2

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them by iptables. Here is the script:

#!/bin/bash

cd /root/
windowSize=100
tresh=10
lastb | head -n $windowSize | awk '{print $3}' | uniq -c > .ips
nlines=`wc .ips -l | awk '{print $1}'`
END=`expr $nlines - 1 `
for i in `seq 0 $END`;
do
        range=`expr $nlines - $i`
        count=`tail .ips -n $range | head -n 1 | awk '{print $1}'`
        if [ $count -gt $tresh ] ; then
                IP=`tail .ips -n $range | head -n 1 | awk '{print $2}'`
                if [ ! -z .blips ] ; then
                        touch .blips
                fi ;
                blocked=`cat .blips | grep $IP -c`
                if [ $blocked = '0' ] ; then
                        echo blocking $IP
                        iptables -A INPUT -s $IP -j DROP
                        echo $IP >> .blips
                fi ;
        fi;
done
rm .ips

Can it cause any problem if I run this script by crond every hours?

1
  • I should mention that its couple of days I am running this script on my server every 20 minutes on my server. It works fine and has detected ~9 attacker from around the world.
    – lashgar
    Sep 28, 2012 at 5:36

3 Answers 3

3

Yes, you are not taking any measures to ensure that the IP addresses you connect to the system from are excluded so you could lock yourself out of the system.

A better solution is to install fail2ban which is widely used to do just what you are trying to do.

3
  • My system is trusted to server and It connects through SSH passless connnection and would not be included in lastb log anyway. The script only blocks the last broken SSH logins not successful ones. +1 for Fail2ban. It looks interesting. Thanks.
    – lashgar
    Sep 24, 2012 at 9:59
  • @ahmad: and you never fail to login ?
    – user9517
    Sep 24, 2012 at 16:01
  • @lain: No. Why should this happen? My system's RSA key is stored in the authorized_keys on the server. Also, there is a threshold for the number of failed retires from specific IP. The threshold is set tresh=10 and can be larger to detect a brute-force attacker.
    – lashgar
    Sep 24, 2012 at 16:20
2

The suggested solution is lacking (or smart) in the sense that it does not save IPTABLES so the changes made to IPTABLES will be lost on next boot.

You should save your blocked IPs by committing them: /sbin/service iptables save

CHANGE done /sbin/service iptables save rm .ips

On the other hand, since the system is an automation, maybe it is wise to only do the commit manually after seeing the changes in .blips

1

DenyHosts or Fail2ban will work better than most homemade custom scripts.

http://en.wikipedia.org/wiki/DenyHosts

http://en.wikipedia.org/wiki/Fail2ban

1
  • While this may theoretically answer the question it would be preferred that you expand on your answer and explain the why and/or how.
    – Scott Pack
    Sep 25, 2012 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .