diff --git a/ddos-mitigator.sh b/ddos-mitigator.sh index 04fc044..cffead1 100755 --- a/ddos-mitigator.sh +++ b/ddos-mitigator.sh @@ -1,11 +1,17 @@ #!/bin/sh +################################################################################ +################################################################################ +########### FIXME: This text is outdated and needs to be rewritten. ########### +################################################################################ +################################################################################ + ################################################################################ # # # Try and prevent apache overloads by banning IP addresses that have (too) # # many open connections. # # This script uses netstat to determine the connections to the HTTPS port of # # the host machine and provides automated whois information retrieval based on # -# the address or the /24- /16- or /8-subnet thereof. Addresses (or subnets) # +# the address or the /24-, /16- or /8-subnet thereof. Addresses (or subnets) # # are presented to the user in order of descending connection count. For each # # address (or subnet), the user can choose to ban or ignore it. Addresses (or # # subnets) chosen to be banned will be blocked by the apache-badbots jail of # @@ -16,6 +22,20 @@ # # ################################################################################ +################################################################################ +# # +# Prerequisites: # +# - app-admin/sudo (`sudo`) # +# - net-analyzer/fail2ban (`fail2ban-client`) # +# - net-misc/whois (`whois`) # +# - sys-apps/coreutils (`cut`, `id`, `sort`, `touch`, `tr`, `uniq`) # +# - sys-apps/grep (`grep`) # +# - sys-apps/moreutils (`sponge`) # +# - sys-apps/net_tools (`netstat`) # +# - sys-apps/util-linux (`getopt`) # +# # +################################################################################ + # Set the host's own IP address. So far, only an IPv4 address is supported. MY_IP="94.199.214.20" # Set the desired port to monitor. @@ -51,6 +71,18 @@ reset="\033[0m" # Clean up when the script exits. trap 'sudo -k; popd >/dev/null; rm -r ${tmpdir}' EXIT +function check_installed() { + local command="$1" + local package="$2" + which "${command}" 2>/dev/null >&2 + local result=$? + + if [[ "${result}" -ne 0 ]] ; then + echo -e "${red}Command ${bold}${command}${reset}${red} not found.${reset} Please install package ${blue}${package}${reset}." + exit 1 + fi +} + # Create a temp directory, chdir into it and create the (initially empty) # banlist file. tmpdir=$(mktemp -d) @@ -58,7 +90,7 @@ tmpdir=$(mktemp -d) pushd "${tmpdir}" > /dev/null touch "${banlist}" -function printHelp() { +function print_help() { cat <