Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
11 years, 7 months ago
I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of research on fail2ban an it seems like it would save me quite a bit of time if I could just ban the brute attack IPs at the hardware firewall automatically. Does anyone have experience with this working? Is it a reasonable idea?
Edit: Firewall is a Juniper SSG20 running ScreenOS 6.2
Nov 4, 2011 at 15:44
31 3 3 bronze badges
It's going depends on what your firewall supports and what interfaces it has for such updates. Some firewalls have upload (tftp, http, etc) interfaces for config uploads, some have only Web interfaces, some have an API. If you get one with only a Web interface then you're a bit out of luck.
Nov 4, 2011 at 15:51
37.8k 11 11 gold badges 92 92 silver badges 146 146 bronze badges
Here is how I hacked around my issue and it worked :)
I set this as a cron to run every 10 min.
##This Script Requires expect to be installed!!
##Grab Logs and Filter Information
cat /var/log/fail2ban.log|grep -a "Ban"|grep -v "Unban">/tmp/banned.txt
##Move last line to file
tail -n 1 /tmp/banned.txt>/tmp/lastlogline.txt
##Extract the Date and IP of the Banned IPs
cat /tmp/lastlogline.txt | cut -c 1-10,61-72 --output-delimiter=':'> /tmp/filtered.txt
## Variable Assignment and Excessive Space Removal
cat /tmp/filtered.txt|cut -d: -f 1|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/date.txt
cat /tmp/filtered.txt|cut -d: -f 2|sed 's/^[\t]*//;s/[\t]*$//'>/tmp/IP.txt
## Get User Name and Password from /[Passdir]
username=`cat /filepathto/passwords|cut -d: -f 1`
password=`cat /filepathto/passwords|cut -d: -f 2`
##Set Firewall IP as Variable
command1="set address untrust $namescheme $IP/32"
command2="set group address untrust Group_Banned_IPS add $namescheme"
##Firewall Conector and Rule Enforcer
VAR=$(expect -c "
spawn ssh $username@$firewall
expect -re \"$username.*\"
## Clean up extra text files
rm /tmp/banned.txt /tmp/IP.txt /tmp/date.txt /tmp/filtered.txt /tmp/lastlogline.txt
Nov 9, 2011 at 23:30
31 3 3 bronze badges
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only