Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them by iptables. Here is the script:


cd /root/
lastb | head -n $windowSize | awk '{print $3}' | uniq -c > .ips
nlines=`wc .ips -l | awk '{print $1}'`
END=`expr $nlines - 1 `
for i in `seq 0 $END`;
        range=`expr $nlines - $i`
        count=`tail .ips -n $range | head -n 1 | awk '{print $1}'`
        if [ $count -gt $tresh ] ; then
                IP=`tail .ips -n $range | head -n 1 | awk '{print $2}'`
                if [ ! -z .blips ] ; then
                        touch .blips
                fi ;
                blocked=`cat .blips | grep $IP -c`
                if [ $blocked = '0' ] ; then
                        echo blocking $IP
                        iptables -A INPUT -s $IP -j DROP
                        echo $IP >> .blips
                fi ;
rm .ips

Can it cause any problem if I run this script by crond every hours?

share|improve this question
I should mention that its couple of days I am running this script on my server every 20 minutes on my server. It works fine and has detected ~9 attacker from around the world. –  ahmad Sep 28 '12 at 5:36

3 Answers 3

Yes, you are not taking any measures to ensure that the IP addresses you connect to the system from are excluded so you could lock yourself out of the system.

A better solution is to install fail2ban which is widely used to do just what you are trying to do.

share|improve this answer
My system is trusted to server and It connects through SSH passless connnection and would not be included in lastb log anyway. The script only blocks the last broken SSH logins not successful ones. +1 for Fail2ban. It looks interesting. Thanks. –  ahmad Sep 24 '12 at 9:59
@ahmad: and you never fail to login ? –  Iain Sep 24 '12 at 16:01
@lain: No. Why should this happen? My system's RSA key is stored in the authorized_keys on the server. Also, there is a threshold for the number of failed retires from specific IP. The threshold is set tresh=10 and can be larger to detect a brute-force attacker. –  ahmad Sep 24 '12 at 16:20

The suggested solution is lacking (or smart) in the sense that it does not save IPTABLES so the changes made to IPTABLES will be lost on next boot.

You should save your blocked IPs by committing them: /sbin/service iptables save

CHANGE done /sbin/service iptables save rm .ips

On the other hand, since the system is an automation, maybe it is wise to only do the commit manually after seeing the changes in .blips

share|improve this answer

DenyHosts or Fail2ban will work better than most homemade custom scripts.

share|improve this answer
While this may theoretically answer the question it would be preferred that you expand on your answer and explain the why and/or how. –  Scott Pack Sep 25 '12 at 0:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.