weeheavy/scripts
1
0
Fork 0
Code Pull requests Activity

rbl: sanity checks, fix IPv6 geoip lookup, extend duration to 4 days

Browse source
This commit is contained in:
Oliver Ladner 2015-05-27 08:36:29 +02:00
commit 5eae4ecb43
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
rbl_expire.sh
View file

@ -2,7 +2,7 @@
#
# Expire old RBL records
maxage=48 # in hours
maxage=96 # in hours
rblfile="/var/lib/rbldns/list"
egrep '^[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}' $rblfile | while read -r ip delimiter timestamp foo; do
@ -10,7 +10,7 @@ egrep '^[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}'
expiration=$(echo "$(date +%s)-$timestamp" | bc)
if [ "$expiration" -gt "$(($maxage * 3600))" ]; then
#echo "entry $ip older than $maxage hours (expired $(($expiration / 3600)) hours ago)"
#echo "DEBUG: entry $ip older than $maxage hours (expired $(($expiration / 3600)) hours ago)"
sed -i "/^$ip.*# $timestamp.*$/d" $rblfile || echo "Error while deleting $ip: $?"
fi
fi

11
rbl_generate.sh
View file

@ -58,7 +58,7 @@ fi
# fail2ban
for ip in ${iptables_banned[@]}; do
if [[ $(grep -c $ip $rblfile) -lt 1 ]]; then
if [[ $(grep -c "$ip" $rblfile) -lt 1 ]]; then
# Add IP
geoip=$(geoiplookup $ip | sed 's/GeoIP Country Edition: //' | awk {' if($1=="IP") print $0; else print $2,$3,$4,$5,$6,$7,$8'})
printf "%s # $(date +%s) # Service login attempts/misconfiguration # %s\n" "$ip" "$geoip" >> $rblfile
@ -67,9 +67,14 @@ done
# SPAM
for ip in ${spamtrap[@]}; do
if [[ $(grep -c $ip $rblfile) -lt 1 ]]; then
if [[ $(grep -c "$ip" $rblfile) -lt 1 ]]; then
# Add IP
geoip=$(geoiplookup $ip | sed 's/GeoIP Country Edition: //' | awk {' if($1=="IP") print $0; else print $2,$3,$4,$5,$6,$7,$8'})
# IPv4 or IPv6 switch
if [ $(echo "$ip" | grep -c ':') -gt 0 ]; then
geoip=$(geoiplookup6 $ip | sed 's/GeoIP Country V6 Edition: //' | awk {' if($1=="IP") print $0; else print $2,$3,$4,$5,$6,$7,$8'})
else
geoip=$(geoiplookup $ip | sed 's/GeoIP Country Edition: //' | awk {' if($1=="IP") print $0; else print $2,$3,$4,$5,$6,$7,$8'})
fi
printf "%s # $(date +%s) # SPAM mail to trap address # %s\n" "$ip" "$geoip" >> $rblfile
fi
done