1 files changed, 31 insertions, 0 deletions

diff --git a/filterwall.sh b/filterwall.sh
new file mode 100755
index 0000000..deba71f
--- /dev/null
+++ b/filterwall.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+#
+# Log Filter/Firewall Generator
+# by Mike Crute (mcrute@gmail.com)
+# on November 20, 2009
+#
+# Script to scrape over logfiles and generate blocked-ip
+# list for people abusing machine services. This is designed
+# to be run as a cron.
+#
+
+BLOCK_FILE=/etc/firewall/blocked-ips
+
+# Filter SSHD Abusers
+egrep "sshd\[[0-9]+\]: Failed password for" /var/log/auth.log | \
+        egrep -o '([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | \
+        awk '{ a[$1]++ } END { for (i in a) { if (a[i] > 10) { print i }}}' \
+>> $BLOCK_FILE
+
+# Filter FTP Abusers
+grep 'FAIL LOGIN: Client' /var/log/vsftpd.log | \
+        egrep -o '([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | \
+        awk '{ a[$1]++ } END { for (i in a) { if (a[i] > 10) { print i }}}' \
+>> $BLOCK_FILE
+
+# De-dup the filter file.
+cat $BLOCK_FILE | sort -u > $BLOCK_FILE.tmp
+mv $BLOCK_FILE.tmp $BLOCK_FILE
+
+# Refresh the firewall
+/root/bin/firewall