|
|
|
|
![]()
|
| Name |
Description |
Remarks |
Link |
| check_journal.pl |
Checks new incoming lines from sshd log and catches all ip addresses that tried to login and add them the ipset blacklist. The action is logged in /var/tmp/check_journal.log. By saving the last checked line number to a file, the next run of the script starts at the last line + 1. IP addresses are sent to ipinfo.io to get the location (country). Script is executed every 5 minutes by cron (*/5 * * * * /root/check_journal.pl) |
/usr/bin/journalctl -u ssh, not /var/log/auth.log. |
Perl |
| abuse.sh |
Checks a list of IP addresses against abuseipdb database and print abuse score, ISP, Country, etc to output file |
input=/tmp/ipfile.txt output=/tmp/bulkip_abuse_check.txt after been cleaned up by jq (JSON processor). |
Bash |
| ip_range.c |
Returns the Start address, End address, and number of hosts based on an input ip address and netmask. |
./ip_range 192.168.10.1 19 Network: 192.168.0.0/19 Start address: 192.168.0.1 End address: 192.168.31.254 No of hosts: 8190 |
C |
| check_iptables.sh |
The lines of iptables and ipset are counted and when below a threshold it will recreate a new ipset list and/or restores iptables. Email will be sent. |
A separated script takes care of a new ipset scammer list, called create_scammer.sh, iptables is restored using iptables.stable. The trial version is iptables.rules |
Bash |
| logtail.c |
This program copies the last 100 lines of various log-files to a directory within a website folder structure, so it caan be read by the Apache user. |
To allow apache userid www-data to copy logfiles from /var/log to a website directory this program runs with root s-bit (SUID). |
C |
| main.sh, 1_visitor.pl, 2_bulkcheck.sh, 3_update_scammer.pl, 4_block_chains.sh |
Five scripts take care of updating the ipset scammer list. The ip addresses of visitors in the iptables.log are extracted, send to abuseipdb and based on confidence of abuse above 30% or country code the bad ip addresses are added to the list. The main script runs a 5 am every day and mails a report. |
The number of days how far back (abuseipdb-)reports are fetched is set to 30. Countries like CN,RU,BR,HK,VN,SP,IN are considered bad by default. To recreate a ipset list that is locked by the kernel, create a dummy and swap the two, then destroy the dummy. |
Perl |
| menu |
The file menu holds alias definitions and descriptions. It makes frequently needed commands easier to execute; alias 'mn' will source the menu (alias mn='. /root/menu') |
One example: alias temp='vcgencmd measure_temp' and echo "temp = vcgencmd measure_temp" |
Bash |
