uetoaya的部落格

#!/bin/sh
# 2005/01/15 ver4  by Boolean@HC Email:boolean@xx
# 2009/10/06 ver5  by Boolean Email:boolean@boolean.twbbs.org
#
# 檔案存放的路徑
basedir="/usr/local/virus/iptables"

# log 存放的地方
sshlog="/var/log/secure"
httplog="/var/log/httpd/error_log"

# mail for
mailfor="boolean"

# 登入錯誤訊息
faildMsg="sshd.*Failed password"
faildMsgInvalid="sshd.*Failed password for invalid user"

# 登入幾次失敗　就擋掉
loginCountFail=3

#定義白名單. 現在已從sshd抓到的block名單,目前firewall的抵擋名單
nodenyip="$basedir/wip.txt"
sshd_block="$basedir/sshd_block_ip_now"
httpd_block="$basedir/httpd_block_ip_now"
block_ip="$basedir/block_ip"
tmp_sshd="/tmp/sshd"
tmp_httpd="/tmp/httpd"
denyfile="$basedir/iptables.deny"

#先抓sshd錯誤IP,灌入block名單
cat "$sshlog" | grep "sshd.*Failed password for" | grep -v "invalid" > /tmp/ssh_tmp.log
cat "$sshlog" | grep "sshd.*Failed password for invalid user" > /tmp/ssh_tmp2.log
cat "$httplog" | grep "File does not exist:" > /tmp/httpd_tmp.log
cat /tmp/httpd_tmp.log | cut -d " " -f8 | cut -d "]" -f1 > $tmp_httpd
cat /tmp/ssh_tmp.log | cut -d " " -f11 > $tmp_sshd
cat /tmp/ssh_tmp.log | cut -d " " -f12 >> $tmp_sshd
cat /tmp/ssh_tmp2.log | cut -d " " -f14 >> $tmp_sshd

#順便抓取 secure.1 ,
declare -i lognumber=1
for (( m=1 ; mdo
     if [ -f "$sshlog.$m" ]; then
      cat "$sshlog.$m" | grep "sshd.*Failed password for" | grep -v "invalid" >> /tmp/ssh_tmp.log
      cat "$sshlog.$m" | grep "sshd.*Failed password for invalid user" >> /tmp/ssh_tmp2.log
      cat /tmp/ssh_tmp.log | cut -d " " -f11 >> $tmp_sshd
      cat /tmp/ssh_tmp.log | cut -d " " -f12 >> $tmp_sshd
      cat /tmp/ssh_tmp2.log | cut -d " " -f14 >> $tmp_sshd
     else
      echo "檔案 $sshlog.$m 並不存在 !!!!"
     fi
    if [ -f "$httplog.$m" ]; then
      cat "$httplog.$m" | grep "File does not exist:" >> /tmp/httpd_tmp.log
       cat /tmp/httpd_tmp.log | cut -d " " -f8 | cut -d "]" -f1 >> $tmp_httpd
    else
      echo "檔案 $httplog.$m 並不存在 !!!!"
     fi

done

#SSHD section:利用for 迴圈去跑 drop ip , if 失敗次數小於3次
number_sshd=`cat $tmp_sshd | sort | uniq`
for ip in $number_sshd ;
do
  # 計算此IP登入幾次失敗
  count=`cat $tmp_sshd | grep "$ip" | wc -l`
  # 如果登入失敗次數大於 預設值 則執行  drop
    if [ "$count" -gt "$loginCountFail" ] ; then
       touch "$sshd_block"
       echo "$ip" >> "$sshd_block"
    fi
done

#HTTPD section:利用for 迴圈去跑 drop ip , if 失敗次數小於3次
number_httpd=`cat $tmp_httpd | sort | uniq`
for ip in $number_httpd ;
do
  # 計算此IP登入幾次失敗
  count=`cat $tmp_httpd | grep "$ip" | wc -l`
  # 如果登入失敗次數大於 預設值 則執行  drop
    if [ "$count" -gt "$loginCountFail" ] ; then
       touch "$httpd_block"
       echo "$ip" >> "$httpd_block"
    fi
done

#抓取目前已抵擋名單
if [ -f "$denyfile" ];then
   cat $denyfile | cut -d " " -f 7 >> $block_ip
   rm -rf $denyfile
  else
   echo "不存在 $denyfile ,Script會依需要自動建立"
fi
cat $sshd_block | sort | uniq > /tmp/ip
cat $httpd_block | sort | uniq >> /tmp/ip
cat $block_ip | sort | uniq >> /tmp/ip
cat /tmp/ip | sort | uniq > $block_ip
target=`cat $block_ip`
if [ "$target" = "" ]; then
   echo "目前沒有添加需要被阻擋IP的需要"
else
for i in $target ;
do
target1=`cat $nodenyip | grep $i`
   if [ "$target1" = "" ]; then
      if [ -f "$denyfile" ]; then
      echo "/sbin/iptables -A INPUT -i "'$EXTIF'" -s $i -j DROP #auto" >> $denyfile
      else
      echo "/sbin/iptables -A INPUT -i "'$EXTIF'" -s $i -j DROP #auto" > $denyfile
      fi
      echo ">IP: $i Add to $denyfile"
    else
     echo ">According to the $nodenyip ,drop the IP: $i"
    fi
done
fi
cat $denyfile | sort | uniq > $denyfile
rm -rf $tmp_sshd
rm -rf $tmp_httpd
rm -rf /tmp/ssh*
rm -rf /tmp/http*
./iptables.rule


2.接下來,就是Copy鳥哥的scripts, 去建立 iptables.rule 在 /usr/local/virus/iptables