1

I have a Bitnami server, Ubuntu Xenial, on AWS LightSail. I followed this tutorial to restrict SSH connections by country. This script ipfilter.sh filters IP addresses:

#!/bin/bash
# License: WTFPL

# UPPERCASE space-separated country codes to ACCEPT
ALLOW_COUNTRIES="US UK"
LOGDENY_FACILITY="authpriv.notice"

if [ $# -ne 1 ]; then
  echo "Usage:  `basename $0` " 1>&2
  exit 0 # return true in case of config issue
fi

if [[ "`echo $1 | grep ':'`" != "" ]] ; then
  COUNTRY=`/usr/bin/geoiplookup6 "$1" | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`
else
  COUNTRY=`/usr/bin/geoiplookup "$1" | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`
fi
[[ $COUNTRY = "IP Address not found" || $ALLOW_COUNTRIES =~ $COUNTRY ]] && RESPONSE="ALLOW" || RESPONSE="DENY"

if [[ "$RESPONSE" == "ALLOW" ]] ; then
  logger -p $LOGDENY_FACILITY "$RESPONSE sshd connection from $1 ($COUNTRY)"
  exit 0
else
  logger -p $LOGDENY_FACILITY "$RESPONSE sshd connection from $1 ($COUNTRY)"
  exit 1
fi

And I set it up with:

sudo -y apt-get install geoip-bin geoip-database

sudo echo "sshd: ALL" > /etc/hosts.deny
sudo echo "vsftpd: ALL" >> /etc/hosts.deny

sudo echo "sshd: ALL: spawn /path/to/file/ipfilter.sh %a" > /etc/hosts.allow

I restarted the SSH daemon with sudo systemctl restart ssh.service. I attempt a connection from another country and check the files /var/log/syslog and /var/log/auth.log, which do not show this event. The file /etc/rsyslog.conf does not show the location of logging for the authpriv facility.

How can I check that this IP filter is working?

2
  • Does the used operating system use the denyhosts files (/etc/hosts.deny)? – sebix Jan 8 at 20:53
  • @sebix To test the filter, I did it immediately with another virtual machine and did not find evidence in the logs I listed. I added the OS version: Ubuntu Xenial, which seems to use those files. – miguelmorin Jan 8 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.