
##  Extra-simple brute force detection
##  script. Use at your own risk!
##
########################################

########################################
##
##  Set Variables here!
##
########################################

LOGFILE="/var/log/secure"
BLOCKLIST="/root/bin/firewall/block_list"
TMPFILE="/tmp/punkd.log"
MAX_TRY="10"
DELAY="20"
EMAIL="email@domain.com" # insert email address here for notifications
IPTABLES="/sbin/iptables"
TRUSTED_IPS="x.x.x.x/32" # insert trusted IPs here

########################################
##
##  First thing we need to do is clear
##  any existing rules, and insert ours
##
########################################


## Reset the firewall...
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F

## Open it up for the good guys
for trusted_ips in $TRUSTED_IPS; do
  $IPTABLES -A INPUT -s $trusted_ips -j ACCEPT
done

## Shut it down for the bad guys
for blocked_ip in $(cat $BLOCKLIST); do
  $IPTABLES -A INPUT -s $blocked_ip -j DROP
done


########################################
##
##  Here we use a "while" loop to keep
##  things rolling...
##
########################################

while true; do

########################################
##
##  Count the failures and make a temp
##  file in the format of:
##  <COUNT> <IPADDR>
##
##  May be able to eliminate temp file
##  working on that...
##
########################################

grep -E "sshd.+Failed" $LOGFILE |
grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' |
sort | uniq -c > $TMPFILE


########################################
##
##  Use 'exec' to direct the output of
##  the tmpfile to 'read' in our next
##  loop
##
########################################

exec < $TMPFILE


########################################
##
##  Use 'read' to break out the ip and
##  the number of occurrences, check
##  for existence in block list, and
##  block if necessary
##
########################################

while read COUNT IPADDR ; do
  ## Check to see if the IP is already in the list
  PRE=$(grep $IPADDR $BLOCKLIST)

  ## If it's not in the list...
  if [ -z "$PRE" ]; then

    ## And it occurs greater than or equal to $MAX_TRY times...
    if [ "$COUNT" -ge "$MAX_TRY" ]; then

      ## We drop it into the block list...
      echo $IPADDR >> $BLOCKLIST

      ## Reset the firewall...
      $IPTABLES -P INPUT ACCEPT
      $IPTABLES -P OUTPUT ACCEPT
      $IPTABLES -F

      ## Open it up for the good guys
      for trusted_ips in $TRUSTED_IPS; do
        $IPTABLES -A INPUT -s $trusted_ips -j ACCEPT
      done

      ## Shut it down for the bad guys
      for blocked_ip in $(cat $BLOCKLIST); do
        $IPTABLES -A INPUT -s $blocked_ip -j DROP
      done

      ## Email ourselves...
      echo "$IPADDR ($COUNT failures) is being added to the list" |
      mail $EMAIL -s "Auto-punkd - $IPADDR"

      ## And make a log entry.
      logger "$IPADDR ($COUNT failures) is being Auto-punkd"

    fi
  fi
done

########################################
##
## Sleep for $DELAY seconds, start over
##
########################################
sleep $DELAY
done