paramah/ossec-blacklist
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

less verbose

Browse Source
This commit is contained in:
Pawel Krawczyk
2014-11-13 11:28:42 +00:00
parent f7c09e47af
commit ede2ed56d6
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
blacklist.sh
View File

@@ -26,7 +26,7 @@ if [ -z "$(which curl)" ]; then
fi fi
# create main blocklists chain # create main blocklists chain
if ! iptables -L ${blocklist_chain_name}; then iptables -N ${blocklist_chain_name}; fi if ! iptables -L | grep -q "Chain ${blocklist_chain_name}"; then iptables -N ${blocklist_chain_name}; fi
# inject references to blocklist in the beginning of input and forward chains # inject references to blocklist in the beginning of input and forward chains
if ! iptables -L INPUT|grep -q ${blocklist_chain_name}; then if ! iptables -L INPUT|grep -q ${blocklist_chain_name}; then
@@ -42,14 +42,16 @@ for url in $urls; do
tmp=$(mktemp) tmp=$(mktemp)
tmp2=$(mktemp) tmp2=$(mktemp)
set_name=$(basename $url) set_name=$(basename $url)
curl --compressed -k "$url" >"$tmp" curl -s --compressed -k "$url" >"$tmp"
sort -u <"$tmp" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >"$tmp2" sort -u <"$tmp" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >"$tmp2"
ipset -! create ${set_name} hash:net ipset -! create ${set_name} hash:net
while read line; do while read line; do
ipset add ${set_name} "$line" ipset -! add ${set_name} "$line"
done <"$tmp2" done <"$tmp2"
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -m limit --limit 10/minute -j LOG --log-prefix "BLOCK ${set_name} " iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -m limit --limit 10/minute -j LOG --log-prefix "BLOCK ${set_name} "
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -j DROP iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -j DROP
echo ${set_name} $(ipset list ${set_name} | wc -l) echo ${set_name} $(ipset list ${set_name} | wc -l)
rm "$tmp" "$tmp2"
done done