Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them by iptables. Here is the script:

#!/bin/bash

cd /root/
windowSize=100
tresh=10
lastb | head -n $windowSize | awk '{print $3}' | uniq -c > .ips
nlines=`wc .ips -l | awk '{print $1}'`
END=`expr $nlines - 1 `
for i in `seq 0 $END`;
do
        range=`expr $nlines - $i`
        count=`tail .ips -n $range | head -n 1 | awk '{print $1}'`
        if [ $count -gt $tresh ] ; then
                IP=`tail .ips -n $range | head -n 1 | awk '{print $2}'`
                if [ ! -z .blips ] ; then
                        touch .blips
                fi ;
                blocked=`cat .blips | grep $IP -c`
                if [ $blocked = '0' ] ; then
                        echo blocking $IP
                        iptables -A INPUT -s $IP -j DROP
                        echo $IP >> .blips
                fi ;
        fi;
done
rm .ips

Can it cause any problem if I run this script by crond every hours?

share|improve this question
    
I should mention that its couple of days I am running this script on my server every 20 minutes on my server. It works fine and has detected ~9 attacker from around the world. –  ahmad Sep 28 '12 at 5:36

2 Answers 2

Yes, you are not taking any measures to ensure that the IP addresses you connect to the system from are excluded so you could lock yourself out of the system.

A better solution is to install fail2ban which is widely used to do just what you are trying to do.

share|improve this answer
    
My system is trusted to server and It connects through SSH passless connnection and would not be included in lastb log anyway. The script only blocks the last broken SSH logins not successful ones. +1 for Fail2ban. It looks interesting. Thanks. –  ahmad Sep 24 '12 at 9:59
    
@ahmad: and you never fail to login ? –  Iain Sep 24 '12 at 16:01
    
@lain: No. Why should this happen? My system's RSA key is stored in the authorized_keys on the server. Also, there is a threshold for the number of failed retires from specific IP. The threshold is set tresh=10 and can be larger to detect a brute-force attacker. –  ahmad Sep 24 '12 at 16:20

DenyHosts or Fail2ban will work better than most homemade custom scripts.

http://en.wikipedia.org/wiki/DenyHosts

http://en.wikipedia.org/wiki/Fail2ban

share|improve this answer
    
While this may theoretically answer the question it would be preferred that you expand on your answer and explain the why and/or how. –  Scott Pack Sep 25 '12 at 0:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.