First push of files
This commit is contained in:
commit
a35e3c45ea
57
README
Normal file
57
README
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
SSH Block 2
|
||||||
|
|
||||||
|
I am glad to announce version 2 of the SSH Block script!
|
||||||
|
Version two contains many improvments over the earlier versions.
|
||||||
|
|
||||||
|
A quick list with the best of version two:
|
||||||
|
- Total re-write of the code
|
||||||
|
- No more catting back and forth thruogh the script
|
||||||
|
- No more strange temp files in /Var/state/ssh_block
|
||||||
|
- ONE scriptfile for all system (Linux, FreeBSD, Solaris and Mac OS X)
|
||||||
|
- No more un-neccesary grepping. The script only "greps" if the size of the
|
||||||
|
log file has changed. This way it uses less system recuorces.
|
||||||
|
- The blocked IP's are now inserted directly into hosts.deny
|
||||||
|
|
||||||
|
I came up with ideea of making a version two since I made the port to Solaris
|
||||||
|
and Mac OS X. I liked the code that came out of these two ports. Later on I
|
||||||
|
started thinking about what can be done about the script re-writing
|
||||||
|
the hosts.deny file every 10 second. So for this I added the logfile size check.
|
||||||
|
And I didn't like having 4 diffrent versions (5 if you count the iptable
|
||||||
|
version) of the script. So I made a "One for all" version.
|
||||||
|
|
||||||
|
I hope version two of SSH Block will be appreciated both among version one users
|
||||||
|
aswell as among new users.
|
||||||
|
|
||||||
|
Please drop me an e-mail with comments, bugs, improvments or just about
|
||||||
|
anything!
|
||||||
|
|
||||||
|
This is the new SSH Block, simply called sshblock2.
|
||||||
|
It sould run out of the box on FreeBSD, Mac OS X, Linux and Solaris, though
|
||||||
|
there are some extra steps to make it work with Solaris (since TCP Wrappers
|
||||||
|
arn't enabled by default and no logging is done.)
|
||||||
|
|
||||||
|
|
||||||
|
NOTE TO SOLARIS USERS
|
||||||
|
|
||||||
|
There are some things you have to do to your system before this script
|
||||||
|
will acually work under Solaris.
|
||||||
|
To start with, TCP Wrappers is not enabled by default on Solaris 10. How to
|
||||||
|
enable TCP Wrappers and some info about it can be found here:
|
||||||
|
http://www.sun.com/bigadmin/content/submitted/tcp_wrap_solaris10.html
|
||||||
|
|
||||||
|
Second, you have to enable syslog logging of the ssh daemon. This is done by
|
||||||
|
editing /etc/syslog.conf.
|
||||||
|
Adding the following line will have sshd logging to /var/log/authlog
|
||||||
|
|
||||||
|
auth.info /var/log/authlog
|
||||||
|
|
||||||
|
Now you can run the script (as root) and it will block IP numbers of probing
|
||||||
|
hosts. The scripts will add this hosts to your /etc/hosts.deny file like this:
|
||||||
|
|
||||||
|
#BEGIN_SSHBLOCK
|
||||||
|
sshd : 192.168.0.1
|
||||||
|
sshd : 10.0.0.3
|
||||||
|
#END_SSHBLOCK
|
||||||
|
|
||||||
|
I would recommend to backup your /etc/hosts.deny and your /etc/syslog.conf
|
||||||
|
before making changes and running the script.
|
||||||
216
sshblock2.sh
Executable file
216
sshblock2.sh
Executable file
@ -0,0 +1,216 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
# #
|
||||||
|
# Copyright (C) 2006 Jack-Benny Persson <jake@cyberinfo.se> #
|
||||||
|
# #
|
||||||
|
# This program is free software; you can redistribute it and/or modify #
|
||||||
|
# it under the terms of the GNU General Public License as published by #
|
||||||
|
# the Free Software Foundation; either version 2 of the License, or #
|
||||||
|
# (at your option) any later version. #
|
||||||
|
# #
|
||||||
|
# This program is distributed in the hope that it will be useful, #
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
||||||
|
# GNU General Public License for more details. #
|
||||||
|
# #
|
||||||
|
# You should have received a copy of the GNU General Public License #
|
||||||
|
# along with this program; if not, write to the Free Software #
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
|
||||||
|
# #
|
||||||
|
################################################################################
|
||||||
|
|
||||||
|
# Version 2.3
|
||||||
|
#
|
||||||
|
# SSH Block 2 - A script that blocks SSH probing hosts in /etc/hosts.deny
|
||||||
|
# This is version two of SSH Block, wich is a total re-write of the original
|
||||||
|
# code. This version should work on Linux, FreeBSD, Solaris and Mac OS X.
|
||||||
|
# Please read the README file for more information.
|
||||||
|
|
||||||
|
#If these users are trying to login via SSH, the host is instantly blocked.
|
||||||
|
#Be careful not to add users that normaly login via SSH here...
|
||||||
|
BLOCK_USERS=("mysql" "nobody")
|
||||||
|
|
||||||
|
SLEEP_TIME=10
|
||||||
|
OS=`uname`
|
||||||
|
|
||||||
|
if [ "$OS" = "FreeBSD" ]; then
|
||||||
|
DENYFILE="/etc/hosts.allow" #Both allow and deny in one file on FreeBSD
|
||||||
|
elif [ "$OS" != "FreeBSD" ]; then
|
||||||
|
DENYFILE="/etc/hosts.deny" #The default way...
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if [ "$UID" -ne 0 ]; then
|
||||||
|
echo "Must be run as root"
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
#The default way...
|
||||||
|
print_ip()
|
||||||
|
{
|
||||||
|
sort | uniq | sed -e 's/^/sshd : /' >> ${DENYFILE}
|
||||||
|
}
|
||||||
|
|
||||||
|
#The FreeBSD way...
|
||||||
|
print_ip_freebsd()
|
||||||
|
{
|
||||||
|
sort | uniq | sed -e 's/^/sshd : /' | sed -e 's/$/ : deny/' >> \
|
||||||
|
${DENYFILE}
|
||||||
|
}
|
||||||
|
|
||||||
|
#Diffrent logfiles with diffrent syntax on diffrent systems...
|
||||||
|
SunOS_greplog()
|
||||||
|
{
|
||||||
|
grep sshd /var/log/authlog | grep 'invalid user' \
|
||||||
|
| awk '{print $15}' - | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep \
|
||||||
|
"Failed keyboard-interactive for $i from" \
|
||||||
|
/var/log/authlog; done | awk '{print $14}' - | sort | uniq
|
||||||
|
}
|
||||||
|
|
||||||
|
FreeBSD_greplog()
|
||||||
|
{
|
||||||
|
(grep 'Illegal user' /var/log/auth.log || \
|
||||||
|
grep 'Invalid user' /var/log/auth.log) \
|
||||||
|
| awk '{print $10}' - | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep "Failed password for $i from" \
|
||||||
|
/var/log/auth.log; done | awk '{print $11}' - | sort | uniq
|
||||||
|
}
|
||||||
|
|
||||||
|
OpenBSD_greplog()
|
||||||
|
{
|
||||||
|
grep 'Invalid user' /var/log/authlog \
|
||||||
|
| awk '{print $10}' - | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep "Failed password for $i from" \
|
||||||
|
/var/log/authlog; done | awk '{print $11}' - | sort | uniq
|
||||||
|
}
|
||||||
|
|
||||||
|
Linux_greplog()
|
||||||
|
{
|
||||||
|
(grep '[Ii]nvalid user' /var/log/messages || \
|
||||||
|
grep '[Ii]nvalid user' /var/log/auth.log || \
|
||||||
|
grep '[Ii]llegal user' /var/log/secure || \
|
||||||
|
grep '[Ii]llegal user' /var/log/messages || \
|
||||||
|
grep '[Ii]nvalid user' /var/log/secure) \
|
||||||
|
| egrep -o '[0-9]{1,3}(\.[0-9]{1,3}){3}' - | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep \
|
||||||
|
"Authentication failure for $i from" \
|
||||||
|
/var/log/messages; done | egrep -o '[0-9]{1,3}(\.[0-9]{1,3}){3}' \
|
||||||
|
- | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep "Failed password for $i from" \
|
||||||
|
/var/log/messages; done | egrep -o '[0-9]{1,3}(\.[0-9]{1,3}){3}' \
|
||||||
|
- | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep "Failed password for $i from" \
|
||||||
|
/var/log/auth.log; done | egrep -o '[0-9]{1,3}(\.[0-9]{1,3}){3}' \
|
||||||
|
- | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep \
|
||||||
|
"Authentication failure for $i from" \
|
||||||
|
/var/log/secure; done | egrep -o '[0-9]{1,3}(\.[0-9]{1,3}){3}' \
|
||||||
|
- | sort | uniq
|
||||||
|
}
|
||||||
|
|
||||||
|
Darwin_greplog()
|
||||||
|
{
|
||||||
|
grep sshd /var/log/system.log | grep 'illegal user' \
|
||||||
|
| awk '{print $15}' - | sort | uniq
|
||||||
|
|
||||||
|
for i in ${BLOCK_USERS[*]}; do grep \
|
||||||
|
"Authentication failure for $i from" \
|
||||||
|
/var/log/system.log; done | - | awk '{print $13}' sort | uniq
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
SunOS_size()
|
||||||
|
{
|
||||||
|
ls -l /var/log/authlog | awk '{print $5}'
|
||||||
|
}
|
||||||
|
|
||||||
|
Darwin_size()
|
||||||
|
{
|
||||||
|
ls -l /var/log/system.log | awk '{print $5}'
|
||||||
|
}
|
||||||
|
|
||||||
|
FreeBSD_size()
|
||||||
|
{
|
||||||
|
ls -l /var/log/auth.log | awk '{print $5}'
|
||||||
|
}
|
||||||
|
|
||||||
|
OpenBSD_size()
|
||||||
|
{
|
||||||
|
ls -l /var/log/authlog | awk '{print $5}'
|
||||||
|
}
|
||||||
|
|
||||||
|
Linux_size()
|
||||||
|
{
|
||||||
|
if [ -e /var/log/secure ] && [ -e /var/log/messages ]; then
|
||||||
|
A=`ls -l /var/log/secure | awk '{print $5}'`
|
||||||
|
B=`ls -l /var/log/messages | awk '{print $5}'`
|
||||||
|
let C=A+B
|
||||||
|
echo $C
|
||||||
|
elif [ -e /var/log/secure ]; then
|
||||||
|
ls -l /var/log/secure | awk '{print $5}'
|
||||||
|
elif [ -e /var/log/messages ]; then
|
||||||
|
ls -l /var/log/messages | awk '{print $5}'
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
touch ${DENYFILE}
|
||||||
|
|
||||||
|
#Check if we have run SSH Block before....
|
||||||
|
RUN_BEFORE=`grep -c "#BEGIN_SSHBLOCK" ${DENYFILE}`
|
||||||
|
if [ $RUN_BEFORE -gt 0 ]; then
|
||||||
|
echo "/#BEGIN_SSHBLOCK/,/#END_SSHBLOCK/d|x" \
|
||||||
|
| ex -s ${DENYFILE}
|
||||||
|
fi
|
||||||
|
|
||||||
|
OLD_SIZE=0
|
||||||
|
|
||||||
|
#Here we go!
|
||||||
|
(
|
||||||
|
while true
|
||||||
|
do
|
||||||
|
case "$OS" in
|
||||||
|
SunOS) SIZE=`SunOS_size` ;;
|
||||||
|
Darwin) SIZE=`Darwin_size` ;;
|
||||||
|
FreeBSD) SIZE=`FreeBSD_size` ;;
|
||||||
|
OpenBSD) SIZE=`OpenBSD_size` ;;
|
||||||
|
Linux) SIZE=`Linux_size` ;;
|
||||||
|
esac
|
||||||
|
if [ $OLD_SIZE -ne $SIZE ]; then
|
||||||
|
|
||||||
|
BLOCK_EXIST=`grep -c "#BEGIN_SSHBLOCK" ${DENYFILE}`
|
||||||
|
if [ $BLOCK_EXIST -gt 0 ]; then
|
||||||
|
echo "/#BEGIN_SSHBLOCK/,/#END_SSHBLOCK/d|x" \
|
||||||
|
| ex -s ${DENYFILE}
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "#BEGIN_SSHBLOCK" >> ${DENYFILE}
|
||||||
|
case "$OS" in
|
||||||
|
SunOS) SunOS_greplog | print_ip ;;
|
||||||
|
FreeBSD) FreeBSD_greplog | print_ip_freebsd ;;
|
||||||
|
OpenBSD) OpenBSD_greplog | print_ip ;;
|
||||||
|
Linux) Linux_greplog | print_ip ;;
|
||||||
|
Darwin) Darwin_greplog | print_ip ;;
|
||||||
|
esac
|
||||||
|
echo "#END_SSHBLOCK" >> ${DENYFILE}
|
||||||
|
case "$OS" in
|
||||||
|
SunOS) OLD_SIZE=`SunOS_size` ;;
|
||||||
|
Darwin) OLD_SIZE=`Darwin_size` ;;
|
||||||
|
FreeBSD) OLD_SIZE=`FreeBSD_size` ;;
|
||||||
|
OpenBSD) OLD_SIZE=`OpenBSD_size` ;;
|
||||||
|
Linux) OLD_SIZE=`Linux_size` ;;
|
||||||
|
esac
|
||||||
|
sleep ${SLEEP_TIME}
|
||||||
|
else
|
||||||
|
sleep ${SLEEP_TIME}
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
) 2> /dev/null &
|
||||||
Loading…
x
Reference in New Issue
Block a user