Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of research on fail2ban an it seems like it would save me quite a bit of time if I could just ban the brute attack IPs at the hardware firewall automatically. Does anyone have experience with this working? Is it a reasonable idea?

Edit: Firewall is a Juniper SSG20 running ScreenOS 6.2

share|improve this question
    
What kind of firewall? –  NorbyTheGeek Nov 4 '11 at 15:58
    
What configuration interfaces does your firewall provide? if it provides you with a shell or allows you to upload configurations remotely via tftp. Chances are there that you would be able to achieve it. –  Gaumire Nov 4 '11 at 16:08

2 Answers 2

It's going depends on what your firewall supports and what interfaces it has for such updates. Some firewalls have upload (tftp, http, etc) interfaces for config uploads, some have only Web interfaces, some have an API. If you get one with only a Web interface then you're a bit out of luck.

share|improve this answer
    
I can ssh into it I am reading the documentation the hardware firewall is a Juniper SSG20 running ScreenOS 6.2. The documentation is 776 pages....but I do have ssh console access so I am thinking there is either a feature to do this or I can push a conf to it with a script. –  Nolan Nov 4 '11 at 16:05

Here is how I hacked around my issue and it worked :) I set this as a cron to run every 10 min.

#!/bin/sh
##This Script Requires expect to be installed!!
##Grab Logs and Filter Information
cat /var/log/fail2ban.log|grep -a "Ban"|grep -v "Unban">/tmp/banned.txt
##Move last line to file
tail -n 1 /tmp/banned.txt>/tmp/lastlogline.txt
##Extract the Date and IP of the Banned IPs
cat /tmp/lastlogline.txt | cut -c 1-10,61-72 --output-delimiter=':'> /tmp/filtered.txt
## Variable Assignment and Excessive Space Removal
cat /tmp/filtered.txt|cut -d: -f 1|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/date.txt
cat /tmp/filtered.txt|cut -d: -f 2|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/IP.txt
date=`cat /tmp/date.txt`
IP=`cat /tmp/IP.txt`
## Get User Name and Password from /[Passdir]
username=`cat /filepathto/passwords|cut -d: -f 1`
password=`cat /filepathto/passwords|cut -d: -f 2`
##Set Firewall IP as Variable
firewall="[IPofFirewallHere]"
namescheme="$date"_"$IP"
command1="set address untrust $namescheme $IP/32"
command2="set group address untrust Group_Banned_IPS add $namescheme"
##Firewall Conector and Rule Enforcer
VAR=$(expect -c "
spawn ssh $username@$firewall
expect \"password:\"
send \"$password\r\"
expect \"\\\\>\"
send \"$command1\r\n\"
expect \"\\\\>\"
send \"$command2\r\"
expect -re \"$username.*\"
send \"logout\"
")
echo "==============="
echo "$VAR"
## Clean up extra text files
rm /tmp/banned.txt /tmp/IP.txt /tmp/date.txt /tmp/filtered.txt /tmp/lastlogline.txt
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.