Compare commits
28 Commits
Author | SHA1 | Date |
---|---|---|
Manuel Friedli | 9b4a55dfb2 | |
Manuel Friedli | 64918328c9 | |
Manuel Friedli | 22bc52d665 | |
Manuel Friedli | 31f0901134 | |
Manuel Friedli | 70d41673f7 | |
Manuel Friedli | a1d5821cc7 | |
Manuel Friedli | b3afda4932 | |
Manuel Friedli | 142db098be | |
Manuel Friedli | 5078363348 | |
Manuel Friedli | f5180a5e57 | |
Manuel Friedli | 11ad1b471a | |
Manuel Friedli | 8e0f22da8f | |
Manuel Friedli | 0871a25bf7 | |
Manuel Friedli | b65bd6ea55 | |
Manuel Friedli | 36a5fbc2e5 | |
Manuel Friedli | 2f58a65f7b | |
Manuel Friedli | 877a2723e5 | |
Manuel Friedli | 7f3432672b | |
Manuel Friedli | 265507452c | |
Manuel Friedli | 11c246b02c | |
Manuel Friedli | 3a15ac1ba3 | |
Manuel Friedli | c4600f34b6 | |
Manuel Friedli | 0c2f8efe6d | |
Manuel Friedli | 8fa1414f18 | |
Manuel Friedli | f2c8ad8b9d | |
Manuel Friedli | e8280e5916 | |
Manuel Friedli | bfbbe0c976 | |
Manuel Friedli | a396d1cf4e |
|
@ -0,0 +1,5 @@
|
|||
root = true
|
||||
|
||||
[*.sh]
|
||||
indent_size = 4
|
||||
indent_style = tab
|
|
@ -0,0 +1,30 @@
|
|||
# Example configuration file for ddos-mitigator.sh.
|
||||
# PLEASE TAKE CARE not to put any whitespace around the '=' signs, as this file is directly sourced by the script
|
||||
# file and this needs to conform to the BASH syntax. Also, make sure to declare the COUNTRIES variable with the
|
||||
# correct array syntax: COUNTRIES=("AA" "BB" "CC"), or to comment it out altogether.
|
||||
|
||||
# The path to the GeoIP2 database file (must be either country or city database). This parameter is mandatory. If it is
|
||||
# not specified here, it must be given on the command line (through the -d option).
|
||||
DATABASE_FILE="/path/to/geoip/country-or-city-database.mmdb"
|
||||
|
||||
# Enable the autopilot for automatically banning IP addresses of the desired countries (see also COUNTRIES option).
|
||||
# Only ban IP addresses with at least AUTOPILOT current connections. If the value is not specified or 0, don't
|
||||
# automatically ban IP addresses, but run in interactive mode.
|
||||
AUTOPILOT="0"
|
||||
|
||||
# Defines the subnet size in bytes to be analyzed. Valid values are:
|
||||
# - 8 for class A networks (X.0.0.0/8)
|
||||
# - 16 for class B networks (X.X.0.0/16)
|
||||
# - 24 for class C networks (X.X.X.0/24)
|
||||
# - 32 for class D networks (X.X.X.X/32)
|
||||
# If not specified, run in interactive mode and prompt for the netmask size.
|
||||
NETMASK="8"
|
||||
|
||||
# The country-codes to block as an array. Defaults to "CN" (China).
|
||||
#COUNTRIES=("CN" "HK" "TW")
|
||||
|
||||
# Specify the JAIL to use for banning the IP addresses. Defaults to 'apache-auth'.
|
||||
#JAIL="apache-auth"
|
||||
|
||||
# The desired port to monitor. Defaults to 443 (https).
|
||||
#PORT="443"
|
|
@ -1,21 +1,17 @@
|
|||
#!/bin/sh
|
||||
################################################################################
|
||||
################################################################################
|
||||
########### FIXME: This text is outdated and needs to be rewritten. ###########
|
||||
################################################################################
|
||||
################################################################################
|
||||
|
||||
################################################################################
|
||||
# #
|
||||
# Try and prevent apache overloads by banning IP addresses that have (too) #
|
||||
# many open connections. #
|
||||
# This script uses netstat to determine the connections to the HTTPS port of #
|
||||
# the host machine and provides automated whois information retrieval based on #
|
||||
# the address or the /24-, /16- or /8-subnet thereof. Addresses (or subnets) #
|
||||
# are presented to the user in order of descending connection count. For each #
|
||||
# address (or subnet), the user can choose to ban or ignore it. Addresses (or #
|
||||
# subnets) chosen to be banned will be blocked by the apache-badbots jail of #
|
||||
# fail2ban. #
|
||||
# This script uses ss to determine the connections to a configurable port #
|
||||
# on the host machine and provides automated GeoIP information retrieval based #
|
||||
# the address or the /24-, /16- or /8-subnet thereof. A GeoIP city- or country #
|
||||
# database must be installed separately and is provided to the script via a #
|
||||
# command line parameter. #
|
||||
# Addresses (or subnets) are presented to the user in order of descending #
|
||||
# connection count. For each address (or subnet), the user can choose to ban #
|
||||
# or ignore it. Addresses (or subnets) chosen to be banned will be blocked by #
|
||||
# a configurable jail of fail2ban. #
|
||||
# Author: Manuel Friedli, <manuel@fritteli.ch> #
|
||||
# This script is licenced under the GNU General Public Licence, version 3 or #
|
||||
# later. #
|
||||
|
@ -30,17 +26,32 @@
|
|||
# - net-analyzer/fail2ban (`fail2ban-client`) #
|
||||
# - sys-apps/coreutils (`cut`, `id`, `sort`, `touch`, `tr`, `uniq`) #
|
||||
# - sys-apps/grep (`grep`) #
|
||||
# - sys-apps/iproute2 (`ss`) #
|
||||
# - sys-apps/moreutils (`sponge`) #
|
||||
# - sys-apps/net_tools (`netstat`) #
|
||||
# - sys-apps/util-linux (`getopt`) #
|
||||
# #
|
||||
################################################################################
|
||||
|
||||
# Set the host's own IP address. So far, only an IPv4 address is supported.
|
||||
MY_IP="94.199.214.20"
|
||||
# Store the start time; this enables us to output the total runtime at the end.
|
||||
start="$(date +%s)"
|
||||
|
||||
# After this point, no editing is required.
|
||||
start=$(date +%s)
|
||||
# Dependencies of this script. Simple array with the following structure:
|
||||
# (command package [...])
|
||||
dependencies=(
|
||||
"sudo" "app-admin/sudo"
|
||||
"python" "dev-lang/python:3.8"
|
||||
"fail2ban-client" "net-analyzer/fail2ban"
|
||||
"cut" "sys-apps/coreutils"
|
||||
"id" "sys-apps/coreutils"
|
||||
"sort" "sys-apps/coreutils"
|
||||
"touch" "sys-apps/coreutils"
|
||||
"tr" "sys-apps/coreutils"
|
||||
"uniq" "sys-apps/coreutils"
|
||||
"grep" "sys-apps/grep"
|
||||
"ss" "sys-apps/iproute2"
|
||||
"sponge" "sys-apps/moreutils"
|
||||
"getopt" "sys-apps/util-linux"
|
||||
)
|
||||
|
||||
# These suffixes must be appended to the respective addresses and subnets.
|
||||
suffix8="/8"
|
||||
|
@ -61,18 +72,40 @@ bold="$(printf '\033[1m')"
|
|||
reset="$(printf '\033[0m')"
|
||||
|
||||
# Clean up when the script exits.
|
||||
trap 'sudo -k; rm -r ${tmpdir}' EXIT
|
||||
trap 'sudo -k 2>/dev/null >&2; rm -r ${tmpdir}' EXIT
|
||||
|
||||
function check_installed() {
|
||||
local command="$1"
|
||||
local package="$2"
|
||||
which "${command}" 2>/dev/null >&2
|
||||
local result=$?
|
||||
function is_installed() {
|
||||
which "${1}" 2>/dev/null >&2
|
||||
return $?
|
||||
}
|
||||
|
||||
if [[ "${result}" -ne 0 ]] ; then
|
||||
echo "${red}Command ${bold}${command}${reset}${red} not found.${reset} Please install package ${blue}${package}${reset}."
|
||||
exit 1
|
||||
function print_missing_dependency() {
|
||||
local command="${1}"
|
||||
local package="${2}"
|
||||
|
||||
echo "${red}Command ${bold}${command}${reset}${red} not found.${reset} Please install package ${blue}${package}${reset}." >&2
|
||||
}
|
||||
|
||||
function check_dependencies() {
|
||||
local arraylength=${#dependencies[@]}
|
||||
local res=
|
||||
local command=
|
||||
local package=
|
||||
# 0: true, all installed; 1: false, at least one command/package missing
|
||||
local all_installed=0
|
||||
|
||||
for ((i = 0; i < ${arraylength}; i += 2)); do
|
||||
command="${dependencies[$i]}"
|
||||
package="${dependencies[$i + 1]}"
|
||||
is_installed "${command}" "${package}"
|
||||
res=$?
|
||||
if [[ ${res} -ne 0 ]]; then
|
||||
print_missing_dependency "${command}" "${package}"
|
||||
all_installed=1
|
||||
fi
|
||||
done
|
||||
|
||||
return ${all_installed}
|
||||
}
|
||||
|
||||
function print_help() {
|
||||
|
@ -96,6 +129,20 @@ Usage: $(basename $0) -d FILE [OPTION...]
|
|||
comma-separated values; defaults to 'CN'
|
||||
(China).
|
||||
|
||||
-e, --dependencies Check if all required dependencies are
|
||||
installed. If all dependencies are found,
|
||||
the program terminates with exit code 0.
|
||||
Otherwise, missing dependencies are
|
||||
printed to stderr and the program
|
||||
terminates with exit code 1.
|
||||
|
||||
-f, --config-file=FILENAME Specify the full path to the configuration
|
||||
file. If omitted, all options are read
|
||||
from the command line.
|
||||
Any parameter specified on the command
|
||||
line takes precedence over configuration
|
||||
option read from the file.
|
||||
|
||||
-j, --jail=JAIL Specify the JAIL to use for banning the IP
|
||||
addresses.
|
||||
Defaults to 'apache-auth'.
|
||||
|
@ -131,11 +178,11 @@ function exec_as_root() {
|
|||
|
||||
function filter() {
|
||||
# list of current connections
|
||||
file="$1"
|
||||
file="${1}"
|
||||
# subnet extension, e.g. ".0.0"
|
||||
ext="$2"
|
||||
ext="${2}"
|
||||
# subnet suffix, e.g. "/16"
|
||||
suffix="$3"
|
||||
suffix="${3}"
|
||||
rm -f "${filtered}"
|
||||
touch "${filtered}"
|
||||
|
||||
|
@ -151,8 +198,48 @@ function filter() {
|
|||
mv "${filtered}" "${file}"
|
||||
}
|
||||
|
||||
function set_default_values() {
|
||||
if [[ -z "${autopilot}" ]]; then
|
||||
autopilot=0
|
||||
fi
|
||||
if [[ -z "${bancountries}" ]]; then
|
||||
bancountries=("CN")
|
||||
fi
|
||||
if [[ -z "${jail}" ]]; then
|
||||
jail="apache-auth"
|
||||
fi
|
||||
if [[ -z "${netmask}" ]]; then
|
||||
netmask=0
|
||||
fi
|
||||
if [[ -z "${port}" ]]; then
|
||||
port=443
|
||||
fi
|
||||
}
|
||||
|
||||
function parse_config_file() {
|
||||
source "${configfile}"
|
||||
if [[ -z "${autopilot}" ]]; then
|
||||
autopilot="${AUTOPILOT}"
|
||||
fi
|
||||
if [[ -z "${bancountries}" ]]; then
|
||||
bancountries=(${COUNTRIES[@]})
|
||||
fi
|
||||
if [[ -z "${database}" ]]; then
|
||||
database="${DATABASE_FILE}"
|
||||
fi
|
||||
if [[ -z "${jail}" ]]; then
|
||||
jail="${JAIL}"
|
||||
fi
|
||||
if [[ -z "${netmask}" ]]; then
|
||||
netmask="${NETMASK}"
|
||||
fi
|
||||
if [[ -z "${port}" ]]; then
|
||||
port="${PORT}"
|
||||
fi
|
||||
}
|
||||
|
||||
function parse_command_line_args() {
|
||||
TEMP=$(getopt -o 'a::,c:,d:,j:,n:,p:,h' -l 'auto::,country:,database:,jail:,netmask:,port:,help' -- "$@")
|
||||
TEMP=$(getopt -o 'a::,c:,d:,e,f:,j:,n:,p:,h' -l 'auto::,country:,database:,dependencies,config-file:,jail:,netmask:,port:,help' -- "$@")
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo 'Error parsing command line options. Terminating. Invoke with --help for help.' >&2
|
||||
|
@ -163,16 +250,12 @@ function parse_command_line_args() {
|
|||
unset TEMP
|
||||
|
||||
while true; do
|
||||
case "$1" in
|
||||
case "${1}" in
|
||||
'-a' | '--auto')
|
||||
case "$2" in
|
||||
case "${2}" in
|
||||
'')
|
||||
autopilot=1
|
||||
;;
|
||||
*[!0-9]*)
|
||||
echo "Invalid argument for parameter 'auto': '$2'. Invoke with --help for help." >&2
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
autopilot="$2"
|
||||
;;
|
||||
|
@ -180,44 +263,47 @@ function parse_command_line_args() {
|
|||
shift
|
||||
;;
|
||||
'-c' | '--country')
|
||||
IFS=',' read -ra bancountries <<< "$2"
|
||||
if [[ -z ${bancountries[@]// } ]] ; then
|
||||
echo "Invalid argument for parameter 'country': '$2'. Invoke with --help for help." >&2
|
||||
exit 1
|
||||
fi
|
||||
IFS=',' read -ra bancountries <<<"${2}"
|
||||
shift
|
||||
;;
|
||||
'-d' | '--database')
|
||||
database="$2"
|
||||
database="${2}"
|
||||
shift
|
||||
;;
|
||||
'-e' | '--dependencies')
|
||||
check_dependencies
|
||||
exit $?
|
||||
;;
|
||||
'-f' | '--config-file')
|
||||
configfile="${2}"
|
||||
shift
|
||||
;;
|
||||
'-j' | '--jail')
|
||||
jail="$2"
|
||||
jail="${2}"
|
||||
shift
|
||||
;;
|
||||
'-n' | '--netmask')
|
||||
case "$2" in
|
||||
'1'|'8')
|
||||
case "${2}" in
|
||||
'1')
|
||||
netmask=8
|
||||
;;
|
||||
'2'|'16')
|
||||
'2')
|
||||
netmask=16
|
||||
;;
|
||||
'3'|'24')
|
||||
'3')
|
||||
netmask=24
|
||||
;;
|
||||
'4'|'32')
|
||||
'4')
|
||||
netmask=32
|
||||
;;
|
||||
*)
|
||||
echo "Invalid argument for parameter 'netmask': '$2'. Invoke with --help for help." >&2
|
||||
exit 1
|
||||
netmask="${2}"
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
;;
|
||||
'-p' | '--port')
|
||||
port="$2"
|
||||
port="${2}"
|
||||
shift
|
||||
;;
|
||||
'-h' | '--help')
|
||||
|
@ -229,22 +315,88 @@ function parse_command_line_args() {
|
|||
break
|
||||
;;
|
||||
*)
|
||||
echo "Unknown error on command line argument '$1'. Terminating." >&2
|
||||
echo "Unknown error on command line argument '${1}'. Terminating." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# If the config file option is set, parse the config file.
|
||||
if [[ ! -z ${configfile+x} ]]; then
|
||||
if [[ ! -f "${configfile}" || ! -r "${configfile}" ]]; then
|
||||
echo "Can not read configuration file '${2}'. Invoke with --help for help." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
parse_config_file
|
||||
fi
|
||||
|
||||
# Here, we set the default values for all options that have not been set yet.
|
||||
set_default_values
|
||||
}
|
||||
|
||||
function validate_parameter_values() {
|
||||
# GeoIP-Database
|
||||
if [[ -z "${database}" ]]; then
|
||||
echo "No GeoIP database specified. Invoke with --help for more information." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -r "${database}" ]] ; then
|
||||
if [[ ! -f "${database}" || ! -r "${database}" ]]; then
|
||||
echo "Database '${database}' is not accessible." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Autopilot
|
||||
case "${autopilot}" in
|
||||
*[!0-9]*)
|
||||
echo "Invalid value for parameter 'auto' / 'AUTOPILOT': '${autopilot}'." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Countries
|
||||
if [[ -z ${bancountries[@]// /} ]]; then
|
||||
echo "Invalid value for parameter 'country' / 'COUNTRIES': '${bancountries[*]}'." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Jail
|
||||
if [[ -z "${jail}" ]]; then
|
||||
echo "Invalid value for parameter 'jail' / 'JAIL': '${jail}'." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Netmask
|
||||
case "${netmask}" in
|
||||
'0' | '8' | '16' | '24' | '32')
|
||||
# Everything OK.
|
||||
;;
|
||||
*)
|
||||
echo "Invalid value for parameter 'netmask': '${2}'." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Port
|
||||
case "${port}" in
|
||||
*[!0-9]*)
|
||||
echo "Invalid value for parameter 'port' / 'PORT': '${autopilot}'." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
if [[ ${port} -lt 0 || ${port} -gt 65535 ]]; then
|
||||
echo "Invalid value for parameter 'port' / 'PORT': '${autopilot}'." >&2
|
||||
echo "Value must be between 0 ... 65535 (inclusive)." >&2
|
||||
echo "Invoke with --help for help." >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
################################################################################
|
||||
|
@ -254,13 +406,13 @@ function parse_command_line_args() {
|
|||
# color to the next happen at different values.
|
||||
################################################################################
|
||||
function set_highlight_color() {
|
||||
local count=$1
|
||||
local count=${1}
|
||||
case "${choice}" in
|
||||
"1")
|
||||
# /32: 0 <= green < 3 <= yellow < 5 <= red
|
||||
if [ $count -ge 5 ] ; then
|
||||
if [ ${count} -ge 5 ]; then
|
||||
hilite="${red}"
|
||||
elif [ $count -ge 3 ] ; then
|
||||
elif [ ${count} -ge 3 ]; then
|
||||
hilite="${yellow}"
|
||||
else
|
||||
hilite="${green}"
|
||||
|
@ -268,9 +420,9 @@ function set_highlight_color() {
|
|||
;;
|
||||
"2")
|
||||
# /24: 0 <= green < 7 <= yellow < 13 <= red
|
||||
if [ $count -ge 13 ] ; then
|
||||
if [ ${count} -ge 13 ]; then
|
||||
hilite="${red}"
|
||||
elif [ $count -ge 7 ] ; then
|
||||
elif [ ${count} -ge 7 ]; then
|
||||
hilite="${yellow}"
|
||||
else
|
||||
hilite="${green}"
|
||||
|
@ -278,9 +430,9 @@ function set_highlight_color() {
|
|||
;;
|
||||
"3")
|
||||
# /16: 0 <= green < 13 <= yellow < 25 <= red
|
||||
if [ $count -ge 25 ] ; then
|
||||
if [ ${count} -ge 25 ]; then
|
||||
hilite="${red}"
|
||||
elif [ $count -ge 13 ] ; then
|
||||
elif [ ${count} -ge 13 ]; then
|
||||
hilite="${yellow}"
|
||||
else
|
||||
hilite="${green}"
|
||||
|
@ -288,9 +440,9 @@ function set_highlight_color() {
|
|||
;;
|
||||
"4")
|
||||
# /8: 0 <= green < 21 <= yellow < 49 <= red
|
||||
if [ $count -ge 49 ] ; then
|
||||
if [ ${count} -ge 49 ]; then
|
||||
hilite="${red}"
|
||||
elif [ $count -ge 21 ] ; then
|
||||
elif [ ${count} -ge 21 ]; then
|
||||
hilite="${yellow}"
|
||||
else
|
||||
hilite="${green}"
|
||||
|
@ -329,7 +481,7 @@ function process_file () {
|
|||
addrwithsuffix="${addronly}${suffix}"
|
||||
set_highlight_color "${count}"
|
||||
country="$("${curdir}/geoip-lookup.py" -f "${database}" "${addronly}")"
|
||||
if [[ autopilot -eq 0 ]] ; then
|
||||
if [[ ${autopilot} -eq 0 ]]; then
|
||||
echo "Country: '${yellow}${country}${reset}'"
|
||||
fi
|
||||
echo -n "Address ${bold}$((nline++)) of ${nlines}${reset}: \
|
||||
|
@ -340,7 +492,7 @@ Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times."
|
|||
read banaction
|
||||
else
|
||||
if [[ " ${bancountries[@]} " =~ " ${country} " ]]; then
|
||||
if [[ $count -ge $autopilot ]] ; then
|
||||
if [[ ${count} -ge ${autopilot} ]]; then
|
||||
echo -en "\n${red}Autopilot active. ${reset}"
|
||||
banaction=y
|
||||
else
|
||||
|
@ -348,7 +500,7 @@ Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times."
|
|||
return
|
||||
fi
|
||||
else
|
||||
if [[ $count -ge $autopilot ]] ; then
|
||||
if [[ ${count} -ge ${autopilot} ]]; then
|
||||
echo -en "\n${green}Autopilot active. ${reset}"
|
||||
banaction=n
|
||||
else
|
||||
|
@ -380,7 +532,7 @@ banlist (country=${yellow}${country}${reset})."
|
|||
|
||||
# Create a temp directory, chdir into it and create the (initially empty)
|
||||
# banlist file.
|
||||
tmpdir=$(mktemp -d)
|
||||
tmpdir="$(mktemp -d)"
|
||||
|
||||
# Set up all file paths
|
||||
curdir="$(dirname "$0")"
|
||||
|
@ -393,45 +545,40 @@ file24="${tmpdir}/sorted-http-24.txt"
|
|||
file32="${tmpdir}/sorted-http-32.txt"
|
||||
# This file will contain the addresses to be banned.
|
||||
banlist="${tmpdir}/banlist.txt"
|
||||
# This file contains the output of the last invocation of whois
|
||||
whoisoutput="${tmpdir}/whois.txt"
|
||||
|
||||
touch "${banlist}"
|
||||
|
||||
# Parse the command line options
|
||||
autopilot=0
|
||||
netmask=0
|
||||
jail="apache-auth"
|
||||
bancountries=("CN")
|
||||
autopilot=
|
||||
netmask=
|
||||
jail=
|
||||
bancountries=
|
||||
database=
|
||||
port=443
|
||||
port=
|
||||
|
||||
parse_command_line_args "$@"
|
||||
validate_parameter_values
|
||||
|
||||
check_installed "sudo" "app-admin/sudo"
|
||||
check_installed "python" "dev-lang/python:3.8"
|
||||
check_installed "fail2ban-client" "net-analyzer/fail2ban"
|
||||
check_installed "cut" "sys-apps/coreutils"
|
||||
check_installed "id" "sys-apps/coreutils"
|
||||
check_installed "sort" "sys-apps/coreutils"
|
||||
check_installed "touch" "sys-apps/coreutils"
|
||||
check_installed "tr" "sys-apps/coreutils"
|
||||
check_installed "uniq" "sys-apps/coreutils"
|
||||
check_installed "grep" "sys-apps/grep"
|
||||
check_installed "sponge" "sys-apps/moreutils"
|
||||
check_installed "netstat" "sys-apps/net_tools"
|
||||
check_installed "getopt" "sys-apps/util-linux"
|
||||
check_dependencies
|
||||
dependencies_ok=$?
|
||||
if [[ ${dependencies_ok} -ne 0 ]]; then
|
||||
exit ${dependencies_ok}
|
||||
fi
|
||||
|
||||
# List already banned addresses in the chosen jail
|
||||
banned="$(exec_as_root fail2ban-client get "${jail}" banip)"
|
||||
|
||||
# Determine the current connections to the desired port; store the raw data in
|
||||
# $fileraw.
|
||||
netstat -nt | grep "${MY_IP}:${port}" | tr -s '[:blank:]' | cut -d' ' -f5 \
|
||||
| cut -d: -f1 | sort > "${fileraw}"
|
||||
connections=$(ss -HOn state established "( sport = :${port} )" | tr -s '[:blank:]' | cut -d' ' -f5)
|
||||
|
||||
# IPv6-mapped-IPv4: [::ffff:192.168.0.1]:443
|
||||
echo "${connections}" | grep '^\[::ffff:' - | cut -d: -f4 | cut -d] -f1 | grep -v '^$' >"${fileraw}"
|
||||
# Pure IPv4: 192.168.0.1:443
|
||||
echo "${connections}" | grep -v '^\[' - | cut -d: -f1 | grep -v '^$' >>"${fileraw}"
|
||||
|
||||
# Group and sort the data into the subnet-specific files.
|
||||
cp "${fileraw}" "${file32}"
|
||||
sort "${fileraw}" >"${file32}"
|
||||
cut -d. -f1-3 "${fileraw}" | sort >"${file24}"
|
||||
cut -d. -f1-2 "${fileraw}" | sort >"${file16}"
|
||||
cut -d. -f1 "${fileraw}" | sort >"${file8}"
|
||||
|
@ -520,6 +667,6 @@ while read -r addrwithsuffix ; do
|
|||
exec_as_root fail2ban-client set "${jail}" banip "${addrwithsuffix}"
|
||||
done <"${banlist}"
|
||||
|
||||
end=$(date +%s)
|
||||
end="$(date +%s)"
|
||||
|
||||
echo "${green}All done in $((end - start)) seconds!${reset}"
|
||||
|
|
|
@ -1,16 +1,24 @@
|
|||
#!/usr/bin/python3.8
|
||||
#!/usr/bin/python
|
||||
|
||||
import getopt
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
try:
|
||||
import geoip2.database
|
||||
import geoip2.errors
|
||||
except ImportError:
|
||||
print(
|
||||
"Required module geoip2.database not found. On Gentoo Linux, please install dev-python/geoip2 from the 'fritteli' overlay.",
|
||||
"Required modules geoip2.database and geoip2.errors not found. On Gentoo Linux, please install dev-python/geoip2 from the 'fritteli' overlay.",
|
||||
file=sys.stderr)
|
||||
exit(1)
|
||||
|
||||
try:
|
||||
import maxminddb.errors
|
||||
except ImportError:
|
||||
print(
|
||||
"Required module maxminddb.errors not found. On Gentoo Linux, please install dev-python/maxminddb from the 'fritteli' overlay.",
|
||||
file=sys.stderr)
|
||||
exit(1)
|
||||
|
||||
class LookupException(Exception):
|
||||
"""
|
||||
|
@ -47,6 +55,14 @@ def get_county_code(ipaddress, dbfile):
|
|||
raise LookupException("Unsupported DB type: " + dbtype)
|
||||
|
||||
return country.iso_code
|
||||
except FileNotFoundError as e:
|
||||
raise LookupException(e.args)
|
||||
except maxminddb.errors.InvalidDatabaseError as e:
|
||||
raise LookupException(e.args)
|
||||
except geoip2.errors.AddressNotFoundError as e:
|
||||
raise LookupException(e.args)
|
||||
except ValueError as e:
|
||||
raise LookupException(e.args)
|
||||
finally:
|
||||
if reader:
|
||||
reader.close()
|
||||
|
@ -60,21 +76,12 @@ def parse_command_line(argv):
|
|||
:return:
|
||||
"""
|
||||
dbfile = None
|
||||
try:
|
||||
opts, args = getopt.getopt(argv, "f:")
|
||||
except getopt.GetoptError as e:
|
||||
raise LookupException("Error parsing command line") from e
|
||||
|
||||
for opt, arg in opts:
|
||||
if opt == "-f":
|
||||
dbfile = arg
|
||||
else:
|
||||
raise LookupException("Unknown command line argument")
|
||||
|
||||
if len(args) == 0:
|
||||
raise LookupException("No address given on command line")
|
||||
return dbfile, args[0]
|
||||
parser = argparse.ArgumentParser(description='Get the country code from an IP address')
|
||||
parser.add_argument('-f', dest='dbfile', required=True, help="Path to the GeoIP2 database file")
|
||||
parser.add_argument('address', help="The IP address to check")
|
||||
args = parser.parse_args()
|
||||
|
||||
return args.dbfile, args.address
|
||||
|
||||
def main(argv):
|
||||
"""
|
||||
|
@ -83,14 +90,18 @@ def main(argv):
|
|||
:param argv: Format: "-f /path/to/database.mmdb ip.v4.add.ress"
|
||||
:return:
|
||||
"""
|
||||
try:
|
||||
(dbfile, ipaddress) = parse_command_line(argv)
|
||||
code = get_county_code(ipaddress, dbfile)
|
||||
print(code)
|
||||
except LookupException as e:
|
||||
print(e.args, file=sys.stderr)
|
||||
print("Unknown")
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main(sys.argv[1:])
|
||||
except BaseException as e:
|
||||
print("Usage: geoip-lookup.py -f /path/to/geoip2-database.mmdb 192.168.1.1", file=sys.stderr)
|
||||
print("Unknown")
|
||||
raise e
|
||||
|
|
Loading…
Reference in New Issue