0

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of research on fail2ban an it seems like it would save me quite a bit of time if I could just ban the brute attack IPs at the hardware firewall automatically. Does anyone have experience with this working? Is it a reasonable idea?

Edit: Firewall is a Juniper SSG20 running ScreenOS 6.2

Improve this question
2
  • What kind of firewall?
    – NorbyTheGeek
    Nov 4, 2011 at 15:58
  • What configuration interfaces does your firewall provide? if it provides you with a shell or allows you to upload configurations remotely via tftp. Chances are there that you would be able to achieve it.
    – Gaumire
    Nov 4, 2011 at 16:08

2 Answers 2

Reset to default
0

It's going depends on what your firewall supports and what interfaces it has for such updates. Some firewalls have upload (tftp, http, etc) interfaces for config uploads, some have only Web interfaces, some have an API. If you get one with only a Web interface then you're a bit out of luck.

Improve this answer
1
  • I can ssh into it I am reading the documentation the hardware firewall is a Juniper SSG20 running ScreenOS 6.2. The documentation is 776 pages....but I do have ssh console access so I am thinking there is either a feature to do this or I can push a conf to it with a script.
    – Nolan
    Nov 4, 2011 at 16:05
0

Here is how I hacked around my issue and it worked :) I set this as a cron to run every 10 min.

#!/bin/sh
##This Script Requires expect to be installed!!
##Grab Logs and Filter Information
cat /var/log/fail2ban.log|grep -a "Ban"|grep -v "Unban">/tmp/banned.txt
##Move last line to file
tail -n 1 /tmp/banned.txt>/tmp/lastlogline.txt
##Extract the Date and IP of the Banned IPs
cat /tmp/lastlogline.txt | cut -c 1-10,61-72 --output-delimiter=':'> /tmp/filtered.txt
## Variable Assignment and Excessive Space Removal
cat /tmp/filtered.txt|cut -d: -f 1|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/date.txt
cat /tmp/filtered.txt|cut -d: -f 2|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/IP.txt
date=`cat /tmp/date.txt`
IP=`cat /tmp/IP.txt`
## Get User Name and Password from /[Passdir]
username=`cat /filepathto/passwords|cut -d: -f 1`
password=`cat /filepathto/passwords|cut -d: -f 2`
##Set Firewall IP as Variable
firewall="[IPofFirewallHere]"
namescheme="$date"_"$IP"
command1="set address untrust $namescheme $IP/32"
command2="set group address untrust Group_Banned_IPS add $namescheme"
##Firewall Conector and Rule Enforcer
VAR=$(expect -c "
spawn ssh $username@$firewall
expect \"password:\"
send \"$password\r\"
expect \"\\\\>\"
send \"$command1\r\n\"
expect \"\\\\>\"
send \"$command2\r\"
expect -re \"$username.*\"
send \"logout\"
")
echo "==============="
echo "$VAR"
## Clean up extra text files
rm /tmp/banned.txt /tmp/IP.txt /tmp/date.txt /tmp/filtered.txt /tmp/lastlogline.txt
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .